[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_2610":2611,"_2612":59,"_2613":15,"_2614":15,"_2615":15,"_2616":15,"_2617":15,"_2618":15,"_2619":2620},"routes/s.$postId",{"_9":10,"_11":12,"_13":-7,"_14":15,"_16":15,"_17":-5,"_18":19},"kind","post_with_profile","postWithProfile",{"_20":21,"_22":23},"referrer","preferIntrinsicAspectRatioForOgImage",false,"enforceRenderedOgImg","ogImageVariantOverride","defaultOgDescription","ChatGPT helps you get answers, find inspiration, and be more productive.","post",{"_42":43,"_44":45,"_46":-5,"_47":-5,"_48":-5,"_49":-5,"_50":51,"_52":53,"_35":54,"_55":56,"_57":15},"profile",{"_24":25,"_26":25,"_27":28,"_29":-5,"_30":-5,"_31":32,"_33":15,"_34":-5,"_35":-5,"_36":-5,"_37":15,"_38":-5,"_39":-5,"_40":-5,"_41":15},"user_id","anonymous","username","profile_picture_url","https://cdn.openai.com/sora/images/profile_placeholder_v4.png","profile_picture_id","is_default_profile_picture","follower_count",0,"is_following","display_name","permalink","can_cameo","verified","character_count","owner_profile","social_context","follows_you","id","cd_6a6065d1c50c819192652251b4a6560f","posted_at",1784702417.769854,"text","og_title","og_description","og_image_variant","attachments",[65],"preview_image_url","https://ogimg.chatgpt.com/?postId=cd_6a6065d1c50c819192652251b4a6560f","https://chatgpt.com/s/cd_6a6065d1c50c819192652251b4a6560f","permissions",{"_58":59,"_60":15,"_61":15,"_62":59,"_63":64},"use_experimental_unfurl","can_read",true,"can_write","can_delete","can_remix","share_setting","public",{"_42":66,"_67":68,"_9":69,"_70":71,"_72":73,"_74":75,"_76":77,"_78":79,"_80":-5},"cd_6a6065d1c50c819192652251b4a6560f-attachment-0","tags",[],"codex","task",{"_42":2570,"_120":2571,"_339":2572,"_2573":59,"_83":84,"_2574":15,"_2575":2576,"_302":59,"_2577":2578,"_2579":-5,"_2580":2581},"current_user_turn",{"_93":351,"_42":85,"_97":351,"_1543":2562,"_1545":2563,"_1547":1548,"_133":-5,"_120":1549},"current_assistant_turn",{"_93":94,"_42":84,"_95":-5,"_96":-5,"_97":94,"_98":2072,"_100":2073,"_102":103,"_104":-5,"_105":2074,"_107":2075,"_109":2076,"_111":2077,"_113":114,"_115":-5,"_116":117,"_118":2078,"_120":121,"_122":-5,"_123":124,"_125":2079,"_127":128,"_129":130,"_131":-5,"_132":-5,"_133":85,"_134":2080,"_136":2081,"_138":-5,"_139":15,"_140":141,"_142":-5},"current_diff_task_turn",{"_93":94,"_42":84,"_95":-5,"_96":-5,"_97":94,"_98":1582,"_100":1583,"_102":103,"_104":-5,"_105":1584,"_107":1585,"_109":1586,"_111":1587,"_113":114,"_115":-5,"_116":117,"_118":1588,"_120":121,"_122":-5,"_123":124,"_125":1589,"_127":128,"_129":130,"_131":-5,"_132":-5,"_133":85,"_134":1590,"_136":1591,"_138":-5,"_139":15,"_140":141,"_142":-5},"turns",{"_81":82,"_83":84},"example_task_info","turn_mapping",{"_85":86,"_84":87},"current_turn_id","task_e_6a6065ce89388322872a29f77ac543ba~assttrn_e_6a6065cfdfb88322ac11ce8d102c0285","task_e_6a6065ce89388322872a29f77ac543ba~usertrn_e_6a6065cfbf14832299b4e95cde9e7d6b",{"_42":85,"_88":1541,"_90":1542,"_92":-5},{"_42":84,"_88":89,"_90":91,"_92":85},"turn",{"_93":94,"_42":84,"_95":-5,"_96":-5,"_97":94,"_98":99,"_100":101,"_102":103,"_104":-5,"_105":106,"_107":108,"_109":110,"_111":112,"_113":114,"_115":-5,"_116":117,"_118":119,"_120":121,"_122":-5,"_123":124,"_125":126,"_127":128,"_129":130,"_131":-5,"_132":-5,"_133":85,"_134":135,"_136":137,"_138":-5,"_139":15,"_140":141,"_142":-5},"children",[],"parent","type","assistant","sibling_turn_ids","attempt_placement","role","output_items",[1139,1140,1141],"child_turns",[],"conversation_id","None","error","latest_event",{"_1134":1135,"_46":1136,"_1137":1138},"worklog",{"_1108":1109},"app_server_events",{"_361":1107},"thread_events",{"_361":362},"turn_status","completed","cancellation_requested_at","pull_request_status","externally_created","pull_request_data",{"_331":332,"_322":333,"_334":335,"_336":15,"_337":15,"_338":15,"_339":340,"_341":342,"_343":294,"_344":128,"_345":346,"_347":130,"_348":-5,"_349":-5,"_350":-5,"_351":352,"_353":354,"_355":354,"_356":357,"_358":359},"created_at",1784702415.87402,"internal_only_rollouts","environment_id","6a4f4a07a864819196abaa21176f9e31","environment",{"_42":124,"_220":221,"_222":223,"_224":15,"_225":226,"_227":228,"_229":230,"_231":-5,"_232":-5,"_233":15,"_234":235,"_236":237,"_238":237,"_239":240,"_241":242,"_243":244,"_245":-5,"_246":247,"_248":249,"_250":251,"_252":253,"_55":-5,"_120":254,"_255":256,"_257":258,"_259":260,"_261":15,"_262":15},"branch","claude/capture-governance-audit-deferrals","base_commit_sha","eb2a83c18bf14a6a5722de91cf69fcc235767cf1","branch_name","direct_push_pushed_commit_sha","previous_turn_id","logs",{"_134":200},"proxy_events",[143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158],"debug_metadata","discarded","model_version","gpt-5.5","languages",{"_159":199,"_161":162,"_163":164,"_165":177,"_167":178,"_169":170,"_171":32,"_173":-5},{"_159":195,"_161":196,"_163":197,"_165":177,"_167":198,"_169":170,"_171":32,"_173":-5},{"_159":194,"_161":162,"_163":164,"_165":175,"_167":168,"_169":170,"_171":32,"_173":-5},{"_159":192,"_161":162,"_163":164,"_165":166,"_167":168,"_169":170,"_171":193,"_173":-5},{"_159":191,"_161":162,"_163":164,"_165":177,"_167":178,"_169":170,"_171":32,"_173":-5},{"_159":190,"_161":162,"_163":164,"_165":175,"_167":168,"_169":170,"_171":32,"_173":-5},{"_159":188,"_161":162,"_163":164,"_165":166,"_167":168,"_169":170,"_171":189,"_173":-5},{"_159":187,"_161":162,"_163":164,"_165":177,"_167":186,"_169":170,"_171":32,"_173":-5},{"_159":185,"_161":162,"_163":164,"_165":175,"_167":186,"_169":170,"_171":32,"_173":-5},{"_159":184,"_161":162,"_163":164,"_165":177,"_167":178,"_169":170,"_171":32,"_173":-5},{"_159":183,"_161":162,"_163":164,"_165":175,"_167":168,"_169":170,"_171":32,"_173":-5},{"_159":181,"_161":162,"_163":164,"_165":166,"_167":168,"_169":170,"_171":182,"_173":-5},{"_159":179,"_161":162,"_163":164,"_165":166,"_167":168,"_169":170,"_171":180,"_173":-5},{"_159":176,"_161":162,"_163":164,"_165":177,"_167":178,"_169":170,"_171":32,"_173":-5},{"_159":174,"_161":162,"_163":164,"_165":175,"_167":168,"_169":170,"_171":32,"_173":-5},{"_159":160,"_161":162,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":-5},"timestamp","2026-07-22T06:40:56.160491","decision","allow","reason","checks passed","method","POST","domain","github.com","protocol","HTTP/1.1","size",365,"path","2026-07-22T06:40:56.060419","GET","2026-07-22T06:40:55.972160","CONNECT","github.com:443","2026-07-22T06:40:55.727821",606,"2026-07-22T06:40:55.600538",305,"2026-07-22T06:40:55.493390","2026-07-22T06:40:55.398799","2026-07-22T06:40:32.010516","chatgpt.com:18080","2026-07-22T06:40:31.950680","2026-07-22T06:40:25.211863",179,"2026-07-22T06:40:25.157306","2026-07-22T06:40:25.002228","2026-07-22T06:40:24.658704",102,"2026-07-22T06:40:24.607285","2026-07-22T06:40:24.520379","block","domain is not in allowlist","chatgpt.com:443","2026-07-22T06:40:24.465380",[201,202,203],{"_204":216,"_206":217},{"_204":212,"_206":213},{"_204":205,"_206":207},"key",{"_208":209,"_93":210,"_120":211},"value","file_000000008844820cafbb48d37cbed06c","name","setup_autodetect","UserSetupScript","2026-07-22T06:08:35.802925",{"_208":214,"_93":210,"_120":215},"file_00000000b9d4822fb4b1cd30a09e40fa","auto_setup","2026-07-22T06:08:47.564313",{"_208":218,"_93":210,"_120":219},"file_00000000f36481f5b10931c973ec3e6e","warm_up_git_repo_1784702420","2026-07-22T06:40:20.702119","machine_id","wham-public/wham-universal","label","BigSimmo/Database","is_pinned","description","Database environment","workspace_dir","/workspace","agent_network_access",{"_324":325,"_326":69,"_327":-5,"_328":-5,"_329":-5,"_330":-5},"codex_github_direct","github_connector_id","enable_gitlab_webhooks","repos",[284],"setup","","maintenance_setup","repo_map",{"_284":285},"env_vars",{"_266":267,"_268":269,"_270":271,"_272":273,"_274":275,"_276":277,"_278":279,"_280":281,"_282":283},"secrets",{},"secrets_with_domains","task_count",1175,"creator_id","user-meqzK8tcEkFfh4X5tXfIqXyp","share_settings","workspace","share_targets",[],1783581192.606357,"auto_setup_settings",{"_265":59},"cache_settings",{"_263":59,"_264":237},"etag","\"0400444a-0000-0200-0000-6a6065ab0000\"","enable_authtranslator","enable_docker_in_docker","post_setup_cache_enabled","cache_invalidation_key","use_auto_setup","CODEX_ENV_PYTHON_VERSION","3.12","CODEX_ENV_NODE_VERSION","20","CODEX_ENV_RUBY_VERSION","3.4.4","CODEX_ENV_RUST_VERSION","1.89.0","CODEX_ENV_GO_VERSION","1.24.3","CODEX_ENV_BUN_VERSION","1.2.14","CODEX_ENV_PHP_VERSION","8.4","CODEX_ENV_JAVA_VERSION","21","CODEX_ENV_SWIFT_VERSION","6.1","github-1243497866",{"_42":286,"_208":287,"_288":289,"_290":223,"_291":292,"_293":294,"_295":296,"_297":298,"_299":300,"_301":64,"_302":15,"_303":-5,"_304":-5,"_305":-5,"_306":-5,"_307":-5,"_308":-5,"_171":309,"_310":-5,"_55":311},"1243497866","Database","owner",{"_316":317,"_42":318,"_93":319,"_320":321,"_322":323},"repository_full_name","clone_url","https://github.com/BigSimmo/Database.git","default_branch","main","git_commits_url","https://api.github.com/repos/BigSimmo/Database/git/commits{/sha}","git_refs_url","https://api.github.com/repos/BigSimmo/Database/git/refs{/sha}","git_url","git://github.com/BigSimmo/Database.git","visibility","archived","allow_auto_merge","allow_merge_commit","allow_rebase_merge","allow_squash_merge","allow_update_branch","language",63073,"master_branch",{"_312":15,"_313":15,"_314":15,"_315":15},"admin","maintain","push","pull","login","BigSimmo",87357024,"User","avatar_url","https://avatars.githubusercontent.com/u/87357024?v=4","url","https://api.github.com/users/BigSimmo","mode","on","preset_allowlist","allowlist_domains","allowlist_rules","denylist_domains","safe_methods_only","number",1072,"https://github.com/BigSimmo/Database/pull/1072","state","open","merged","mergeable","draft","title","docs(issues): capture source-governance audit deferrals (#025-#030)","body","## Summary\n\nThe source-governance audit shipped its regression-safe subset in #1051 and deferred the rest. Those deferrals existed only in #1051's PR body and session context — so once #1051 merges they'd effectively vanish from the repo's durable memory. This captures them in `docs/outstanding-issues.md` (6 rows, `#025`–`#030`).\n\n**The important one is `#025`.** The audit reported three ranking \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at `0`, and `selectBestSourceRecommendation` ignores governance metadata. Filing those as open tasks would have been actively harmful — they are **deliberate, measured decisions, not debt**:\n\n> Blanket governance metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to **16/23** (doc-recall@5 **1.0 → 0.76**, mrr 0.75 → 0.64). The corpus is only partially metadata-enriched and `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so **\"unknown\" ≠ \"bad\"**, and blanket weighting swings ranking ~0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected, PR #118).\n\nSo `#025` is written as a **guardrail with the measurement attached**, not a todo — it exists to stop a future session \"fixing\" a known regression back into the ranker.\n\nThe rest are genuine, correctly-scoped follow-ups:\n\n| Row | Item |\n| --- | --- |\n| `#026` | Governance metadata absent from the LLM prompt (generation-surface; needs `eval:rag` + approval; same \"unknown ≠ bad\" hazard) |\n| `#027` | Answer cache can serve stale governance metadata — **already mitigated** by explicit invalidation; residual risk only, next action is a regression test |\n| `#028` | Threshold-conflict detection covers only ANC/WBC/platelets (broadening carries false-positive risk) |\n| `#029` | No explicit `is_public` flag — visibility is implicit `owner_id IS NULL` |\n| `#030` | D5 `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` parked OFF (product decision) |\n\nAudit item 12 (canary automation) is **deliberately not filed** — already covered by the blocking `pr-policy` RAG-impact gate plus the weekly scheduled 44-case canary. Filing it would be a false todo.\n\n## Verification\n\n- [x] `npx prettier --check docs/outstanding-issues.md` — clean\n- [x] `npm run docs:check-links` — passed, 1103 repo path references resolve\n\nDocs-only; no code, no behaviour, no provider calls. The non-`#025`–`#030` line changes are prettier re-padding the aligned markdown table (whitespace only) because the new Detail cells are the widest in the column.\n\n## Risk and rollout\n\n- Risk: none — documentation only.\n- Rollback: single-commit revert.\n- Provider or production effects: None.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\n\n\n## Summary by CodeRabbit\n\n* **Documentation**\n * Expanded the list of outstanding items with six newly tracked entries.\n * Updated the issue numbering marker to reflect the next available item ID.\n\n","base","head","base_sha","ee0c0185e96f8991d7e7a25b02f31b4a98d1cfe8","head_sha","merge_commit_sha","comments","diff","user",{"_316":317,"_208":317,"_360":-5,"_320":321,"_42":318},"commits",1,"changed_files","additions",28,"deletions",22,"email","events",[363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445],{"_165":1079,"_447":1080},{"_165":464,"_447":1074},{"_165":1069,"_447":1070},{"_165":468,"_447":1060},{"_165":468,"_447":1052},{"_165":468,"_447":1046},{"_165":486,"_447":1035},{"_165":486,"_447":1030},{"_165":468,"_447":1022},{"_165":486,"_447":1019},{"_165":468,"_447":1011},{"_165":468,"_447":1006},{"_165":486,"_447":991},{"_165":468,"_447":986},{"_165":468,"_447":981},{"_165":468,"_447":977},{"_165":486,"_447":966},{"_165":486,"_447":961},{"_165":468,"_447":953},{"_165":468,"_447":948},{"_165":486,"_447":938},{"_165":468,"_447":933},{"_165":486,"_447":928},{"_165":468,"_447":920},{"_165":468,"_447":915},{"_165":486,"_447":906},{"_165":468,"_447":901},{"_165":486,"_447":896},{"_165":468,"_447":888},{"_165":468,"_447":883},{"_165":468,"_447":879},{"_165":486,"_447":868},{"_165":468,"_447":863},{"_165":486,"_447":853},{"_165":468,"_447":848},{"_165":486,"_447":843},{"_165":468,"_447":835},{"_165":468,"_447":830},{"_165":468,"_447":826},{"_165":486,"_447":808},{"_165":486,"_447":803},{"_165":468,"_447":795},{"_165":468,"_447":790},{"_165":486,"_447":781},{"_165":468,"_447":776},{"_165":486,"_447":771},{"_165":468,"_447":763},{"_165":468,"_447":758},{"_165":468,"_447":754},{"_165":486,"_447":743},{"_165":486,"_447":738},{"_165":468,"_447":730},{"_165":468,"_447":725},{"_165":468,"_447":721},{"_165":486,"_447":710},{"_165":486,"_447":705},{"_165":468,"_447":697},{"_165":468,"_447":692},{"_165":468,"_447":688},{"_165":486,"_447":677},{"_165":486,"_447":672},{"_165":468,"_447":664},{"_165":468,"_447":654},{"_165":468,"_447":627},{"_165":468,"_447":622},{"_165":486,"_447":613},{"_165":468,"_447":608},{"_165":486,"_447":603},{"_165":468,"_447":595},{"_165":468,"_447":589},{"_165":486,"_447":567},{"_165":468,"_447":562},{"_165":486,"_447":557},{"_165":468,"_447":549},{"_165":468,"_447":540},{"_165":486,"_447":519},{"_165":468,"_447":511},{"_165":486,"_447":506},{"_165":468,"_447":492},{"_165":486,"_447":487},{"_165":468,"_447":469},{"_165":464,"_447":465},{"_165":446,"_447":448},"turn/completed","params",{"_449":450,"_88":451},"threadId","019f888d-d625-7b63-b3ca-4132eddff4c6",{"_452":453,"_454":455,"_104":-5,"_42":456,"_457":458,"_459":460,"_461":462,"_463":114},"completedAt",1784702529,"durationMs",99034,"019f888d-da19-79b2-bf38-932d829cc0ed","items",[],"itemsView","notLoaded","startedAt",1784702430,"status","thread/status/changed",{"_463":466,"_449":450},{"_93":467},"idle","rawResponseItem/completed",{"_470":471,"_449":450,"_472":456},"item",{"_473":474,"_475":-5,"_42":476,"_477":478,"_479":480,"_97":94,"_93":481},"turnId","content",[483],"end_turn","msg_040c0fdc22270fa6016a60663d8ae881979494992f0acf3817","internal_chat_message_metadata_passthrough",{"_482":456},"phase","final_answer","message","turn_id",{"_46":484,"_93":485},"**Summary**\n* Resolved the outstanding-issues ledger merge conflict by keeping the latest `main` ledger entries, preserving the source-governance audit deferrals, renumbering them to `#029`–`#034`, and advancing `issues:next-id` to `035`. 【F:docs/outstanding-issues.md†L30-L64】\n* Kept the merged `main` webhook documentation updates in the conflict-resolution commit, including the expanded webhook integration overview and setup guidance. 【F:docs/webhooks.md†L1-L11】\n* Committed the conflict resolution on the current branch with commit `a2b4d56` (`docs(issues): resolve outstanding issues ledger conflict`).\n* Created PR metadata with title: `docs(issues): resolve ledger conflict on governance deferrals`.\n\n**Testing**\n* ✅ `git diff --check`\n* ✅ `npx prettier --check docs/outstanding-issues.md`\n* ✅ `npm run docs:check-links`\n\n**Status**\n* Current branch: `work`\n* Worktree: clean after commit\n* Push: not performed in this environment.","output_text","item/completed",{"_488":489,"_470":490,"_449":450,"_472":456},"completedAtMs",1784702529088,{"_42":476,"_479":480,"_46":484,"_93":491},"agentMessage",{"_470":493,"_449":450,"_472":456},{"_473":-5,"_494":495,"_42":496,"_477":497,"_498":499,"_93":500},"encrypted_content","gAAAAABqYGY9gt0oPm5jNSVekkjKYz1NBq5fa1Zv7FpVCQI-r4-Q_UaVWsr2a4_amYL-oTGSF0RGLRZwN8jATbL-RLE_gCbL7qr0TDXMnzugnWrxNDiAX-2M-mP-wNgs5E39dKQoY2LnhHkqlyhIFCO67RgjXnscJOz7fYQ735QtK3pWR54FougeG8tvrq5nh-6h3L7s8lfQ-l8nuWrAFWesB1xH6OOyCz0uiMRHmdEnfPnUBt59Kcyl1G0tzNLwjg4wOdeGdw-hMkMUpF_5vRMuBqgSTTtAFX5JNoDHKG50qK-nTDeBpZioXQhoQZhwEj8N_emAV_b0d5A-0bHfEXT0UgWHV-03ssornB2RhW0MBwtuCAiKbm4eGOsa40IBdvbylcP1gYKI4s7s5Nh5J-okLZ3em4UeoiTatmdbKryntip1Pogxiak3oJ40AnMPdVlOsTLZf5SllCbyT-TfzxOCwYQqJovX3PRM5lJ9GlHHyY92oxDjV_w2cOiL3uQe1iREjRtKCNKB9tAGt_iRcmRIkOD4jowurpvyHvsvbCQbDVmRF3OgaJ6BgXW5Rfw0IghTxYiOAPvCcvp_uW79Q6sYBMMgKwEyov4xGDeKZgFZPIheFc96dvWH2B7yidiYSXnGaDkSttZtlHm5eFjeYtNZEAXMKM2aCZ9U05XW1CvCA4nm4U28P7LtLWzJwLEnHgr8VWpGV4b0sk8-IbFn8y0JEvhNGlz79JizXLrry-9RFyo-QUT2UvMdel4tFFxKjO3g8H5vtrMrUhatTOZESZMXEadrubuDzGZ_zaLjkEDnhw-FxqkC7NBlXcxOnItzjcE7cX9TFUn9bsu-rnGBYFphdn0X-8FjTKMjo9YybSTDogzBjBiiYQz2Jn4fXP-TaAPp232J8t83PGe1HQ1DW5LzXvxotNQu9ro3qWSER54GAWhWULWOgnbugv9dh85yiaHzmPKn5aff05ehN7Knu-o8eFcdtYJfXfPoZFZm9CeCRqEv_tKYJlNqFPGNtVZ5L-Izb6Htz67bwblixg1LTq2cOYZLJjEoGdHMS40BlOsUs2nk7ybTZt8uwJBlH-tRRWLC0YU6dBWjUI3dBPx6UjyJ0PdGJeyFT2iMHdLuM40IVNFNcXQ03-tyT8GmJkgBxsS2bpksgZ37iGdVvnrPJTArs_xhSZAuR0oZDHPuEvvxElsJc76EsnZOHJ7ccAZ9uKHxheLVAaFcdrZZFN1PaCTrtM8MphbQUvlaQfM1sw9tgPaI-s2PfKiw4EmPnIYlTGPk38cZYSy3AvUiHgW8inTe-H8NguOCBuNZ9lYW8JpZ_6zaGeYmTxykVr05aAwQqnh-vFhB8QqK1OKG1NWtbwTNnHQxbWyWtM18aW0HCyaHwAmyItF9iOrlDJsaq7pl5TXAzXokbKbJYE2YSx1TU9h33Mo06cZe6618Ch8kmC2xrfbQwmK1j7ghXZD6O2QYFfLnlWiUywX1Llvgx3tdnGfts_9GqOlKLm8F8OJZvzyQaxgeJZr95T976xnYancXDvzWZyt6IY13-4KPvUqUBgQWuBkOYORYbQ3m33ppxuJMUzjV0C-KH2XkRbngmvZ8OrohrWCGDd8wwSDXItolDSoYBX1BfAVd8b2WbMre0i1eSNYEFgumWGg7sFnhN0BEqYykDetfHwaPlYLZe4vsQDrN75vK2zqmAZ5M5WyyjrtG-y_4F7jPcjEVsjtBtJOCUl41fu0eKD1hbcX8_DCOZCZdyDODYASSHQflU21Ra3oGpS1Bl9SqSBVI8O7ukaqft_Dh80vs66z4mQW7CpyN4e-dgQleHHk4M1bLz2ujGax_r1OxKQxv0UxoXMx7EVnqa-6q1AafhX_7ylVsikIAqQy8DWlOodjgPC6eRxveDLA9G6nnR-7U8b34MPuNpDQfFtreUXsjM2zw6dEDYrtVeeaG-ai1S6wDuHrIykUhOoAEv2g801uWbhpxEn-gl-tcTfPv2q7QgZDfhTGRwOVHvz5KTKYmPWc6GxrJFcrB3Phv47r6vlyX9lMZ_uybZWIGexUnTsoXf_oJSPtzN32n34BRFy6LlYRJ_PCXI33QGagiGIsh4-bFX0DuOpo1Kov9RXmJ9eogQILsapTX6iFa2rRcnuofAwPjXg==","rs_040c0fdc22270fa6016a606639867c81978d1c1ed5ffeca684",{"_482":456},"summary",[501,502],"reasoning",{"_46":505,"_93":504},{"_46":503,"_93":504},"**Adding testing checks and PR metadata notes**","summary_text","**Deciding test inclusion and git notes**",{"_488":507,"_470":508,"_449":450,"_472":456},1784702525558,{"_473":509,"_42":496,"_498":510,"_93":500},[],[505,503],{"_470":512,"_449":450,"_472":456},{"_513":514,"_42":-5,"_477":515,"_516":517,"_93":518},"call_id","call_xWT66E8fiVYOdSDdyxxPKjKL",{"_482":456},"output","Chunk ID: f3576e\nWall time: 0.0024 seconds\nProcess exited with code 0\nOriginal token count: 18196\nOutput:\nWarning: truncated output (original token count: 18196)\nTotal output lines: 125\n\n## work\na2b4d56 docs(issues): resolve outstanding issues ledger conflict\n\n docs/outstanding-issues.md | 60 +++++-----\n docs/webhooks.md | 268 +++++++++++++++++++++++++++++++++++++++++++--\n 2 files changed, 288 insertions(+), 40 deletions(-)\n 28\t rows are archived, not deleted, so the history stays auditable.\n 29\t\n 30\t\n 31\t\n 32\t## Open items\n 33\t\n 34\t| ID | Pri | Type | Summary | Detail / next action | Source | Added |\n 35\t| ---- | --- | ----- | ------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n 36\t| #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 |\n 37\t| #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 |\n 38\t| #006 | P2 | issue | Globe \"Language & region\" button had no handler | Fixed in this PR to the disabled \"Coming soon\" placeholder convention (`aria-disabled` + sr-only note). Wire to a real language/region settings screen when one exists, then drop the placeholder state. | `src/components/clinical-dashboard/master-search-header.tsx:1829`; session 2026-07-21 | 2026-07-21 |\n 39\t| #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 |\n 40\t| #009 | P3 | rec | Confirm `/api/jobs` is intentionally server/ops-only | No client `fetch()` reaches `/api/jobs` (only tests import it). Confirm it is a deliberate ops/manual surface; if abandoned, remove it. | `src/app/api/jobs/route.ts` | 2026-07-21 |\n 41\t| #010 | P3 | task | Un-built \"Coming soon\" controls across forms/favourites | ~10 disabled placeholders (forms refine/reset, favourites sort/add/new-set, move-to-set, remove-favourite). Correctly flagged (`aria-disabled` + \"Coming soon\"), not defects — wire when the underlying features land. | `forms-search-results-page.tsx`; `favourites-hub.tsx`; `favourites-command-library-page.tsx` | 2026-07-21 |\n 42\t| #011 | P3 | task | Auth DB-connection allocation is operator-only | Supabase Auth (GoTrue) is capped at ~10 absolute DB connections (Supabase perf advisor). Switch to **percentage-based** allocation in the Supabase **dashboard** before the first compute scale-up — **not settable via SQL/MCP** (operator-owned). Verify via a staging soak + an approval-gated read-only advisor re-check. | `docs/auth-connection-cap-runbook.md`; `docs/process-hardening.md` (Known follow-up debts) …8196 tokens truncated… | 2026-07-22 |\n 58\t| #028 | P3 | rec | Runtime error tracking (Sentry or similar) | No error tracking in the repo — production exceptions on `psychiatry.tools`, including how often `RAG_PROVIDER_MODE=auto` silently degrades to source-only, are invisible. Weigh adding `@sentry/nextjs` (dependency + DSN secret + instrumentation) vs cost; alert → chat/issue. Provider-backed; needs explicit sign-off before adding the dependency. | session 2026-07-22 webhook review | 2026-07-22 |\n 59\t| #029 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so \"unknown\" ≠ \"bad\" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 |\n 60\t| #030 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same \"unknown ≠ bad\" hazard as #029 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |\n 61\t| #031 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 |\n 62\t| #032 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |\n 63\t| #033 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |\n 64\t| #034 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 |\n 65\t\n 66\t## Resolved / archive\n 1\t# Webhooks\n 2\t\n 3\tThis repo ships three webhook integrations. Two are inbound receivers under\n 4\t`src/app/api/webhooks/`; one is an outbound GitHub Actions notifier. All three\n 5\tshare the same optional chat destinations.\n 6\t\n 7\t| # | Integration | Direction | Entry point |\n 8\t| --- | ------------------------------------ | --------- | --------------------------------------------- |\n 9\t| 1 | Railway deploy → chat | inbound | `POST /api/webhooks/railway` |\n 10\t| 2 | GitHub CI failure → chat | outbound | `.github/workflows/notify-ci-failure.yml` |\n 11\t| 3 | Supabase document change → ingestion | inbound | `POST /api/webhooks/supabase/document-change` |\n 12\t\n 13\t## Chat destinations (shared)\n 14\t\n 15\tSet either, both, or neither. A receiver with no destination configured still\n 16\taccepts the event and reports it as undelivered.\n 17\t\n 18\t- `SLACK_WEBHOOK_URL` — a Slack incoming webhook (`{ \"text\": … }`).\n 19\t- `DISCORD_WEBHOOK_URL` — a Discord webhook (`{ \"content\": … }`).\n 20\t\n 21\tThe GitHub workflow reads these from repository **secrets** of the same name; the\n 22\tinbound receivers read them from server env (`src/lib/env.ts`).\n 23\t\n 24\tStore every secret below in Railway/GitHub secret stores — never in the repo.\n 25\t\n 26\t## 1. Railway deploy → chat\n 27\t\n 28\t`POST /api/webhooks/railway` forwards notable Railway deploy status changes\n 29\t(`SUCCESS`, `FAILED`, `CRASHED`, `REMOVED`) for the app + worker services to chat.\n 30\tThis reports the deploy outcome GitHub cannot see.\n 31\t\n 32\t**Auth.** Railway lets you configure only a target URL (no custom headers or\n 33\tsigning), so the shared secret `RAILWAY_WEBHOOK_SECRET` (min 16 chars) travels as\n 34\ta `?token=` query parameter and is compared constant-time. The receiver fails\n 35\tclosed (`503`) when the secret is unset and returns `401` on a bad token.\n 36\t\n 37\t**Setup.** Railway → Project → Settings → Webhooks → add:\n 38\t\n 39\t```\n 40\thttps://psychiatry.tools/api/webhooks/railway?token=\n 41\t```\n 42\t\n 43\tTransient phases (`BUILDING`, `DEPLOYING`, `QUEUED`, …) are dropped to keep the\n 44\tchannel quiet; the receiver answers `200 { \"skipped\": true }` for them.\n 45\t\n 46\t> Chat destination: this receiver forwards through `postChatNotification`, which\n 47\t> reads `SLACK_WEBHOOK_URL`/`DISCORD_WEBHOOK_URL` from **server env** — set them on\n 48\t> the Railway `Database` service, not only as GitHub repo secrets. With the token\n 49\t> set but no chat URL in server env the receiver authenticates and returns\n 50\t> `200 { \"forwarded\": false }`, so deploy alerts are silently undelivered. The\n 51\t> repo secrets in §2 cover only the GitHub CI-failure workflow.\n 52\t\n 53\t> Note: the receiver runs inside the app being deployed, so a notification about\n 54\t> a deploy that takes the app fully down may not be delivered. Pair it with an\n 55\t> external uptime monitor for hard-down detection.\n 56\t\n 57\t## 2. GitHub CI failure → chat\n 58\t\n 59\t`.github/workflows/notify-ci-failure.yml` triggers on `workflow_run: completed`\n 60\tfor the key workflows (CI, SAST, Secret Scan, PR Policy, and the scheduled\n 61\tmonitors) and pings chat when a run on `main` or `release/*` fails.\n 62\t\n 63\t**Setup.** Add repository secrets `SLACK_WEBHOOK_URL` and/or `DISCORD_WEBHOOK_URL`.\n 64\tNo secret → the workflow logs \"nothing to notify\" and exits cleanly. It posts with\n 65\t`curl` only (no external actions), so the pinned-action allowlist is not involved.\n 66\t\n 67\t## 3. Supabase document change → ingestion\n 68\t\n 69\t`POST /api/webhooks/supabase/document-change` turns the polling ingestion path\n 70\tinto an event-driven one: when a `public.documents` row is inserted outside the\n 71\tapp upload flow, or an existing row is flagged for reindex, the receiver enqueues\n 72\tone `ingestion_jobs` row that the worker then claims.\n 73\t\n 74\t**Auth.** Supabase Database Webhooks can send custom headers, so the shared secret\n 75\t`SUPABASE_INGESTION_WEBHOOK_SECRET` (min 16 chars) is sent as\n 76\t`Authorization: Bearer ` (or `x-webhook-secret`) and compared\n 77\tconstant-time. Fails closed (`503`) when unset, `401` on a bad secret.\n 78\t\n 79\t**When it enqueues (idempotent + loop-safe):**\n 80\t\n","function_call_output",{"_488":520,"_470":521,"_449":450,"_472":456},1784702519952,{"_522":523,"_524":525,"_526":527,"_528":529,"_454":530,"_531":32,"_42":514,"_532":533,"_534":535,"_463":114,"_93":536},"aggregatedOutput","## work\na2b4d56 docs(issues): resolve outstanding issues ledger conflict\n\n docs/outstanding-issues.md | 60 +++++-----\n docs/webhooks.md | 268 +++++++++++++++++++++++++++++++++++++++++++--\n 2 files changed, 288 insertions(+), 40 deletions(-)\n 28\t rows are archived, not deleted, so the history stays auditable.\n 29\t\n 30\t\n 31\t\n 32\t## Open items\n 33\t\n 34\t| ID | Pri | Type | Summary | Detail / next action | Source | Added |\n 35\t| ---- | --- | ----- | ------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n 36\t| #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 |\n 37\t| #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 |\n 38\t| #006 | P2 | issue | Globe \"Language & region\" button had no handler | Fixed in this PR to the disabled \"Coming soon\" placeholder convention (`aria-disabled` + sr-only note). Wire to a real language/region settings screen when one exists, then drop the placeholder state. | `src/components/clinical-dashboard/master-search-header.tsx:1829`; session 2026-07-21 | 2026-07-21 |\n 39\t| #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 |\n 40\t| #009 | P3 | rec | Confirm `/api/jobs` is intentionally server/ops-only | No client `fetch()` reaches `/api/jobs` (only tests import it). Confirm it is a deliberate ops/manual surface; if abandoned, remove it. | `src/app/api/jobs/route.ts` | 2026-07-21 |\n 41\t| #010 | P3 | task | Un-built \"Coming soon\" controls across forms/favourites | ~10 disabled placeholders (forms refine/reset, favourites sort/add/new-set, move-to-set, remove-favourite). Correctly flagged (`aria-disabled` + \"Coming soon\"), not defects — wire when the underlying features land. | `forms-search-results-page.tsx`; `favourites-hub.tsx`; `favourites-command-library-page.tsx` | 2026-07-21 |\n 42\t| #011 | P3 | task | Auth DB-connection allocation is operator-only | Supabase Auth (GoTrue) is capped at ~10 absolute DB connections (Supabase perf advisor). Switch to **percentage-based** allocation in the Supabase **dashboard** before the first compute scale-up — **not settable via SQL/MCP** (operator-owned). Verify via a staging soak + an approval-gated read-only advisor re-check. | `docs/auth-connection-cap-runbook.md`; `docs/process-hardening.md` (Known follow-up debts) | 2026-07-21 |\n 43\t| #012 | P3 | rec | Slim the lazy cross-mode differentials chunk | `cross-mode-differentials.ts` is dynamically imported (correctly code-split **out** of the initial/dashboard bundle — verified), but it pulls the full ~860 KB differentials snapshot (~125 KB gzip lazy chunk) just to build a tiny `{slug,title,clinicalHinge}` + presentations + aliases catalog. A precomputed lightweight index (generator + drift check, like the `specifiers-content` split / medications `fields=index`) would cut that lazy chunk ~5–10×. Not a bundle leak — an M-effort slim. | `src/lib/cross-mode-differentials.ts`; `src/components/clinical-dashboard/cross-mode-links.tsx:150`; session 2026-07-21 (build:analyze) | 2026-07-21 |\n 44\t| #013 | P3 | rec | Route-chunk + mockup catalogue JSON weight | `build:analyze`: `/specifiers` ships `specifiers-search-index.json` (~180 KB parsed), `/forms` ships `forms-catalog.json` (~132 KB), `/formulation` ships `formulation-content.json` (~52 KB, client-side local search — needs index/full split or a search endpoint, architectural). All route-scoped (not initial bundle). Also `*-mockups.tsx` (~100 KB across chunks) build though `/mockups` 404s in prod — exclude from the prod artifact. | session 2026-07-21 (build:analyze) | 2026-07-21 |\n 45\t| #014 | P3 | rec | Realize the `next/image` win on signed previews | `next.config` `images` (AVIF + `*.supabase.co` `remotePatterns` pinned to the project host, from #1024) is currently inert — signed document/image previews still render as raw ``. Route them through `next/image` to actually get AVIF + lazy optimization. | #1024; `src/components/clinical-dashboard/signed-image.tsx`; session 2026-07-21 | 2026-07-21 |\n 46\t| #016 | P3 | rec | \"Big but not easy\" structural + motion perf | Deferred larger levers: (a) nonce-CSP forces every product route to `ƒ Dynamic` (zero static generation) — evaluate Partial Prerendering / static shells for the static clinical catalogues (DSM/differentials/therapy/specifiers/formulation); (b) sidebar expand/collapse animates `grid-template-columns` (biggest smoothness cost, motion-gated — needs a transform-overlay rethink); (c) Therapy Compass fetches 692 KB / 2.5 MB JSON client-side (defer until interaction + confirm brotli); (d) settings/setup/admin dialogs static-imported into the home chunk (`next/dynamic` them). | session 2026-07-21 (build route table + design audit) | 2026-07-21 |\n 47\t| #017 | P3 | task | Field Web-Vitals baseline via live Lighthouse | In-sandbox runtime vitals were blocked (prod server hard-requires Supabase secrets; dev-mode CLS measured excellent at 0.00–0.04, content-first pages 0.000). Run Lighthouse against `psychiatry.tools` for real LCP/INP/CLS to prioritize #012–#016 by measured impact rather than reasoning. | session 2026-07-21 (measurement pass) | 2026-07-21 |\n 48\t| #018 | P2 | task | Monitoring retrieval-depth trio misses schedules | quality-lithium-monitoring-range, quality-antipsychotic-metabolic-monitoring, quality-adhd-medication-monitoring still fail targeting (\"no schedule/interval\") after the #1040 gate parity — their live chunk sets apparently surface no admissible schedule sentence. Diagnose via read-only chunk queries + run #61 dump artifact (30d retention) to split corpus-content vs retrieval-depth vs fact-extraction; fix shape TBD after diagnosis. A retrieval-side fix is a protected surface (canary pair, fresh ~$2-4 authorization). | run #61 targeting misses; branch-review-ledger 2026-07-21 | 2026-07-21 |\n 49\t| #019 | P2 | task | Comparison-class coverage: admission doc never in top-5 | admission-discharge-comparison misses its expected admission-side doc on every canary (#57-#61) — top-5 carries discharge-planning + unrelated docs only. Same \"why doesn't retrieval surface X\" species as #018; diagnose jointly. Ground-truth already widened (#1020); the residual is genuine comparison-class retrieval coverage. | runs #57-#61; PR #1020 replay verdict | 2026-07-21 |\n 50\t| #020 | P3 | task | Validate eval:quality cost readout post-fix | The estimator fix landed in PR #1050 (zero-usage cases count $0 with rates configured; provider-attempted cases with missing usage stay n/a). Remaining action: confirm the next canary run prints a real dollar figure in Answer Metrics, then archive this row. | PR #1050; run #60/#61 Answer Metrics tables | 2026-07-21 |\n 51\t| #021 | P3 | rec | E-3d H2 residual: strong/comparison generation discards | approx. 6 generation attempts per full 44-case run still fail the final quality gate and fall to extractive on strong-route comparison/complex shapes (the designed-conservative outcome). PARKED: weakest cost/benefit on the queue — a wave (approx. $2-4 pair + reviewer cycle) to shave seconds off a few hard cases. Revisit only if latency/waste complaints or a cheaper lever appears. | E-3c design record; runs #59-#61 diagnostics | 2026-07-21 |\n 52\t| #022 | P2 | task | Source-governance metadata refresh (operator) | Governance warning rate ~0.84 across canaries: stale/review-required/unknown source metadata on most top results. Operator work (document review-status attestation in the app), not a code defect. Next action: generate the prioritized refresh worklist ($0 read-only) and schedule a metadata pass. | runs #57-#61 Source Governance tables; docs/observability-slos.md | 2026-07-21 |\n 53\t| #023 | P3 | task | Read Sunday 2026-07-26 scheduled-run artifacts | The 18:00 UTC scheduled runs deliver three free datapoints at once: first full-44 weekly canary (validates the #1044 ANSWER_CASE_LIMIT raise), browser-matrix flake second datapoint (webkit ui-route-coverage now reproduced + root-caused 2026-07-22 → see #024; firefox ui-formulation:91 still awaits a datapoint), and the irrelevant@10 labeling-audit artifact (§3.1 human-decision class). Read all three, then disposition. | sessions 2026-07-20/21; branch-review-ledger convergence notes | 2026-07-21 |\n 54\t| #024 | P3 | issue | WebKit e2e `_rsc`-prefetch access-control-checks errors | verify:release:offline on `main` ce32fe170 (2026-07-22) reproduced #023's webkit clause: **6/6 deterministic** failures in `tests/ui-route-coverage.spec.ts` (Therapy Compass; DSM home/comparison; Specifier comparison/map; Differential stream), each a `pageerror … ?_rsc=… due to access control checks` on Next.js RSC prefetch — Chromium + Firefox clean. Not merge-blocking (required gate `test:e2e:pr` is chromium-only; the full webkit matrix is advisory/release-time). Most likely a Playwright route-interception × WebKit interaction, not a Safari user defect. Next: decide (a) allow/mock the `_rsc` routes for the `webkit` e2e project, or (b) confirm real Safari impact — before trusting the full-matrix webkit gate at release. NB the 2 other webkit fails (`ui-stress:412`, `ui-universal-search:210`) passed on isolated re-run = true flake. | session 2026-07-22 (verify:release:offline, `main` ce32fe170); refines #023 | 2026-07-22 |\n 55\t| #025 | P2 | task | Activate the three webhooks (operator secrets) | Merged (#968) + deployed but inert — verified live: `POST /api/webhooks/railway` returns `503 webhook_not_configured`. To turn on: (1) Railway → set `RAILWAY_WEBHOOK_SECRET` + add the `?token=…` webhook URL; (2) the chat URLs `SLACK_WEBHOOK_URL`/`DISCORD_WEBHOOK_URL` must be set in BOTH places — the Railway **app/server env** (the receiver forwards deploy alerts via `postChatNotification`, which reads server env, so repo-secret-only leaves the Railway webhook authenticated but returning `delivered:false`) AND as **GitHub repo secrets** (the CI-failure workflow reads `secrets.*`); (3) `SUPABASE_INGESTION_WEBHOOK_SECRET`. Each fails closed until set, so this is pure ops. See docs/webhooks.md. | session 2026-07-22; PR #968; docs/webhooks.md | 2026-07-22 |\n 56\t| #026 | P2 | task | Wire the Supabase document-change trigger | The `/api/webhooks/supabase/document-change` receiver is live but nothing calls it. The trigger (`notify_document_change_ingestion_webhook()` + `documents_ingestion_webhook`, SQL in docs/webhooks.md §3) must land as a **committed migration** — drift covers functions/triggers, so applying raw SQL to live would fail `check:drift`: add the migration, reconcile `supabase/schema.sql`, run `npm run drift:manifest` (needs a local Supabase container), then deploy. Operator-applied live state is the Vault secret (`select vault.create_secret('','ingestion_webhook_secret')`) + the base-URL GUC `app.ingestion_webhook_base_url`, which is MANDATORY per environment (the trigger no-ops when it is unset, so `reindex_requested` flips never enqueue — there is no production default). Trigger is `AFTER UPDATE` on `reindex_requested` only — NOT `INSERT` (an INSERT-fired webhook can beat the upload route's own job insert, which then deletes its just-created doc → intermittent upload failures); external inserts set `reindex_requested=true` to be picked up. Note delivery is at-most-once (pg_net has no retry) and there is NO built-in recovery (automatic or manual) for a dropped insert — neither the autopilot nor `scripts/reindex.ts` sweeps `queued` docs with no job (`hasIncompleteDocumentsWithoutOpenJobs` requires `queuedDocuments === 0`). External imports must insert then issue a SEPARATE UPDATE flipping `reindex_requested=true` (an insert with the flag pre-set won't fire the AFTER UPDATE trigger). The app upload path is NOT a guarantee either: it inserts the `documents` row then the `ingestion_jobs` row as two separate non-atomic calls (rollback only on a job-insert error), so a crash/timeout between them strands the same queued-without-job row nothing sweeps. The only true guarantees are an atomic enqueue (document + job in one transaction/RPC) or a scheduled queued-without-job sweep. Until applied, webhook #5 never fires. | session 2026-07-22; docs/webhooks.md §3 | 2026-07-22 |\n 57\t| #027 | P3 | rec | External uptime monitor independent of GitHub/Railway | `live-domain-monitor.yml` runs on GitHub's cron, so it won't run in exactly the outage it should catch (Actions or the deploy itself down). Add an off-platform synthetic monitor (UptimeRobot / Better Stack / Checkly) hitting `/api/health` with a webhook alert. Provider setup, not code. | session 2026-07-22 webhook review | 2026-07-22 |\n 58\t| #028 | P3 | rec | Runtime error tracking (Sentry or similar) | No error tracking in the repo — production exceptions on `psychiatry.tools`, including how often `RAG_PROVIDER_MODE=auto` silently degrades to source-only, are invisible. Weigh adding `@sentry/nextjs` (dependency + DSN secret + instrumentation) vs cost; alert → chat/issue. Provider-backed; needs explicit sign-off before adding the dependency. | session 2026-07-22 webhook review | 2026-07-22 |\n 59\t| #029 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so \"unknown\" ≠ \"bad\" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 |\n 60\t| #030 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same \"unknown ≠ bad\" hazard as #029 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |\n 61\t| #031 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 |\n 62\t| #032 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |\n 63\t| #033 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |\n 64\t| #034 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 |\n 65\t\n 66\t## Resolved / archive\n 1\t# Webhooks\n 2\t\n 3\tThis repo ships three webhook integrations. Two are inbound receivers under\n 4\t`src/app/api/webhooks/`; one is an outbound GitHub Actions notifier. All three\n 5\tshare the same optional chat destinations.\n 6\t\n 7\t| # | Integration | Direction | Entry point |\n 8\t| --- | ------------------------------------ | --------- | --------------------------------------------- |\n 9\t| 1 | Railway deploy → chat | inbound | `POST /api/webhooks/railway` |\n 10\t| 2 | GitHub CI failure → chat | outbound | `.github/workflows/notify-ci-failure.yml` |\n 11\t| 3 | Supabase document change → ingestion | inbound | `POST /api/webhooks/supabase/document-change` |\n 12\t\n 13\t## Chat destinations (shared)\n 14\t\n 15\tSet either, both, or neither. A receiver with no destination configured still\n 16\taccepts the event and reports it as undelivered.\n 17\t\n 18\t- `SLACK_WEBHOOK_URL` — a Slack incoming webhook (`{ \"text\": … }`).\n 19\t- `DISCORD_WEBHOOK_URL` — a Discord webhook (`{ \"content\": … }`).\n 20\t\n 21\tThe GitHub workflow reads these from repository **secrets** of the same name; the\n 22\tinbound receivers read them from server env (`src/lib/env.ts`).\n 23\t\n 24\tStore every secret below in Railway/GitHub secret stores — never in the repo.\n 25\t\n 26\t## 1. Railway deploy → chat\n 27\t\n 28\t`POST /api/webhooks/railway` forwards notable Railway deploy status changes\n 29\t(`SUCCESS`, `FAILED`, `CRASHED`, `REMOVED`) for the app + worker services to chat.\n 30\tThis reports the deploy outcome GitHub cannot see.\n 31\t\n 32\t**Auth.** Railway lets you configure only a target URL (no custom headers or\n 33\tsigning), so the shared secret `RAILWAY_WEBHOOK_SECRET` (min 16 chars) travels as\n 34\ta `?token=` query parameter and is compared constant-time. The receiver fails\n 35\tclosed (`503`) when the secret is unset and returns `401` on a bad token.\n 36\t\n 37\t**Setup.** Railway → Project → Settings → Webhooks → add:\n 38\t\n 39\t```\n 40\thttps://psychiatry.tools/api/webhooks/railway?token=\n 41\t```\n 42\t\n 43\tTransient phases (`BUILDING`, `DEPLOYING`, `QUEUED`, …) are dropped to keep the\n 44\tchannel quiet; the receiver answers `200 { \"skipped\": true }` for them.\n 45\t\n 46\t> Chat destination: this receiver forwards through `postChatNotification`, which\n 47\t> reads `SLACK_WEBHOOK_URL`/`DISCORD_WEBHOOK_URL` from **server env** — set them on\n 48\t> the Railway `Database` service, not only as GitHub repo secrets. With the token\n 49\t> set but no chat URL in server env the receiver authenticates and returns\n 50\t> `200 { \"forwarded\": false }`, so deploy alerts are silently undelivered. The\n 51\t> repo secrets in §2 cover only the GitHub CI-failure workflow.\n 52\t\n 53\t> Note: the receiver runs inside the app being deployed, so a notification about\n 54\t> a deploy that takes the app fully down may not be delivered. Pair it with an\n 55\t> external uptime monitor for hard-down detection.\n 56\t\n 57\t## 2. GitHub CI failure → chat\n 58\t\n 59\t`.github/workflows/notify-ci-failure.yml` triggers on `workflow_run: completed`\n 60\tfor the key workflows (CI, SAST, Secret Scan, PR Policy, and the scheduled\n 61\tmonitors) and pings chat when a run on `main` or `release/*` fails.\n 62\t\n 63\t**Setup.** Add repository secrets `SLACK_WEBHOOK_URL` and/or `DISCORD_WEBHOOK_URL`.\n 64\tNo secret → the workflow logs \"nothing to notify\" and exits cleanly. It posts with\n 65\t`curl` only (no external actions), so the pinned-action allowlist is not involved.\n 66\t\n 67\t## 3. Supabase document change → ingestion\n 68\t\n 69\t`POST /api/webhooks/supabase/document-change` turns the polling ingestion path\n 70\tinto an event-driven one: when a `public.documents` row is inserted outside the\n 71\tapp upload flow, or an existing row is flagged for reindex, the receiver enqueues\n 72\tone `ingestion_jobs` row that the worker then claims.\n 73\t\n 74\t**Auth.** Supabase Database Webhooks can send custom headers, so the shared secret\n 75\t`SUPABASE_INGESTION_WEBHOOK_SECRET` (min 16 chars) is sent as\n 76\t`Authorization: Bearer ` (or `x-webhook-secret`) and compared\n 77\tconstant-time. Fails closed (`503`) when unset, `401` on a bad secret.\n 78\t\n 79\t**When it enqueues (idempotent + loop-safe):**\n 80\t\n","command","/bin/bash -lc \"git status --short --branch; git show --stat --oneline HEAD; nl -ba docs/outstanding-issues.md | sed -n '28,66p'; nl -ba docs/webhooks.md | sed -n '1,80p'\"","commandActions",[537],"cwd","/workspace/Database",2,"exitCode","processId","66395","source","unifiedExecStartup","commandExecution",{"_524":538,"_93":539},"git status --short --branch; git show --stat --oneline HEAD; nl -ba docs/outstanding-issues.md | sed -n '28,66p'; nl -ba docs/webhooks.md | sed -n '1,80p'","unknown",{"_470":541,"_449":450,"_472":456},{"_542":543,"_513":514,"_42":544,"_477":545,"_208":546,"_547":-5,"_93":548},"arguments","{\"cmd\":\"git status --short --branch; git show --stat --oneline HEAD; nl -ba docs/outstanding-issues.md | sed -n '28,66p'; nl -ba docs/webhooks.md | sed -n '1,80p'\",\"workdir\":\"/workspace/Database\",\"max_output_tokens\":12000}","fc_040c0fdc22270fa6016a606636bd9c8197915e1803ab2d4a0a",{"_482":456},"exec_command","namespace","function_call",{"_470":550,"_449":450,"_472":456},{"_473":-5,"_494":551,"_42":552,"_477":553,"_498":554,"_93":500},"gAAAAABqYGY2RQ6-jvDeWgg3dEnD1NVqSWFS9fcDjHLrLwcxGOqfgyU5p7wUo-lGH0-ueYbWJ-j-jzQVGQRNUcdJfBGqH8wPEybqBifo1XV5zUbyAovticrNQ5-yxmf6DuaoHJWOozfP21WK8A155op6ie92bgP2sZ1gvXN8cZagdBr88Q4l0ssgrrrNhePY_rQ39y8fTNq6a4SegdB5KA0Ul1spPz_Q1iQZG9FqIIrXrz_L0JptURSQJs75jUbXLLwQ5F8wqimJofIN59VJZlQjL4p0icgu8IqmIjIkwF8hQqyXm8oJRN4PPQoU0rYqOuAPTTlO2L25ty4iWEB2CO_RMpURyClslhgdqTdBfvpoISVWJLo91KFMu2d-S9YsQ6inQlLlSLGUYxHVOBPeJFKux81yB4NO2Avootqab_VImLz65XzzIAWDP_4VaV4pB1cbT0v4oEJRc7VAy3XesoUPH2p-9KsQ3-BCRnHMxxlbVoH2A5OEMeLq25bHkyZjoJQ3D-JnTlzyzTA26UvcAGXVkXu4VkdoKrF17AMs6oRDug-czSUFuvpffEtqOD8oajdz38Icr8c11jrJc-3PlAG_WDfyMCeu6iV8ebAnbVhIbc5yN4GMQ4ave0Wj3TaVRYTYxeQgWUJuYuQJOyk4-5_wtDsIQgaXbjOmOm7OMvFm1EEa1PO8fFisRwguaAl1fzLEAVTN-4vh_lAdoAYKWuc4TCk6ewPKNfXaPD-SfqtcUNiEFuK-GBkURY_-Q-BG_FqoseImSIv-03R45hW60p1fy2m0i2LYM07vGeL-CSt0ndPoeTYzKez_nuK8NWDjLSPCllwH0lW2iX0urDCYz19vG3QEMrVoMoyZqptmCJjihbbDn4gI0xQ3WFv0DnDCAic1Q3wkM2N_sjNBaoAcObynek-6gfb5TavbFvqhpn1z628VikfNA2H_aQUgpvudiHtQLN7xa8SxDkjX5YxMeJ1plv85ZPNXeDj_su6eFAJoCJ2gJOf8IfZZt8PaOqlecsbirW74lWauBNyLfs5DkkjgMf-wh_LDpXvibr9l1rWAd8RhYsQfNek=","rs_040c0fdc22270fa6016a606635aca8819797b99cc2f9d6c335",{"_482":456},[555],{"_46":556,"_93":504},"**Preparing final output with citations and line numbers**",{"_488":558,"_470":559,"_449":450,"_472":456},1784702518750,{"_473":560,"_42":552,"_498":561,"_93":500},[],[556],{"_470":563,"_449":450,"_472":456},{"_513":564,"_42":-5,"_477":565,"_516":566,"_93":518},"call_FUyitWjlsloy4SNOdlnSQjLz",{"_482":456},"Wall time: 0.0098 seconds\nOutput:\n{\"title\":\"docs(issues): resolve ledger conflict on governance deferrals\",\"body\":\"## Summary\\n\\n- Merged the latest `main` changes into the PR branch to clear the branch conflict.\\n- Kept the `docs/webhooks.md` updates from `main`.\\n- Preserved the source-governance audit deferrals by renumbering them from `#025`-`#030` to `#029`-`#034`, then advanced `issues:next-id` to `035`.\\n\\n## Verification\\n\\n- `git diff --check`\\n- `npx prettier --check docs/outstanding-issues.md`\\n- `npm run docs:check-links`\\n\\nDocs-only conflict resolution; no app behavior changes and no provider-backed checks run.\"}",{"_488":568,"_470":569,"_449":450,"_472":456},1784702515156,{"_570":-5,"_542":571,"_454":572,"_104":-5,"_42":564,"_573":-5,"_574":-5,"_575":576,"_577":578,"_463":114,"_579":578,"_93":580},"appContext",{"_339":585,"_341":586},8,"mcpAppResourceUri","pluginId","result",{"_581":-5,"_473":582,"_583":584},"server","make_pr","tool","mcpToolCall","_meta",[587],"structuredContent",{"_339":585,"_341":586},"docs(issues): resolve ledger conflict on governance deferrals","## Summary\n\n- Merged the latest `main` changes into the PR branch to clear the branch conflict.\n- Kept the `docs/webhooks.md` updates from `main`.\n- Preserved the source-governance audit deferrals by renumbering them from `#025`-`#030` to `#029`-`#034`, then advanced `issues:next-id` to `035`.\n\n## Verification\n\n- `git diff --check`\n- `npx prettier --check docs/outstanding-issues.md`\n- `npm run docs:check-links`\n\nDocs-only conflict resolution; no app behavior changes and no provider-backed checks run.",{"_93":46,"_46":588},"{\n \"title\": \"docs(issues): resolve ledger conflict on governance deferrals\",\n \"body\": \"## Summary\\n\\n- Merged the latest `main` changes into the PR branch to clear the branch conflict.\\n- Kept the `docs/webhooks.md` updates from `main`.\\n- Preserved the source-governance audit deferrals by renumbering them from `#025`-`#030` to `#029`-`#034`, then advanced `issues:next-id` to `035`.\\n\\n## Verification\\n\\n- `git diff --check`\\n- `npx prettier --check docs/outstanding-issues.md`\\n- `npm run docs:check-links`\\n\\nDocs-only conflict resolution; no app behavior changes and no provider-backed checks run.\"\n}",{"_470":590,"_449":450,"_472":456},{"_542":591,"_513":564,"_42":592,"_477":593,"_208":578,"_547":594,"_93":548},"{\"title\":\"docs(issues): resolve ledger conflict on governance deferrals\",\"body\":\"## Summary\\n\\n- Merged the latest `main` changes into the PR branch to clear the branch conflict.\\n- Kept the `docs/webhooks.md` updates from `main`.\\n- Preserved the source-governance audit deferrals by renumbering them from `#025`-`#030` to `#029`-`#034`, then advanced `issues:next-id` to `035`.\\n\\n## Verification\\n\\n- `git diff --check`\\n- `npx prettier --check docs/outstanding-issues.md`\\n- `npm run docs:check-links`\\n\\nDocs-only conflict resolution; no app behavior changes and no provider-backed checks run.\"}","fc_040c0fdc22270fa6016a60663031e08197b49182bf4b4518d1",{"_482":456},"mcp__make_pr",{"_470":596,"_449":450,"_472":456},{"_473":-5,"_494":597,"_42":598,"_477":599,"_498":600,"_93":500},"gAAAAABqYGYwyUxbX5p87iqWh_BhXwuow5yAUEfhMR7DSHLM_bi6yYlIXVYhrkC52mhoN5Y17ilbnXKS8yIdVSvwZ6O_YqOEzQCtNptXmlscYhOLW6KimpfdJgDeQhlaERE6a7Gvio34q0qzqTRIm9dXPisNT9XnCR0kbquSrrT6hj8-DWClTqj8T_JznLujZlaq1H-hx9bEM2IJr4mi6XLVssYNQEgMATHRpJUnCNVD4jlg4GiK_nTWAuEihuC_gQw8YNPIu9lzATO_Z1MpISX0nLu5zY0Evl6gfP8XJ3vCn_VLjb6bn3CVgpGNy3Uv8UBREYO5Fv4DhXiUNZ9uZEOAWL7eaSwXZ0DXV0e3QfPBK-s-QP0tDaPzk38f35ovQOM-b0Ga9hiUxbtkkqjm1ptPSiK2xeDVQU6wGepVVx3b64Vq8_ENNqIdjMNGvRhxkASqsPqh7hzcpTXDgN8qgbNIzDsPk3uj1L7rNAyX76YCcSVOSzcCw9yz2vaXXRHxcB7VPavE4EEwzlGaws4CVJB91cxL9oYUrX0Ee9jlUHaRlOmP7fnE9QLOpY_qbkGhtcu8tR8ZPNVx7a2tViEz0dPC-I0n1h7meD7Qvfhd2qtRgBKerZGa4FVohSf_d6MMwILVdVIPWWEtSL18rIlmCZ3fviVmvXxt2OnU0Y4PRfaisHM_e64Uo2EGW1ippHMM6Fs1jLSMeN7AwhHnbiJ8e2l_LVAjUCa7tKAVFLeulOc0XxcYBBovMOXLvUTpecs47Mnzcb91tR6kevkgM1Xs1_AHOhkiONf--zn8D5YzG_w18DWrI8RQnfi3NRyQCqJg41gACTUm02me5Z47Zyl98rb1I-BbjKoZ6r6IiT6TFbNcZ-8476jA3ViL3N-z7hZAvL0vcaJsv2cEGOQ8iCxltT3NzmfxV7l4YeQGlSX5SApRhLsU3_j5uG6vLlziQguBQz4mkMenD6Vkzqt7SVHXqvAre8uAVHgGWc4QBuXo5FuWn2fMHfdybLj-AXpN9iGGuM6FnmoBhKHRnDfZzKWxAuvWF2--VLbKLd7KE0pvLag1R62YQkxiLKEHmodGeHCHJxmxoASCWEgI","rs_040c0fdc22270fa6016a60662f04608197845f0b8a8f01061c",{"_482":456},[601],{"_46":602,"_93":504},"**Planning merge and PR creation**",{"_488":604,"_470":605,"_449":450,"_472":456},1784702512209,{"_473":606,"_42":598,"_498":607,"_93":500},[],[602],{"_470":609,"_449":450,"_472":456},{"_513":610,"_42":-5,"_477":611,"_516":612,"_93":518},"call_ZVPzMhLVr09Vuwiej1i0mRjN",{"_482":456},"Chunk ID: 680ff5\nWall time: 0.0001 seconds\nProcess exited with code 0\nOriginal token count: 77\nOutput:\n## work\nM docs/outstanding-issues.md\nM docs/webhooks.md\n docs/outstanding-issues.md | 60 +++++-----\n docs/webhooks.md | 268 +++++++++++++++++++++++++++++++++++++++++++--\n 2 files changed, 288 insertions(+), 40 deletions(-)\n[work a2b4d56] docs(issues): resolve outstanding issues ledger conflict\n",{"_488":614,"_470":615,"_449":450,"_472":456},1784702509300,{"_522":616,"_524":617,"_526":618,"_528":529,"_454":32,"_531":32,"_42":610,"_532":619,"_534":535,"_463":114,"_93":536},"## work\nM docs/outstanding-issues.md\nM docs/webhooks.md\n docs/outstanding-issues.md | 60 +++++-----\n docs/webhooks.md | 268 +++++++++++++++++++++++++++++++++++++++++++--\n 2 files changed, 288 insertions(+), 40 deletions(-)\n[work a2b4d56] docs(issues): resolve outstanding issues ledger conflict\n","/bin/bash -lc 'git add docs/outstanding-issues.md docs/webhooks.md && git status --short --branch && git diff --cached --stat && git commit -m \"docs(issues): resolve outstanding issues ledger conflict\"'",[620],"38010",{"_524":621,"_93":539},"git add docs/outstanding-issues.md docs/webhooks.md && git status --short --branch && git diff --cached --stat && git commit -m \"docs(issues): resolve outstanding issues ledger conflict\"",{"_470":623,"_449":450,"_472":456},{"_542":624,"_513":610,"_42":625,"_477":626,"_208":546,"_547":-5,"_93":548},"{\"cmd\":\"git add docs/outstanding-issues.md docs/webhooks.md && git status --short --branch && git diff --cached --stat && git commit -m \\\"docs(issues): resolve outstanding issues ledger conflict\\\"\",\"workdir\":\"/workspace/Database\",\"yield_time_ms\":30000,\"max_output_tokens\":20000}","fc_040c0fdc22270fa6016a60662bc1608197be6707383a30edb9",{"_482":456},{"_470":628,"_449":450,"_472":456},{"_513":629,"_630":631,"_42":-5,"_477":632,"_463":114,"_633":634,"_93":635},"call_GCX0kuAb7kiqAzv0YOnSI6iQ","execution","client",{"_482":456},"tools",[636],"tool_search_output",{"_93":547,"_208":594,"_225":637,"_633":638},"Simple MCP server providing a make_pr tool for preparing pull request metadata.",[639],{"_93":640,"_208":578,"_225":641,"_642":15,"_643":59,"_644":645},"function","Record a pull request title and body.\ntitle: Title of the pull request\nbody: Body message of the pull request","strict","defer_loading","parameters",{"_93":646,"_647":648,"_649":650},"object","properties",{"_341":651,"_339":652},"required",[339,341],{"_93":653},{"_93":653},"string",{"_470":655,"_449":450,"_472":456},{"_542":656,"_513":629,"_630":631,"_42":657,"_477":658,"_463":114,"_93":659},{"_660":661,"_662":663},"tsc_040c0fdc22270fa6016a606629e99081978b4bd053177f1ce8",{"_482":456},"tool_search_call","query","make_pr create pull request metadata","limit",5,{"_470":665,"_449":450,"_472":456},{"_473":-5,"_494":666,"_42":667,"_477":668,"_498":669,"_93":500},"gAAAAABqYGYpNJWSEMneHJT_BCYC7G65SB9ZVxbUGSMHZOnweRl7gJIq2wrWfq_Xjx2WDA4OTlL1yoEi6eqp6w52zb_As3VU2zY7kELk1V2wX6bmVZlNVQZPMdFfPbXgA-cjkrnute7gir792Ze9rDQwMKBFw1RRUHok47v7AABeDlJA_D12Em0BuezEYdpfdGhS25hebO1rfnMapiSBU5iyz2Yl38t7PsJ6DVKVne503XRiL0b6Vwcqtp2ovl0ITgRw5LbTet4AQaDh95uQv2PtxKUxqgdMsdQ0yWcOKau9DJrdGRtqMxvPA8EaDdIdbqkAhvF_jpR_b1SSM3QvusXX6tkCYvVPHNMcDP_JM1JWfYJC4bAOBySNQDVwp_nhWrXur63aLkQbsSVtIzaprX7be9OhMvBL5eTl4UdnR9Oz4VF_ndZI-QS0H4_Zm0CJQz8gOzlpeuFvFF_zBQ0ejiU2CSejlmXfdNUDn4zPqdsctEXfZgO-oCT-wAsXPziB8HX_7cYAlo6MGhdQCN0yqST7IGjo5lBKAtUufbiVBaYaQpmQxtPQWRGOTC4Z_Nt4d6PK_cfStZYJCyAY5nHonK3VRECNGyPBgqY4B2UwEz__EPMb7BPTKwJXz8sdlnHubN3wXEc7RWGnxmVWLNvQT5GKTnCMWId9sTFM4FDCDOHBHmjwawqbMDS_9n_ocfRQGh3VW0RBi7jKRJbbxdHmK8U99C_MVB7LLKgq0q89e7NBYWr8N-Kweus_YdBdcnwbQgDRaMDfAsfImOggGJWJxhEjeKLyms8hLO9ql6z4sepPosHV3sEZR5T6n3_4EumzCp0V3ngpU0b-DFMQhqW0-4EZrSaCxyirPMSM4wiz36dBHYxJDfAfymt3nkMj_UqlWSe6JJl6RLJOPP4jb5O3fPce0gt4eB5t0CJINZaS4iIolBaM7za46SNjYgC6LhgLfb1sEWl9kNppRCHosXmwV5HpATv1uhaurhe0_tMUHGAMCMrNZGyFEB7c3V5bZfVLXPUjkU-EKjTiVCnKnvUiEUbWnmomw-FLI7k0nHSyszESqNNj0GLUDpLwG_XeNS6x9XR4aRZ5tA0pCiPFk0N0d60lKENEmwEFiFF9n1fQtjw0c-QbmZEyRf3tC503kvFlU3b5qX0dEj4eZixrAWYw8IXttnsJZNcur0FTOwjvrJ9GvqNT9Miv9yNJV6zgjuikMnAL0U0Z_Xm_MSIE3jmVcsYfivvuhp4dTsppD_muEdZTa5SMqIqtVf_842hg8ayjRhT-NV-4Kt49zr4j7GqBNOx_wr6KdPs1YmPP0ZxNoCgg6OADsQRgtdcwXjvGH5I53UFCTFEAWnbSk4VHSNZvfPEAKf6iw8kEp44ngWJwTUFVjKIymuoPxH2krJa3gIUQLp3mqUMoQKP-w6nd0i6S1l0-5agKJSXoGVSKMb0E2BuisACYGI9RMWpgVRN_j5jUSnL1W25sOZqbA5N4KAeFCTryKqDg1ED996Kuhvbppfs2lB9ed4VOK0YOjcIYvz2APFypZorxzWVUB3rsrCelT1PchMyr5BSUCVXtY3sH40YYmdiAArxAa1tMGSTBOiesIchOHufODm6u5Ip1L2L0bXba8pnS48WRgkhSNiJL8Xu4spXW7iZMtGiQxk4kWv7yz98RP3c4lpBC","rs_040c0fdc22270fa6016a6066265f6c8197992e6e7440e53158",{"_482":456},[670],{"_46":671,"_93":504},"**Staging and committing merge conflicts**",{"_488":673,"_470":674,"_449":450,"_472":456},1784702505930,{"_473":675,"_42":667,"_498":676,"_93":500},[],[671],{"_488":678,"_470":679,"_449":450,"_472":456},1784702501018,{"_522":680,"_524":681,"_526":682,"_528":529,"_454":683,"_531":32,"_42":684,"_532":685,"_534":535,"_463":114,"_93":536},"npm warn Unknown env config \"http-proxy\". This will stop working in the next major version of npm.\nnpm warn Unknown project config \"allow-scripts\". This will stop working in the next major version of npm.\nChecking formatting...\nAll matched files use Prettier code style!\nnpm warn Unknown env config \"http-proxy\". This will stop working in the next major version of npm.\nnpm warn Unknown project config \"allow-scripts\". This will stop working in the next major version of npm.\n\n> prompt-for-codex-medical-knowledge-base@0.1.0 docs:check-links\n> node scripts/check-docs-links.mjs\n\ndocs link check passed: 1111 repo path references resolve.\n","/bin/bash -lc 'git status --short --branch; git diff --check; npx prettier --check docs/outstanding-issues.md; npm run docs:check-links'",[686],2081,"call_UlR2DWccqr2Q7jC2103AwJYs","61654",{"_524":687,"_93":539},"git status --short --branch; git diff --check; npx prettier --check docs/outstanding-issues.md; npm run docs:check-links",{"_470":689,"_449":450,"_472":456},{"_513":684,"_42":-5,"_477":690,"_516":691,"_93":518},{"_482":456},"Chunk ID: db8c63\nWall time: 1.9811 seconds\nProcess exited with code 0\nOriginal token count: 174\nOutput:\n## work\nUU docs/outstanding-issues.md\nM docs/webhooks.md\nnpm warn Unknown env config \"http-proxy\". This will stop working in the next major version of npm.\nnpm warn Unknown project config \"allow-scripts\". This will stop working in the next major version of npm.\nChecking formatting...\nAll matched files use Prettier code style!\nnpm warn Unknown env config \"http-proxy\". This will stop working in the next major version of npm.\nnpm warn Unknown project config \"allow-scripts\". This will stop working in the next major version of npm.\n\n> prompt-for-codex-medical-knowledge-base@0.1.0 docs:check-links\n> node scripts/check-docs-links.mjs\n\ndocs link check passed: 1111 repo path references resolve.\n",{"_470":693,"_449":450,"_472":456},{"_542":694,"_513":684,"_42":695,"_477":696,"_208":546,"_547":-5,"_93":548},"{\"cmd\":\"git status --short --branch; git diff --check; npx prettier --check docs/outstanding-issues.md; npm run docs:check-links\",\"workdir\":\"/workspace/Database\",\"yield_time_ms\":30000,\"max_output_tokens\":20000}","fc_040c0fdc22270fa6016a606621dabc819796a6ad35ddefc282",{"_482":456},{"_470":698,"_449":450,"_472":456},{"_473":-5,"_494":699,"_42":700,"_477":701,"_498":702,"_93":500},"gAAAAABqYGYhR94OaOEaySa1KjS2nBgm5ktVfqcNbL7FGDTUdXUe2OGcJqp0op_M0YyoFkYxDNEysHbvXWIV50omGLRl2VMYqOHP_VHTpT1NSMzCSYRvTTeMybtoD89K6nlXp-ZnII3MTgPnWFrD82MP8smAbQtTf6wRr2sDBVkSpd3oc1HH3y7bU2Eup6t1oaBtDdqnzpEVwadRgWi6JPyAhepGktIMNhxVDFPWuzqM9nFRxvOESt_u31Xvw6A3MBpLinVykuGQRO1txYKpW3dhtJ4W1cL2R_eQUtf5YKEt3eSUPNSPwoicrjMbkHtg_PxsoFoc3erVS8m5AmFrIcMYt0K5jxt4e55eEiIQIgz59sVr25gYK4DrO1qM2lDpO0NZtxAhum_zscZMo05b1jOygWxGkg9s5evtBIvVSYopflXFqj6MoIW1UeYeqAtgHhDWWiGA9UGtlclliFu2FaIun5zLVNxooo5HvoVWOB4NXn3TknT2BDFu8Pcbe7O1ERIr5Co93iNAdwyPwp8IYQrs2A4nTzhY4bLM1gn6_EDislWmrwYxjN0c6IvqqKK6YjlZvFkPxogVFKU2tuoDoxY_L-iIrBLggpkK6-yM-mYSkDKRLO_JSgYcuithRj3UZ93CaRYtvt4lpDE3ejHBWZ02Nx3UOalxmDdPprvFxULu_ifWTkETTkSWdCK1W3Ax76XlVZ4KNDNyhOvQ2EIAX7RQWvWmBiWZteAnnimmpwUZm67UKNUxlOb2lS2L2_P-QsW8CX2K9yiuPg1tOSBsDZ8p9a3y3DB8h57V8bjkdxEONzasLoQYtEijhqa9T2Ji5i01RXQ6aLgGhsoYHEfRl68DWfsujeIVoy9PCtqJ2YbNWPWRTFVsfdkD6vzMX5tQzBoJvj5fsZEoMJyrtOrniaR1luL14WB6RcswrqEk7J_-e6-zGE-gD-BmsgG5XSMYVS5nt53rr0Uxlr9XCaYCu9geQr-G6DeLOwklSSes45aIf8NlT0_k4aY=","rs_040c0fdc22270fa6016a606621274481979c8822e2fb4d2106",{"_482":456},[703],{"_46":704,"_93":504},"**Checking git status and preparing commits**",{"_488":706,"_470":707,"_449":450,"_472":456},1784702497875,{"_473":708,"_42":700,"_498":709,"_93":500},[],[704],{"_488":711,"_470":712,"_449":450,"_472":456},1784702494919,{"_522":713,"_524":714,"_526":715,"_528":529,"_454":716,"_531":32,"_42":717,"_532":718,"_534":535,"_463":114,"_93":536},"npm warn Unknown env config \"http-proxy\". This will stop working in the next major version of npm.\nnpm warn Unknown project config \"allow-scripts\". This will stop working in the next major version of npm.\ndocs/outstanding-issues.md 316ms\n30:\n59:| #029 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so \"unknown\" ≠ \"bad\" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 |\n60:| #030 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same \"unknown ≠ bad\" hazard as #029 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |\n61:| #031 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 |\n62:| #032 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |\n63:| #033 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |\n64:| #034 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 |\n","/bin/bash -lc \"python3 - <<'PY'\nfrom pathlib import Path\np=Path('docs/outstanding-issues.md')\ns=p.read_text().replace('hazard as #033', 'hazard as #029')\np.write_text(s)\nPY\nnpx prettier --write docs/outstanding-issues.md && rg -n 'issues:next-id|#029|#030|#031|#032|#033|#034|hazard as' docs/outstanding-issues.md\"",[719],1943,"call_Z8kz9vgqEYmywGJv2hoVqkj4","78204",{"_524":720,"_93":539},"python3 - <<'PY'\nfrom pathlib import Path\np=Path('docs/outstanding-issues.md')\ns=p.read_text().replace('hazard as #033', 'hazard as #029')\np.write_text(s)\nPY\nnpx prettier --write docs/outstanding-issues.md && rg -n 'issues:next-id|#029|#030|#031|#032|#033|#034|hazard as' docs/outstanding-issues.md",{"_470":722,"_449":450,"_472":456},{"_513":717,"_42":-5,"_477":723,"_516":724,"_93":518},{"_482":456},"Chunk ID: 814b60\nWall time: 1.8434 seconds\nProcess exited with code 0\nOriginal token count: 3342\nOutput:\nnpm warn Unknown env config \"http-proxy\". This will stop working in the next major version of npm.\nnpm warn Unknown project config \"allow-scripts\". This will stop working in the next major version of npm.\ndocs/outstanding-issues.md 316ms\n30:\n59:| #029 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so \"unknown\" ≠ \"bad\" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 |\n60:| #030 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same \"unknown ≠ bad\" hazard as #029 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |\n61:| #031 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 |\n62:| #032 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |\n63:| #033 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |\n64:| #034 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 |\n",{"_470":726,"_449":450,"_472":456},{"_542":727,"_513":717,"_42":728,"_477":729,"_208":546,"_547":-5,"_93":548},"{\"cmd\":\"python3 - <<'PY'\\nfrom pathlib import Path\\np=Path('docs/outstanding-issues.md')\\ns=p.read_text().replace('hazard as #033', 'hazard as #029')\\np.write_text(s)\\nPY\\nnpx prettier --write docs/outstanding-issues.md && rg -n 'issues:next-id|#029|#030|#031|#032|#033|#034|hazard as' docs/outstanding-issues.md\",\"workdir\":\"/workspace/Database\",\"yield_time_ms\":30000,\"max_output_tokens\":20000}","fc_040c0fdc22270fa6016a60661a9f4881978e5d45da23331b01",{"_482":456},{"_470":731,"_449":450,"_472":456},{"_473":-5,"_494":732,"_42":733,"_477":734,"_498":735,"_93":500},"gAAAAABqYGYaFnV2KKnRy39ATkYRq-VV35V1_4rG1GZv1oDdkxjj5a-uIHR3FNF07zjWf7wLEcW9nLO5rVWrQQwITrufDoq4714CZX-2PTYF0ahAp1CSqOT1JDn35l7IEbSFE__8gru8lwODl8Fm0_khJ0BPQQk9ZfoaDbJGhvMcs0iySCYxnz9DNhbjF3BtZLUXXBj2Efy19Yrr4l0faQEOUwgjnv8pN7jngX9RTzVPLqFfUyGMgg9539foKH8nSo7e-WGoN5namN48Z_FJN0_qH3TSvkDqc43knfUgpQ8fH85KwRdRJLYMYn7IzxJd3GETMzISoiCiIv86buWt53nZiU_tsgXbKw8MhoucW_gcT9u1H3wnMIFYqOdji4q9mYV25E_154K1q6dyyu6J6QtZbW2ntminodFb1fCj6RakqkvwgXiEsw8_C62Cz9SbgM8TxDEFCAdiIgg3DndYNgh_Qn_ImJc9_QbO5YE2XeG21wzzG0izL0vEBuMLqEjb2jWDefTNVo6Wgx4Ed9WaHVzjkQ1d5cg6HuXP5Vu8l3bGd0sEzP1-iz-C7tf9ZdjLwfau8pWOGMm9zcpx1JEHNxlHsLfYvoVwwp_WiynOTKEu9d_jtiZ9jSor6dJz4MG5xl1XjA6_-I9zL-xvJUndCEvUCEvzTcBU9Tpi4OSwgcD1zcYMlMOUzIGM1GA8jrN72vIbG-N9TAUitcQFvT1yQxMtu5TjcgB4EIpzpqvEMRx-6pYYQhVCs4FIN7gtk4sgU4nQEwsLzXegG6qmdVdyzZxxrwrj7lBoKoNI2wiHoduXfYCW_wg1btkdGyxtTvhvgjC64n2p5wdNgc8ufh1KxP7E_6q_yxka-tADaznk5vKu3CMfl1SBwK4CTobH33dolyHwnhVxKDTfm0lT-yd9fYhqiRRSOVPBPK_nalW8GUbjhiq9edTw_FXXLdy_FA1GXna0QIJf0Lz2_DKJS_ttigp4_AiSLaqGT6lQOSxK7FGdNZD8vH-40Ju13M08fqssqEly_E0Ryf6CoR9KzGxNeDfVei8Bhb_lTQc9fAr2OiABiMlBZa_BdWU=","rs_040c0fdc22270fa6016a6066198da88197804909fd2ee09307",{"_482":456},[736],{"_46":737,"_93":504},"**Identifying bug fix and row ID issues**",{"_488":739,"_470":740,"_449":450,"_472":456},1784702490634,{"_473":741,"_42":733,"_498":742,"_93":500},[],[737],{"_488":744,"_470":745,"_449":450,"_472":456},1784702488006,{"_522":746,"_524":747,"_526":748,"_528":529,"_454":749,"_531":32,"_42":750,"_532":751,"_534":535,"_463":114,"_93":536},"30:\n59:| #029 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so \"unknown\" ≠ \"bad\" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 |\n60:| #030 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same \"unknown ≠ bad\" hazard as #033 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |\n61:| #031 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 |\n62:| #032 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |\n63:| #033 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |\n64:| #034 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 |\n","/bin/bash -lc \"python3 - <<'PY'\nfrom pathlib import Path\nours=Path('/tmp/ours.md').read_text()\ntheirs=Path('/tmp/theirs.md').read_text()\nrows=[]\nfor line in ours.splitlines():\n if line.startswith('| #0'):\n idnum=int(line.split('|')[1].strip()[1:])\n if 25 <= idnum <= 30:\n rows.append(line)\nnew=[]\nfor idx,line in enumerate(rows, start=29):\n old=line.split('|')[1].strip()\n line=line.replace(f'| {old} ', f'| #{idx:03d} ', 1)\n # update internal refs for source-governance set cautiously\n mapping={25:29,26:30,27:31,28:32,29:33,30:34}\n for oldn,newn in mapping.items():\n line=line.replace(f'as #{oldn:03d}', f'as #{newn:03d}')\n line=line.replace(f'#025', '#029') if idx \"'!= 29 else line\n # More generic within these rows: references to #025 hazard should point to new #029\n line=line.replace('\"'same \\\"unknown ≠ bad\\\" hazard as #025', 'same \\\"unknown ≠ bad\\\" hazard as #029')\n new.append(line)\ntext=theirs.replace('<\"'!-- issues:next-id=029 -->'\"','<\"'!-- issues:next-id=035 -->'\"')\nneedle='| #028 | P3 | rec | Runtime error tracking (Sentry or similar)'\nlines=text.splitlines()\nout=[]\ninserted=False\nfor line in lines:\n out.append(line)\n if line.startswith(needle):\n out.extend(new)\n inserted=True\nif not inserted:\n raise SystemExit('insertion point not found')\nPath('docs/outstanding-issues.md').write_text('\\\\n'.join(out)+'\\\\n')\nPY\nrg -n '<<<<<<<|=======|>>>>>>>|issues:next-id|#029|#030|#031|#032|#033|#034' docs/outstanding-issues.md\"",[752],663,"call_VZHqj57kZpZcpR5VMYLVHeBg","4111",{"_524":753,"_93":539},"python3 - <<'PY'\nfrom pathlib import Path\nours=Path('/tmp/ours.md').read_text()\ntheirs=Path('/tmp/theirs.md').read_text()\nrows=[]\nfor line in ours.splitlines():\n if line.startswith('| #0'):\n idnum=int(line.split('|')[1].strip()[1:])\n if 25 <= idnum <= 30:\n rows.append(line)\nnew=[]\nfor idx,line in enumerate(rows, start=29):\n old=line.split('|')[1].strip()\n line=line.replace(f'| {old} ', f'| #{idx:03d} ', 1)\n # update internal refs for source-governance set cautiously\n mapping={25:29,26:30,27:31,28:32,29:33,30:34}\n for oldn,newn in mapping.items():\n line=line.replace(f'as #{oldn:03d}', f'as #{newn:03d}')\n line=line.replace(f'#025', '#029') if idx != 29 else line\n # More generic within these rows: references to #025 hazard should point to new #029\n line=line.replace('same \"unknown ≠ bad\" hazard as #025', 'same \"unknown ≠ bad\" hazard as #029')\n new.append(line)\ntext=theirs.replace('','')\nneedle='| #028 | P3 | rec | Runtime error tracking (Sentry or similar)'\nlines=text.splitlines()\nout=[]\ninserted=False\nfor line in lines:\n out.append(line)\n if line.startswith(needle):\n out.extend(new)\n inserted=True\nif not inserted:\n raise SystemExit('insertion point not found')\nPath('docs/outstanding-issues.md').write_text('\\n'.join(out)+'\\n')\nPY\nrg -n '<<<<<<<|=======|>>>>>>>|issues:next-id|#029|#030|#031|#032|#033|#034' docs/outstanding-issues.md",{"_470":755,"_449":450,"_472":456},{"_513":750,"_42":-5,"_477":756,"_516":757,"_93":518},{"_482":456},"Chunk ID: 5b54fe\nWall time: 0.5625 seconds\nProcess exited with code 0\nOriginal token count: 1988\nOutput:\n30:\n59:| #029 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so \"unknown\" ≠ \"bad\" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 |\n60:| #030 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same \"unknown ≠ bad\" hazard as #033 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |\n61:| #031 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 |\n62:| #032 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |\n63:| #033 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |\n64:| #034 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 |\n",{"_470":759,"_449":450,"_472":456},{"_542":760,"_513":750,"_42":761,"_477":762,"_208":546,"_547":-5,"_93":548},"{\"cmd\":\"python3 - <<'PY'\\nfrom pathlib import Path\\nours=Path('/tmp/ours.md').read_text()\\ntheirs=Path('/tmp/theirs.md').read_text()\\nrows=[]\\nfor line in ours.splitlines():\\n if line.startswith('| #0'):\\n idnum=int(line.split('|')[1].strip()[1:])\\n if 25 <= idnum <= 30:\\n rows.append(line)\\nnew=[]\\nfor idx,line in enumerate(rows, start=29):\\n old=line.split('|')[1].strip()\\n line=line.replace(f'| {old} ', f'| #{idx:03d} ', 1)\\n # update internal refs for source-governance set cautiously\\n mapping={25:29,26:30,27:31,28:32,29:33,30:34}\\n for oldn,newn in mapping.items():\\n line=line.replace(f'as #{oldn:03d}', f'as #{newn:03d}')\\n line=line.replace(f'#025', '#029') if idx != 29 else line\\n # More generic within these rows: references to #025 hazard should point to new #029\\n line=line.replace('same \\\"unknown ≠ bad\\\" hazard as #025', 'same \\\"unknown ≠ bad\\\" hazard as #029')\\n new.append(line)\\ntext=theirs.replace('','')\\nneedle='| #028 | P3 | rec | Runtime error tracking (Sentry or similar)'\\nlines=text.splitlines()\\nout=[]\\ninserted=False\\nfor line in lines:\\n out.append(line)\\n if line.startswith(needle):\\n out.extend(new)\\n inserted=True\\nif not inserted:\\n raise SystemExit('insertion point not found')\\nPath('docs/outstanding-issues.md').write_text('\\\\n'.join(out)+'\\\\n')\\nPY\\nrg -n '<<<<<<<|=======|>>>>>>>|issues:next-id|#029|#030|#031|#032|#033|#034' docs/outstanding-issues.md\",\"workdir\":\"/workspace/Database\",\"max_output_tokens\":30000}","fc_040c0fdc22270fa6016a60660e709c81979be5ec82181aeaf2",{"_482":456},{"_470":764,"_449":450,"_472":456},{"_473":-5,"_494":765,"_42":766,"_477":767,"_498":768,"_93":500},"gAAAAABqYGYOMTBYBSBDrUiBGfgNX0OSW_w1X9CdHFuuwDurrKaAIMcxtOoSulXnr0ak36K9nUdeLe3V4togvwv9tZI5fQU-LUehoYKhhROjg3dBqmdrRHyOFHGCGTz2lEsSXjiITG03_3SYO-svorcZhsxkugh8JLhhB1-Dbeo22kGWNB0M73XTb2syEWaPsj9v8FssiRFEoa2h8ED_fHZJ4SNT4Fm7zP2VidAvgHMblxBxvLPw1DMcd413XmO5_qM5pBCnNhLb-Cq57V9uuVLKTdZmOnxbcCyM-xOjsU6VD2CIJb-3KYYe-49bKCuEiXO-F79wKiJWot_iFDg1-ZrybqcXdZn0ZGwvcfjAk28uY9onYzG8Gn85wDVnXaf3Eamfu9PsIv9FEnsQBSjc7VDWNr0vk6_Oii1-j6ldWYWsWtiiAu8RffzayobvGoHcr91oo4CwcJmLHgx0csg3i5t2fOcgVBDDdim1nwwIZj1leFoNyhBuzl2CYtAyVNAykbpy8HCvX671pF_QdbWiaqpTYvKw_1l_ZtIt7Vw--ebzoaqByfi9xbDlEsdCUk7FxS_f-OVi8Wu0seVyjSNTs8b0AaneEh6kGbjjAsnhIT8yTIrjc6Ha50rVapizFN5yYwzWz3cN0jSaM5acu_Fwc7hXcf5NyK4G6AMIMUn9ibm62_7qLpmknDnc09iU51cmPjXVln78FVKKRUfHeEYvUHEgW6OriOw7XlsJMUCmlCZZBPuvR7mt6XREnbI12E-SyTw9N0nkp-1vuH7YHJLo3HUof5Zlhpj556V38Xj0A9cXKJgV9haxaDg_AItQYnAESFPhXjn0Ff96BpGMlFZrA-zBJskJ6UM3y9BBn5c7IY_xqQK575EHhwcllSy_SGmuJlooBjZTtJJPMU50qxpinPZWHWhGKnAkPVT4DBeocjneUGMhUeigTgNDnG_1kOkThoJG4ydEODsBYBPl-xB1j_LnrzrocoLRXSkUCgxcITWznkigTwMPhZsz1qJ8VSz5u2lfEaFh9susG60atyn10FELREvW_DPQPFQura0g6Wbvc0LosdvmrNx3bwdEPEi3-fvXlk6oZrmXKoWK24Mz2_2wG-Wjdf8BBLvRmkHE4O-n_gJkYbWmkkMCRccxXVUOixfCeUQh8QlHf5bizAhokJD8AzB1XHRIgMH5ddL8l23h9sp24Ohmibugzl4GhvBVOE35GHuCK0aP2dP0_DHMcCZy4vVezw1uWecYFWofmjJvdeAiPhy76gQryAEdbTM3YSxOef_FDyr6","rs_040c0fdc22270fa6016a60660cc31c81979be43dfab58361cc",{"_482":456},[769],{"_46":770,"_93":504},"**Planning script merge with row insertion**",{"_488":772,"_470":773,"_449":450,"_472":456},1784702478465,{"_473":774,"_42":766,"_498":775,"_93":500},[],[770],{"_470":777,"_449":450,"_472":456},{"_513":778,"_42":-5,"_477":779,"_516":780,"_93":518},"call_vomFDvl0nGURy1DWXFT12AnH",{"_482":456},"Chunk ID: 33f2b2\nWall time: 0.0023 seconds\nProcess exited with code 0\nOriginal token count: 31956\nOutput:\nWarning: truncated output (original token count: 31956)\nTotal output lines: 108\n\n- **Detail / next action** is the smallest thing that would move the item forward.\n- **Source** points at where it came from: a doc, a PR (`#123`), a file:line, or `session YYYY-MM-DD`.\n- Resolving an item moves its row to **Resolved / archive** with the date and a one-line outcome —\n rows are archived, not deleted, so the history stays auditable.\n\n\n\n## Open items\n\n| ID | Pri | Type | Summary | Detail / next action | Source | Added |\n| ---- | --- | ----- | ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n| #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 |\n| #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 |\n| #006 | P2 | issue | Globe \"Language & region\" button had no handler | Fixed in this PR to the disabled \"Coming soon\" placeholder convention (`aria-disabled` + sr-only note). Wire to a real language/region settings screen when one exists, then drop the placeholder state. | `src/components/clinical-dashboard/master-search-header.tsx:1829`; session 2026-07-21 | 2026-07-21 |\n| #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 |\n| #009 | P3 | rec | Confirm `/api/jobs` is intentionally server/ops-only | No client `fetch()` reaches `/api/jobs` (only tests import it). Confirm it is a deliberate ops/manual surface; if abandoned, remove it. | `src/app/api/jobs/route.ts` | 2026-07-21 |\n| #010 | P3 | task | Un-built \"Coming soon\" controls across forms/favourites | ~10 disabled placeholders (forms refine/reset, favourites sort/add/new-set, move-to-set, remove-favourite). Correctly flagged (`aria-disabled` + \"Coming soon\"), not defects — wire when the underlying features land. | `forms-search-results-page.tsx`; `favourites-hub.tsx`; `favourites-command-library-page.tsx` | 2026-07-21 |\n| #011 | P3 | task | Auth DB-connection allocation is operator-only | Supabase Auth (GoTrue) is capped at ~10 absolute DB connections (Supabase perf advisor). Switch to **percentage-based** allocation in the Supabase **dashboard** before the first compute scale-up — **not settable via SQL/MCP** (operator-owned). Verify via a staging soak + an approval-gated read-only advisor re-check. | `docs/auth-connection-cap-runbook.md`; `docs/process-hardening.md` (Known follow-up debts) | 2026-07-21 |\n| #012 | P3 | rec | Slim the lazy cross-mode differentials chunk | `cross-mode-differentials.ts` is dynamically imported (correctly code-split **out** of the initial/dashboard bundle — verified), but it pulls the full ~860 KB differentials snapshot (~125 KB gzip lazy chunk) just to build a tiny `{slug,title,clinicalHinge}` + presentations + aliases catalog. A precomputed lightweight index (generator + drift check, like the `specifiers-content` split / medications `fields=index`) would cut that lazy chunk ~5–10×. Not a bundle leak — an M-effort slim. | `src/lib/cross-mode-differentials.ts`; `src/components/clinical-dashboard/cross-mode-links.tsx:150`; session 2026-07-21 (build:analyze) | 2026-07-21 |\n| #013 | P3 | rec | Route-chunk + mockup catalogue JSON weight | `build:analyze`: `/specifiers` ships `specifiers-search-index.json` (~180 KB parsed), `/forms` ships `forms-catalog.json` (~132 KB), `/formulation` ships `formulation-content.json` (~52 KB, client-side local search — needs index/full split or a search endpoint, architectural). All route-scoped (not initial bundle). Also `*-mockups.tsx` (~100 KB across chunks) build though `/mockups` 404s in prod — exclude from the prod artifact. | session 2026-07-21 (build:analyze) | 2026-07-21 |\n| #014 | P3 | rec | Realize the `next/image` win on signed previews | `next.config` `images` (AVIF + `*.supabase.co` `remotePatterns` pinned to the project host, from #1024) is currently inert — signed document/image previews still render as raw ``. Route them through `next/image` to actually get AVIF + lazy optimization. | #1024; `src/components/clinical-dashboard/signed-image.tsx`; session 2026-07-21 | 2026-07-21 |\n| #016 | P3 | rec | \"Big but not easy\" structural + motion perf | Deferred larger levers: (a) nonce-CSP forces every product route to `ƒ Dynamic` (zero static generation) — evaluate Partial Prerendering / static shells for the static clinical catalogues (DSM/differentials/therapy/specifiers/formulation); (b) sidebar expand/collapse animates `grid-template-columns` (biggest smoothness cost, motion-gated — needs a transform-overlay rethink); (c) Therapy Compass fetches 692 KB / 2.5 MB JSON client-side (defer until interaction + confirm brotli); (d) settings/setup/admin dialogs static-imported into the home chunk (`next/dynamic` them). | session 2026-07-21 (build route table + design audit) | 2026-07-21 |\n| #017 | P3 | task | Field Web-Vitals baseline via live Lighthouse | In-sandbox runtime vitals were blocked (prod server hard-requires Supabase secrets; dev-mode CLS measured excellent at 0.00–0.04, content-first pages 0.000). Run Lighthouse against `psychiatry.tools` for real LCP/INP/CLS to prioritize #012–#016 by measured impact rather than reasoning. | session 2026-07-21 (measurement pass) | 2026-07-21 |\n| #018 | P2 | task | Monitoring retrieval-depth trio misses schedules | quality-lithium-monitoring-range, quality-antipsychotic-metabolic-monitoring, quality-adhd-medication-monitoring still fail targeting (\"no schedule/interval\") after the #1040 gate parity — their live chunk sets apparently surface no admissible schedule sentence. Diagnose via read-only chunk queries + run #61 dump artifact (30d retention) to split corpus-content vs retrieval-depth vs fact-extraction; fix shape TBD after diagnosis. A retrieval-side fix is a protected surface (canary pair, fresh ~$2-4 authorization). | run #61 targeting misses; bran…21956 tokens truncated… | session 2026-07-21 (measurement pass) | 2026-07-21 |\n| #018 | P2 | task | Monitoring retrieval-depth trio misses schedules | quality-lithium-monitoring-range, quality-antipsychotic-metabolic-monitoring, quality-adhd-medication-monitoring still fail targeting (\"no schedule/interval\") after the #1040 gate parity — their live chunk sets apparently surface no admissible schedule sentence. Diagnose via read-only chunk queries + run #61 dump artifact (30d retention) to split corpus-content vs retrieval-depth vs fact-extraction; fix shape TBD after diagnosis. A retrieval-side fix is a protected surface (canary pair, fresh ~$2-4 authorization). | run #61 targeting misses; branch-review-ledger 2026-07-21 | 2026-07-21 |\n| #019 | P2 | task | Comparison-class coverage: admission doc never in top-5 | admission-discharge-comparison misses its expected admission-side doc on every canary (#57-#61) — top-5 carries discharge-planning + unrelated docs only. Same \"why doesn't retrieval surface X\" species as #018; diagnose jointly. Ground-truth already widened (#1020); the residual is genuine comparison-class retrieval coverage. | runs #57-#61; PR #1020 replay verdict | 2026-07-21 |\n| #020 | P3 | task | Validate eval:quality cost readout post-fix | The estimator fix landed in PR #1050 (zero-usage cases count $0 with rates configured; provider-attempted cases with missing usage stay n/a). Remaining action: confirm the next canary run prints a real dollar figure in Answer Metrics, then archive this row. | PR #1050; run #60/#61 Answer Metrics tables | 2026-07-21 |\n| #021 | P3 | rec | E-3d H2 residual: strong/comparison generation discards | approx. 6 generation attempts per full 44-case run still fail the final quality gate and fall to extractive on strong-route comparison/complex shapes (the designed-conservative outcome). PARKED: weakest cost/benefit on the queue — a wave (approx. $2-4 pair + reviewer cycle) to shave seconds off a few hard cases. Revisit only if latency/waste complaints or a cheaper lever appears. | E-3c design record; runs #59-#61 diagnostics | 2026-07-21 |\n| #022 | P2 | task | Source-governance metadata refresh (operator) | Governance warning rate ~0.84 across canaries: stale/review-required/unknown source metadata on most top results. Operator work (document review-status attestation in the app), not a code defect. Next action: generate the prioritized refresh worklist ($0 read-only) and schedule a metadata pass. | runs #57-#61 Source Governance tables; docs/observability-slos.md | 2026-07-21 |\n| #023 | P3 | task | Read Sunday 2026-07-26 scheduled-run artifacts | The 18:00 UTC scheduled runs deliver three free datapoints at once: first full-44 weekly canary (validates the #1044 ANSWER_CASE_LIMIT raise), browser-matrix flake second datapoint (webkit ui-route-coverage now reproduced + root-caused 2026-07-22 → see #024; firefox ui-formulation:91 still awaits a datapoint), and the irrelevant@10 labeling-audit artifact (§3.1 human-decision class). Read all three, then disposition. | sessions 2026-07-20/21; branch-review-ledger convergence notes | 2026-07-21 |\n| #024 | P3 | issue | WebKit e2e `_rsc`-prefetch access-control-checks errors | verify:release:offline on `main` ce32fe170 (2026-07-22) reproduced #023's webkit clause: **6/6 deterministic** failures in `tests/ui-route-coverage.spec.ts` (Therapy Compass; DSM home/comparison; Specifier comparison/map; Differential stream), each a `pageerror … ?_rsc=… due to access control checks` on Next.js RSC prefetch — Chromium + Firefox clean. Not merge-blocking (required gate `test:e2e:pr` is chromium-only; the full webkit matrix is advisory/release-time). Most likely a Playwright route-interception × WebKit interaction, not a Safari user defect. Next: decide (a) allow/mock the `_rsc` routes for the `webkit` e2e project, or (b) confirm real Safari impact — before trusting the full-matrix webkit gate at release. NB the 2 other webkit fails (`ui-stress:412`, `ui-universal-search:210`) passed on isolated re-run = true flake. | session 2026-07-22 (verify:release:offline, `main` ce32fe170); refines #023 | 2026-07-22 |\n| #025 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so \"unknown\" ≠ \"bad\" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 |\n| #026 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same \"unknown ≠ bad\" hazard as #025 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |\n| #027 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 |\n| #028 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |\n| #029 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |\n| #030 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 |\n| #003 | task | Staging tenancy release evidence outstanding | Ran GitHub Action and validated isolation | 2026-07-21 |\n| #002 | task | Process-ownership fix not yet isolated on `main` | Fixed process isolation using child.pid termination | 2026-07-21 |\n| #008 | rec | Dead href builders in `document-flow-routes.ts` | Not dead code (false positive): `documentReaderHref`/`documentEvidenceHref` are live via the mock wrappers in `src/components/document-search-mockups.tsx` + `src/components/master-document-flow-mockups.tsx` (rendered under `src/app/mockups/document-search/`) and covered by `tests/document-flow-routes.test.ts`; removing breaks the build. Only the production non-mock hrefs are unlinked from prod UI — a wiring gap, not dead code. | 2026-07-22 |\n| #015 | task | Content-first fallback regression tests | Added `tests/registry-record-loader.dom.test.tsx` (8) + `tests/medication-record-page.dom.test.tsx` (6) covering content-first fallback paint, live swap-in, spinner/skeleton, error + not-found/unauthorized states, and the invariant that no authoritative verification badge shows before live governance reconciles (registry fixture-flag neutralization + medication governance-drop-on-error). | 2026-07-22 |\n| #004 | rec | Rescope provider-gated RAG safety ideas | Closed obsolete — rescue source (754-line RAG-safety worktree) unrecoverable/pruned across all refs; answer-quality thresholds + deep-health already shipped on `main` (#585/#587); only cost-cap preflight was genuinely missing and, per session decision, dropped rather than re-filed. | 2026-07-22 |\n",{"_488":782,"_470":783,"_449":450,"_472":456},1784702474262,{"_522":784,"_524":785,"_526":786,"_528":529,"_454":530,"_531":32,"_42":778,"_532":787,"_534":535,"_463":114,"_93":536},"- **Detail / next action** is the smallest thing that would move the item forward.\n- **Source** points at where it came from: a doc, a PR (`#123`), a file:line, or `session YYYY-MM-DD`.\n- Resolving an item moves its row to **Resolved / archive** with the date and a one-line outcome —\n rows are archived, not deleted, so the history stays auditable.\n\n\n\n## Open items\n\n| ID | Pri | Type | Summary | Detail / next action | Source | Added |\n| ---- | --- | ----- | ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n| #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 |\n| #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 |\n| #006 | P2 | issue | Globe \"Language & region\" button had no handler | Fixed in this PR to the disabled \"Coming soon\" placeholder convention (`aria-disabled` + sr-only note). Wire to a real language/region settings screen when one exists, then drop the placeholder state. | `src/components/clinical-dashboard/master-search-header.tsx:1829`; session 2026-07-21 | 2026-07-21 |\n| #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 |\n| #009 | P3 | rec | Confirm `/api/jobs` is intentionally server/ops-only | No client `fetch()` reaches `/api/jobs` (only tests import it). Confirm it is a deliberate ops/manual surface; if abandoned, remove it. | `src/app/api/jobs/route.ts` | 2026-07-21 |\n| #010 | P3 | task | Un-built \"Coming soon\" controls across forms/favourites | ~10 disabled placeholders (forms refine/reset, favourites sort/add/new-set, move-to-set, remove-favourite). Correctly flagged (`aria-disabled` + \"Coming soon\"), not defects — wire when the underlying features land. | `forms-search-results-page.tsx`; `favourites-hub.tsx`; `favourites-command-library-page.tsx` | 2026-07-21 |\n| #011 | P3 | task | Auth DB-connection allocation is operator-only | Supabase Auth (GoTrue) is capped at ~10 absolute DB connections (Supabase perf advisor). Switch to **percentage-based** allocation in the Supabase **dashboard** before the first compute scale-up — **not settable via SQL/MCP** (operator-owned). Verify via a staging soak + an approval-gated read-only advisor re-check. | `docs/auth-connection-cap-runbook.md`; `docs/process-hardening.md` (Known follow-up debts) | 2026-07-21 |\n| #012 | P3 | rec | Slim the lazy cross-mode differentials chunk | `cross-mode-differentials.ts` is dynamically imported (correctly code-split **out** of the initial/dashboard bundle — verified), but it pulls the full ~860 KB differentials snapshot (~125 KB gzip lazy chunk) just to build a tiny `{slug,title,clinicalHinge}` + presentations + aliases catalog. A precomputed lightweight index (generator + drift check, like the `specifiers-content` split / medications `fields=index`) would cut that lazy chunk ~5–10×. Not a bundle leak — an M-effort slim. | `src/lib/cross-mode-differentials.ts`; `src/components/clinical-dashboard/cross-mode-links.tsx:150`; session 2026-07-21 (build:analyze) | 2026-07-21 |\n| #013 | P3 | rec | Route-chunk + mockup catalogue JSON weight | `build:analyze`: `/specifiers` ships `specifiers-search-index.json` (~180 KB parsed), `/forms` ships `forms-catalog.json` (~132 KB), `/formulation` ships `formulation-content.json` (~52 KB, client-side local search — needs index/full split or a search endpoint, architectural). All route-scoped (not initial bundle). Also `*-mockups.tsx` (~100 KB across chunks) build though `/mockups` 404s in prod — exclude from the prod artifact. | session 2026-07-21 (build:analyze) | 2026-07-21 |\n| #014 | P3 | rec | Realize the `next/image` win on signed previews | `next.config` `images` (AVIF + `*.supabase.co` `remotePatterns` pinned to the project host, from #1024) is currently inert — signed document/image previews still render as raw ``. Route them through `next/image` to actually get AVIF + lazy optimization. | #1024; `src/components/clinical-dashboard/signed-image.tsx`; session 2026-07-21 | 2026-07-21 |\n| #016 | P3 | rec | \"Big but not easy\" structural + motion perf | Deferred larger levers: (a) nonce-CSP forces every product route to `ƒ Dynamic` (zero static generation) — evaluate Partial Prerendering / static shells for the static clinical catalogues (DSM/differentials/therapy/specifiers/formulation); (b) sidebar expand/collapse animates `grid-template-columns` (biggest smoothness cost, motion-gated — needs a transform-overlay rethink); (c) Therapy Compass fetches 692 KB / 2.5 MB JSON client-side (defer until interaction + confirm brotli); (d) settings/setup/admin dialogs static-imported into the home chunk (`next/dynamic` them). | session 2026-07-21 (build route table + design audit) | 2026-07-21 |\n| #017 | P3 | task | Field Web-Vitals baseline via live Lighthouse | In-sandbox runtime vitals were blocked (prod server hard-requires Supabase secrets; dev-mode CLS measured excellent at 0.00–0.04, content-first pages 0.000). Run Lighthouse against `psychiatry.tools` for real LCP/INP/CLS to prioritize #012–#016 by measured impact rather than reasoning. | session 2026-07-21 (measurement pass) | 2026-07-21 |\n| #018 | P2 | task | Monitoring retrieval-depth trio misses schedules | quality-lithium-monitoring-range, quality-antipsychotic-metabolic-monitoring, quality-adhd-medication-monitoring still fail targeting (\"no schedule/interval\") after the #1040 gate parity — their live chunk sets apparently surface no admissible schedule sentence. Diagnose via read-only chunk queries + run #61 dump artifact (30d retention) to split corpus-content vs retrieval-depth vs fact-extraction; fix shape TBD after diagnosis. A retrieval-side fix is a protected surface (canary pair, fresh ~$2-4 authorization). | run #61 targeting misses; branch-review-ledger 2026-07-21 | 2026-07-21 |\n| #019 | P2 | task | Comparison-class coverage: admission doc never in top-5 | admission-discharge-comparison misses its expected admission-side doc on every canary (#57-#61) — top-5 carries discharge-planning + unrelated docs only. Same \"why doesn't retrieval surface X\" species as #018; diagnose jointly. Ground-truth already widened (#1020); the residual is genuine comparison-class retrieval coverage. | runs #57-#61; PR #1020 replay verdict | 2026-07-21 |\n| #020 | P3 | task | Validate eval:quality cost readout post-fix | The estimator fix landed in PR #1050 (zero-usage cases count $0 with rates configured; provider-attempted cases with missing usage stay n/a). Remaining action: confirm the next canary run prints a real dollar figure in Answer Metrics, then archive this row. | PR #1050; run #60/#61 Answer Metrics tables | 2026-07-21 |\n| #021 | P3 | rec | E-3d H2 residual: strong/comparison generation discards | approx. 6 generation attempts per full 44-case run still fail the final quality gate and fall to extractive on strong-route comparison/complex shapes (the designed-conservative outcome). PARKED: weakest cost/benefit on the queue — a wave (approx. $2-4 pair + reviewer cycle) to shave seconds off a few hard cases. Revisit only if latency/waste complaints or a cheaper lever appears. | E-3c design record; runs #59-#61 diagnostics | 2026-07-21 |\n| #022 | P2 | task | Source-governance metadata refresh (operator) | Governance warning rate ~0.84 across canaries: stale/review-required/unknown source metadata on most top results. Operator work (document review-status attestation in the app), not a code defect. Next action: generate the prioritized refresh worklist ($0 read-only) and schedule a metadata pass. | runs #57-#61 Source Governance tables; docs/observability-slos.md | 2026-07-21 |\n| #023 | P3 | task | Read Sunday 2026-07-26 scheduled-run artifacts | The 18:00 UTC scheduled runs deliver three free datapoints at once: first full-44 weekly canary (validates the #1044 ANSWER_CASE_LIMIT raise), browser-matrix flake second datapoint (webkit ui-route-coverage now reproduced + root-caused 2026-07-22 → see #024; firefox ui-formulation:91 still awaits a datapoint), and the irrelevant@10 labeling-audit artifact (§3.1 human-decision class). Read all three, then disposition. | sessions 2026-07-20/21; branch-review-ledger convergence notes | 2026-07-21 |\n| #024 | P3 | issue | WebKit e2e `_rsc`-prefetch access-control-checks errors | verify:release:offline on `main` ce32fe170 (2026-07-22) reproduced #023's webkit clause: **6/6 deterministic** failures in `tests/ui-route-coverage.spec.ts` (Therapy Compass; DSM home/comparison; Specifier comparison/map; Differential stream), each a `pageerror … ?_rsc=… due to access control checks` on Next.js RSC prefetch — Chromium + Firefox clean. Not merge-blocking (required gate `test:e2e:pr` is chromium-only; the full webkit matrix is advisory/release-time). Most likely a Playwright route-interception × WebKit interaction, not a Safari user defect. Next: decide (a) allow/mock the `_rsc` routes for the `webkit` e2e project, or (b) confirm real Safari impact — before trusting the full-matrix webkit gate at release. NB the 2 other webkit fails (`ui-stress:412`, `ui-universal-search:210`) passed on isolated re-run = true flake. | session 2026-07-22 (verify:release:offline, `main` ce32fe170); refines #023 | 2026-07-22 |\n| #025 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so \"unknown\" ≠ \"bad\" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 |\n| #026 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same \"unknown ≠ bad\" hazard as #025 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |\n| #027 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 |\n| #028 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |\n| #029 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |\n| #030 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 |\n\n## Resolved / archive\n\nMove resolved rows here with the resolution date and a one-line outcome. Keep them — do not delete.\n\n| ID | Type | Summary | Outcome | Resolved |\n| ---- | ---- | ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n| #003 | task | Staging tenancy release evidence outstanding | Ran GitHub Action and validated isolation | 2026-07-21 |\n| #002 | task | Process-ownership fix not yet isolated on `main` | Fixed process isolation using child.pid termination | 2026-07-21 |\n| #008 | rec | Dead href builders in `document-flow-routes.ts` | Not dead code (false positive): `documentReaderHref`/`documentEvidenceHref` are live via the mock wrappers in `src/components/document-search-mockups.tsx` + `src/components/master-document-flow-mockups.tsx` (rendered under `src/app/mockups/document-search/`) and covered by `tests/document-flow-routes.test.ts`; removing breaks the build. Only the production non-mock hrefs are unlinked from prod UI — a wiring gap, not dead code. | 2026-07-22 |\n| #015 | task | Content-first fallback regression tests | Added `tests/registry-record-loader.dom.test.tsx` (8) + `tests/medication-record-page.dom.test.tsx` (6) covering content-first fallback paint, live swap-in, spinner/skeleton, error + not-found/unauthorized states, and the invariant that no authoritative verification badge shows before live governance reconciles (registry fixture-flag neutralization + medication governance-drop-on-error). | 2026-07-22 |\n| #004 | rec | Rescope provider-gated RAG safety ideas | Closed obsolete — rescue source (754-line RAG-safety worktree) unrecoverable/pruned across all refs; answer-quality thresholds + deep-health already shipped on `main` (#585/#587); only cost-cap preflight was genuinely missing and, per session decision, dropped rather than re-filed. | 2026-07-22 |\n---THEIRS ids---\n| #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 |\n| #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 |\n| #006 | P2 | issue | Globe \"Language & region\" button had no handler | Fixed in this PR to the disabled \"Coming soon\" placeholder convention (`aria-disabled` + sr-only note). Wire to a real language/region settings screen when one exists, then drop the placeholder state. | `src/components/clinical-dashboard/master-search-header.tsx:1829`; session 2026-07-21 | 2026-07-21 |\n| #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 |\n| #009 | P3 | rec | Confirm `/api/jobs` is intentionally server/ops-only | No client `fetch()` reaches `/api/jobs` (only tests import it). Confirm it is a deliberate ops/manual surface; if abandoned, remove it. | `src/app/api/jobs/route.ts` | 2026-07-21 |\n| #010 | P3 | task | Un-built \"Coming soon\" controls across forms/favourites | ~10 disabled placeholders (forms refine/reset, favourites sort/add/new-set, move-to-set, remove-favourite). Correctly flagged (`aria-disabled` + \"Coming soon\"), not defects — wire when the underlying features land. | `forms-search-results-page.tsx`; `favourites-hub.tsx`; `favourites-command-library-page.tsx` | 2026-07-21 |\n| #011 | P3 | task | Auth DB-connection allocation is operator-only | Supabase Auth (GoTrue) is capped at ~10 absolute DB connections (Supabase perf advisor). Switch to **percentage-based** allocation in the Supabase **dashboard** before the first compute scale-up — **not settable via SQL/MCP** (operator-owned). Verify via a staging soak + an approval-gated read-only advisor re-check. | `docs/auth-connection-cap-runbook.md`; `docs/process-hardening.md` (Known follow-up debts) | 2026-07-21 |\n| #012 | P3 | rec | Slim the lazy cross-mode differentials chunk | `cross-mode-differentials.ts` is dynamically imported (correctly code-split **out** of the initial/dashboard bundle — verified), but it pulls the full ~860 KB differentials snapshot (~125 KB gzip lazy chunk) just to build a tiny `{slug,title,clinicalHinge}` + presentations + aliases catalog. A precomputed lightweight index (generator + drift check, like the `specifiers-content` split / medications `fields=index`) would cut that lazy chunk ~5–10×. Not a bundle leak — an M-effort slim. | `src/lib/cross-mode-differentials.ts`; `src/components/clinical-dashboard/cross-mode-links.tsx:150`; session 2026-07-21 (build:analyze) | 2026-07-21 |\n| #013 | P3 | rec | Route-chunk + mockup catalogue JSON weight | `build:analyze`: `/specifiers` ships `specifiers-search-index.json` (~180 KB parsed), `/forms` ships `forms-catalog.json` (~132 KB), `/formulation` ships `formulation-content.json` (~52 KB, client-side local search — needs index/full split or a search endpoint, architectural). All route-scoped (not initial bundle). Also `*-mockups.tsx` (~100 KB across chunks) build though `/mockups` 404s in prod — exclude from the prod artifact. | session 2026-07-21 (build:analyze) | 2026-07-21 |\n| #014 | P3 | rec | Realize the `next/image` win on signed previews | `next.config` `images` (AVIF + `*.supabase.co` `remotePatterns` pinned to the project host, from #1024) is currently inert — signed document/image previews still render as raw ``. Route them through `next/image` to actually get AVIF + lazy optimization. | #1024; `src/components/clinical-dashboard/signed-image.tsx`; session 2026-07-21 | 2026-07-21 |\n| #016 | P3 | rec | \"Big but not easy\" structural + motion perf | Deferred larger levers: (a) nonce-CSP forces every product route to `ƒ Dynamic` (zero static generation) — evaluate Partial Prerendering / static shells for the static clinical catalogues (DSM/differentials/therapy/specifiers/formulation); (b) sidebar expand/collapse animates `grid-template-columns` (biggest smoothness cost, motion-gated — needs a transform-overlay rethink); (c) Therapy Compass fetches 692 KB / 2.5 MB JSON client-side (defer until interaction + confirm brotli); (d) settings/setup/admin dialogs static-imported into the home chunk (`next/dynamic` them). | session 2026-07-21 (build route table + design audit) | 2026-07-21 |\n| #017 | P3 | task | Field Web-Vitals baseline via live Lighthouse | In-sandbox runtime vitals were blocked (prod server hard-requires Supabase secrets; dev-mode CLS measured excellent at 0.00–0.04, content-first pages 0.000). Run Lighthouse against `psychiatry.tools` for real LCP/INP/CLS to prioritize #012–#016 by measured impact rather than reasoning. | session 2026-07-21 (measurement pass) | 2026-07-21 |\n| #018 | P2 | task | Monitoring retrieval-depth trio misses schedules | quality-lithium-monitoring-range, quality-antipsychotic-metabolic-monitoring, quality-adhd-medication-monitoring still fail targeting (\"no schedule/interval\") after the #1040 gate parity — their live chunk sets apparently surface no admissible schedule sentence. Diagnose via read-only chunk queries + run #61 dump artifact (30d retention) to split corpus-content vs retrieval-depth vs fact-extraction; fix shape TBD after diagnosis. A retrieval-side fix is a protected surface (canary pair, fresh ~$2-4 authorization). | run #61 targeting misses; branch-review-ledger 2026-07-21 | 2026-07-21 |\n| #019 | P2 | task | Comparison-class coverage: admission doc never in top-5 | admission-discharge-comparison misses its expected admission-side doc on every canary (#57-#61) — top-5 carries discharge-planning + unrelated docs only. Same \"why doesn't retrieval surface X\" species as #018; diagnose jointly. Ground-truth already widened (#1020); the residual is genuine comparison-class retrieval coverage. | runs #57-#61; PR #1020 replay verdict | 2026-07-21 |\n| #020 | P3 | task | Validate eval:quality cost readout post-fix | The estimator fix landed in PR #1050 (zero-usage cases count $0 with rates configured; provider-attempted cases with missing usage stay n/a). Remaining action: confirm the next canary run prints a real dollar figure in Answer Metrics, then archive this row. | PR #1050; run #60/#61 Answer Metrics tables | 2026-07-21 |\n| #021 | P3 | rec | E-3d H2 residual: strong/comparison generation discards | approx. 6 generation attempts per full 44-case run still fail the final quality gate and fall to extractive on strong-route comparison/complex shapes (the designed-conservative outcome). PARKED: weakest cost/benefit on the queue — a wave (approx. $2-4 pair + reviewer cycle) to shave seconds off a few hard cases. Revisit only if latency/waste complaints or a cheaper lever appears. | E-3c design record; runs #59-#61 diagnostics | 2026-07-21 |\n| #022 | P2 | task | Source-governance metadata refresh (operator) | Governance warning rate ~0.84 across canaries: stale/review-required/unknown source metadata on most top results. Operator work (document review-status attestation in the app), not a code defect. Next action: generate the prioritized refresh worklist ($0 read-only) and schedule a metadata pass. | runs #57-#61 Source Governance tables; docs/observability-slos.md | 2026-07-21 |\n| #023 | P3 | task | Read Sunday 2026-07-26 scheduled-run artifacts | The 18:00 UTC scheduled runs deliver three free datapoints at once: first full-44 weekly canary (validates the #1044 ANSWER_CASE_LIMIT raise), browser-matrix flake second datapoint (webkit ui-route-coverage now reproduced + root-caused 2026-07-22 → see #024; firefox ui-formulation:91 still awaits a datapoint), and the irrelevant@10 labeling-audit artifact (§3.1 human-decision class). Read all three, then disposition. | sessions 2026-07-20/21; branch-review-ledger convergence notes | 2026-07-21 |\n| #024 | P3 | issue | WebKit e2e `_rsc`-prefetch access-control-checks errors | verify:release:offline on `main` ce32fe170 (2026-07-22) reproduced #023's webkit clause: **6/6 deterministic** failures in `tests/ui-route-coverage.spec.ts` (Therapy Compass; DSM home/comparison; Specifier comparison/map; Differential stream), each a `pageerror … ?_rsc=… due to access control checks` on Next.js RSC prefetch — Chromium + Firefox clean. Not merge-blocking (required gate `test:e2e:pr` is chromium-only; the full webkit matrix is advisory/release-time). Most likely a Playwright route-interception × WebKit interaction, not a Safari user defect. Next: decide (a) allow/mock the `_rsc` routes for the `webkit` e2e project, or (b) confirm real Safari impact — before trusting the full-matrix webkit gate at release. NB the 2 other webkit fails (`ui-stress:412`, `ui-universal-search:210`) passed on isolated re-run = true flake. | session 2026-07-22 (verify:release:offline, `main` ce32fe170); refines #023 | 2026-07-22 |\n| #025 | P2 | task | Activate the three webhooks (operator secrets) | Merged (#968) + deployed but inert — verified live: `POST /api/webhooks/railway` returns `503 webhook_not_configured`. To turn on: (1) Railway → set `RAILWAY_WEBHOOK_SECRET` + add the `?token=…` webhook URL; (2) the chat URLs `SLACK_WEBHOOK_URL`/`DISCORD_WEBHOOK_URL` must be set in BOTH places — the Railway **app/server env** (the receiver forwards deploy alerts via `postChatNotification`, which reads server env, so repo-secret-only leaves the Railway webhook authenticated but returning `delivered:false`) AND as **GitHub repo secrets** (the CI-failure workflow reads `secrets.*`); (3) `SUPABASE_INGESTION_WEBHOOK_SECRET`. Each fails closed until set, so this is pure ops. See docs/webhooks.md. | session 2026-07-22; PR #968; docs/webhooks.md | 2026-07-22 |\n| #026 | P2 | task | Wire the Supabase document-change trigger | The `/api/webhooks/supabase/document-change` receiver is live but nothing calls it. The trigger (`notify_document_change_ingestion_webhook()` + `documents_ingestion_webhook`, SQL in docs/webhooks.md §3) must land as a **committed migration** — drift covers functions/triggers, so applying raw SQL to live would fail `check:drift`: add the migration, reconcile `supabase/schema.sql`, run `npm run drift:manifest` (needs a local Supabase container), then deploy. Operator-applied live state is the Vault secret (`select vault.create_secret('','ingestion_webhook_secret')`) + the base-URL GUC `app.ingestion_webhook_base_url`, which is MANDATORY per environment (the trigger no-ops when it is unset, so `reindex_requested` flips never enqueue — there is no production default). Trigger is `AFTER UPDATE` on `reindex_requested` only — NOT `INSERT` (an INSERT-fired webhook can beat the upload route's own job insert, which then deletes its just-created doc → intermittent upload failures); external inserts set `reindex_requested=true` to be picked up. Note delivery is at-most-once (pg_net has no retry) and there is NO built-in recovery (automatic or manual) for a dropped insert — neither the autopilot nor `scripts/reindex.ts` sweeps `queued` docs with no job (`hasIncompleteDocumentsWithoutOpenJobs` requires `queuedDocuments === 0`). External imports must insert then issue a SEPARATE UPDATE flipping `reindex_requested=true` (an insert with the flag pre-set won't fire the AFTER UPDATE trigger). The app upload path is NOT a guarantee either: it inserts the `documents` row then the `ingestion_jobs` row as two separate non-atomic calls (rollback only on a job-insert error), so a crash/timeout between them strands the same queued-without-job row nothing sweeps. The only true guarantees are an atomic enqueue (document + job in one transaction/RPC) or a scheduled queued-without-job sweep. Until applied, webhook #5 never fires. | session 2026-07-22; docs/webhooks.md §3 | 2026-07-22 |\n| #027 | P3 | rec | External uptime monitor independent of GitHub/Railway | `live-domain-monitor.yml` runs on GitHub's cron, so it won't run in exactly the outage it should catch (Actions or the deploy itself down). Add an off-platform synthetic monitor (UptimeRobot / Better Stack / Checkly) hitting `/api/health` with a webhook alert. Provider setup, not code. | session 2026-07-22 webhook review | 2026-07-22 |\n| #028 | P3 | rec | Runtime error tracking (Sentry or similar) | No error tracking in the repo — production exceptions on `psychiatry.tools`, including how often `RAG_PROVIDER_MODE=auto` silently degrades to source-only, are invisible. Weigh adding `@sentry/nextjs` (dependency + DSN secret + instrumentation) vs cost; alert → chat/issue. Provider-backed; needs explicit sign-off before adding the dependency. | session 2026-07-22 webhook review | 2026-07-22 |\n| #003 | task | Staging tenancy release evidence outstanding | Ran GitHub Action and validated isolation | 2026-07-21 |\n| #002 | task | Process-ownership fix not yet isolated on `main` | Fixed process isolation using child.pid termination | 2026-07-21 |\n| #008 | rec | Dead href builders in `document-flow-routes.ts` | Not dead code (false positive): `documentReaderHref`/`documentEvidenceHref` are live via the mock wrappers in `src/components/document-search-mockups.tsx` + `src/components/master-document-flow-mockups.tsx` (rendered under `src/app/mockups/document-search/`) and covered by `tests/document-flow-routes.test.ts`; removing breaks the build. Only the production non-mock hrefs are unlinked from prod UI — a wiring gap, not dead code. | 2026-07-22 |\n| #015 | task | Content-first fallback regression tests | Added `tests/registry-record-loader.dom.test.tsx` (8) + `tests/medication-record-page.dom.test.tsx` (6) covering content-first fallback paint, live swap-in, spinner/skeleton, error + not-found/unauthorized states, and the invariant that no authoritative verification badge shows before live governance reconciles (registry fixture-flag neutralization + medication governance-drop-on-error). | 2026-07-22 |\n| #004 | rec | Rescope provider-gated RAG safety ideas | Closed obsolete — rescue source (754-line RAG-safety worktree) unrecoverable/pruned across all refs; answer-quality thresholds + deep-health already shipped on `main` (#585/#587); only cost-cap preflight was genuinely missing and, per session decision, dropped rather than re-filed. | 2026-07-22 |\n---OURS last ids---\n| #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 |\n| #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 |\n| #006 | P2 | issue | Globe \"Language & region\" button had no handler | Fixed in this PR to the disabled \"Coming soon\" placeholder convention (`aria-disabled` + sr-only note). Wire to a real language/region settings screen when one exists, then drop the placeholder state. | `src/components/clinical-dashboard/master-search-header.tsx:1829`; session 2026-07-21 | 2026-07-21 |\n| #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 |\n| #009 | P3 | rec | Confirm `/api/jobs` is intentionally server/ops-only | No client `fetch()` reaches `/api/jobs` (only tests import it). Confirm it is a deliberate ops/manual surface; if abandoned, remove it. | `src/app/api/jobs/route.ts` | 2026-07-21 |\n| #010 | P3 | task | Un-built \"Coming soon\" controls across forms/favourites | ~10 disabled placeholders (forms refine/reset, favourites sort/add/new-set, move-to-set, remove-favourite). Correctly flagged (`aria-disabled` + \"Coming soon\"), not defects — wire when the underlying features land. | `forms-search-results-page.tsx`; `favourites-hub.tsx`; `favourites-command-library-page.tsx` | 2026-07-21 |\n| #011 | P3 | task | Auth DB-connection allocation is operator-only | Supabase Auth (GoTrue) is capped at ~10 absolute DB connections (Supabase perf advisor). Switch to **percentage-based** allocation in the Supabase **dashboard** before the first compute scale-up — **not settable via SQL/MCP** (operator-owned). Verify via a staging soak + an approval-gated read-only advisor re-check. | `docs/auth-connection-cap-runbook.md`; `docs/process-hardening.md` (Known follow-up debts) | 2026-07-21 |\n| #012 | P3 | rec | Slim the lazy cross-mode differentials chunk | `cross-mode-differentials.ts` is dynamically imported (correctly code-split **out** of the initial/dashboard bundle — verified), but it pulls the full ~860 KB differentials snapshot (~125 KB gzip lazy chunk) just to build a tiny `{slug,title,clinicalHinge}` + presentations + aliases catalog. A precomputed lightweight index (generator + drift check, like the `specifiers-content` split / medications `fields=index`) would cut that lazy chunk ~5–10×. Not a bundle leak — an M-effort slim. | `src/lib/cross-mode-differentials.ts`; `src/components/clinical-dashboard/cross-mode-links.tsx:150`; session 2026-07-21 (build:analyze) | 2026-07-21 |\n| #013 | P3 | rec | Route-chunk + mockup catalogue JSON weight | `build:analyze`: `/specifiers` ships `specifiers-search-index.json` (~180 KB parsed), `/forms` ships `forms-catalog.json` (~132 KB), `/formulation` ships `formulation-content.json` (~52 KB, client-side local search — needs index/full split or a search endpoint, architectural). All route-scoped (not initial bundle). Also `*-mockups.tsx` (~100 KB across chunks) build though `/mockups` 404s in prod — exclude from the prod artifact. | session 2026-07-21 (build:analyze) | 2026-07-21 |\n| #014 | P3 | rec | Realize the `next/image` win on signed previews | `next.config` `images` (AVIF + `*.supabase.co` `remotePatterns` pinned to the project host, from #1024) is currently inert — signed document/image previews still render as raw ``. Route them through `next/image` to actually get AVIF + lazy optimization. | #1024; `src/components/clinical-dashboard/signed-image.tsx`; session 2026-07-21 | 2026-07-21 |\n| #016 | P3 | rec | \"Big but not easy\" structural + motion perf | Deferred larger levers: (a) nonce-CSP forces every product route to `ƒ Dynamic` (zero static generation) — evaluate Partial Prerendering / static shells for the static clinical catalogues (DSM/differentials/therapy/specifiers/formulation); (b) sidebar expand/collapse animates `grid-template-columns` (biggest smoothness cost, motion-gated — needs a transform-overlay rethink); (c) Therapy Compass fetches 692 KB / 2.5 MB JSON client-side (defer until interaction + confirm brotli); (d) settings/setup/admin dialogs static-imported into the home chunk (`next/dynamic` them). | session 2026-07-21 (build route table + design audit) | 2026-07-21 |\n| #017 | P3 | task | Field Web-Vitals baseline via live Lighthouse | In-sandbox runtime vitals were blocked (prod server hard-requires Supabase secrets; dev-mode CLS measured excellent at 0.00–0.04, content-first pages 0.000). Run Lighthouse against `psychiatry.tools` for real LCP/INP/CLS to prioritize #012–#016 by measured impact rather than reasoning. | session 2026-07-21 (measurement pass) | 2026-07-21 |\n| #018 | P2 | task | Monitoring retrieval-depth trio misses schedules | quality-lithium-monitoring-range, quality-antipsychotic-metabolic-monitoring, quality-adhd-medication-monitoring still fail targeting (\"no schedule/interval\") after the #1040 gate parity — their live chunk sets apparently surface no admissible schedule sentence. Diagnose via read-only chunk queries + run #61 dump artifact (30d retention) to split corpus-content vs retrieval-depth vs fact-extraction; fix shape TBD after diagnosis. A retrieval-side fix is a protected surface (canary pair, fresh ~$2-4 authorization). | run #61 targeting misses; branch-review-ledger 2026-07-21 | 2026-07-21 |\n| #019 | P2 | task | Comparison-class coverage: admission doc never in top-5 | admission-discharge-comparison misses its expected admission-side doc on every canary (#57-#61) — top-5 carries discharge-planning + unrelated docs only. Same \"why doesn't retrieval surface X\" species as #018; diagnose jointly. Ground-truth already widened (#1020); the residual is genuine comparison-class retrieval coverage. | runs #57-#61; PR #1020 replay verdict | 2026-07-21 |\n| #020 | P3 | task | Validate eval:quality cost readout post-fix | The estimator fix landed in PR #1050 (zero-usage cases count $0 with rates configured; provider-attempted cases with missing usage stay n/a). Remaining action: confirm the next canary run prints a real dollar figure in Answer Metrics, then archive this row. | PR #1050; run #60/#61 Answer Metrics tables | 2026-07-21 |\n| #021 | P3 | rec | E-3d H2 residual: strong/comparison generation discards | approx. 6 generation attempts per full 44-case run still fail the final quality gate and fall to extractive on strong-route comparison/complex shapes (the designed-conservative outcome). PARKED: weakest cost/benefit on the queue — a wave (approx. $2-4 pair + reviewer cycle) to shave seconds off a few hard cases. Revisit only if latency/waste complaints or a cheaper lever appears. | E-3c design record; runs #59-#61 diagnostics | 2026-07-21 |\n| #022 | P2 | task | Source-governance metadata refresh (operator) | Governance warning rate ~0.84 across canaries: stale/review-required/unknown source metadata on most top results. Operator work (document review-status attestation in the app), not a code defect. Next action: generate the prioritized refresh worklist ($0 read-only) and schedule a metadata pass. | runs #57-#61 Source Governance tables; docs/observability-slos.md | 2026-07-21 |\n| #023 | P3 | task | Read Sunday 2026-07-26 scheduled-run artifacts | The 18:00 UTC scheduled runs deliver three free datapoints at once: first full-44 weekly canary (validates the #1044 ANSWER_CASE_LIMIT raise), browser-matrix flake second datapoint (webkit ui-route-coverage now reproduced + root-caused 2026-07-22 → see #024; firefox ui-formulation:91 still awaits a datapoint), and the irrelevant@10 labeling-audit artifact (§3.1 human-decision class). Read all three, then disposition. | sessions 2026-07-20/21; branch-review-ledger convergence notes | 2026-07-21 |\n| #024 | P3 | issue | WebKit e2e `_rsc`-prefetch access-control-checks errors | verify:release:offline on `main` ce32fe170 (2026-07-22) reproduced #023's webkit clause: **6/6 deterministic** failures in `tests/ui-route-coverage.spec.ts` (Therapy Compass; DSM home/comparison; Specifier comparison/map; Differential stream), each a `pageerror … ?_rsc=… due to access control checks` on Next.js RSC prefetch — Chromium + Firefox clean. Not merge-blocking (required gate `test:e2e:pr` is chromium-only; the full webkit matrix is advisory/release-time). Most likely a Playwright route-interception × WebKit interaction, not a Safari user defect. Next: decide (a) allow/mock the `_rsc` routes for the `webkit` e2e project, or (b) confirm real Safari impact — before trusting the full-matrix webkit gate at release. NB the 2 other webkit fails (`ui-stress:412`, `ui-universal-search:210`) passed on isolated re-run = true flake. | session 2026-07-22 (verify:release:offline, `main` ce32fe170); refines #023 | 2026-07-22 |\n| #025 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so \"unknown\" ≠ \"bad\" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 |\n| #026 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same \"unknown ≠ bad\" hazard as #025 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |\n| #027 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 |\n| #028 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |\n| #029 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |\n| #030 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 |\n| #003 | task | Staging tenancy release evidence outstanding | Ran GitHub Action and validated isolation | 2026-07-21 |\n| #002 | task | Process-ownership fix not yet isolated on `main` | Fixed process isolation using child.pid termination | 2026-07-21 |\n| #008 | rec | Dead href builders in `document-flow-routes.ts` | Not dead code (false positive): `documentReaderHref`/`documentEvidenceHref` are live via the mock wrappers in `src/components/document-search-mockups.tsx` + `src/components/master-document-flow-mockups.tsx` (rendered under `src/app/mockups/document-search/`) and covered by `tests/document-flow-routes.test.ts`; removing breaks the build. Only the production non-mock hrefs are unlinked from prod UI — a wiring gap, not dead code. | 2026-07-22 |\n| #015 | task | Content-first fallback regression tests | Added `tests/registry-record-loader.dom.test.tsx` (8) + `tests/medication-record-page.dom.test.tsx` (6) covering content-first fallback paint, live swap-in, spinner/skeleton, error + not-found/unauthorized states, and the invariant that no authoritative verification badge shows before live governance reconciles (registry fixture-flag neutralization + medication governance-drop-on-error). | 2026-07-22 |\n| #004 | rec | Rescope provider-gated RAG safety ideas | Closed obsolete — rescue source (754-line RAG-safety worktree) unrecoverable/pruned across all refs; answer-quality thresholds + deep-health already shipped on `main` (#585/#587); only cost-cap preflight was genuinely missing and, per session decision, dropped rather than re-filed. | 2026-07-22 |\n","/bin/bash -lc \"git show :2:docs/outstanding-issues.md > /tmp/ours.md; git show :3:docs/outstanding-issues.md > /tmp/theirs.md; tail -n +25 /tmp/ours.md | head -n 90; echo '---THEIRS ids---'; rg '\"'^'\"\\\\| #0' /tmp/theirs.md; echo '---OURS last ids---'; rg '\"'^'\"\\\\| #0' /tmp/ours.md\"",[788],"2123",{"_524":789,"_93":539},"git show :2:docs/outstanding-issues.md > /tmp/ours.md; git show :3:docs/outstanding-issues.md > /tmp/theirs.md; tail -n +25 /tmp/ours.md | head -n 90; echo '---THEIRS ids---'; rg '^\\| #0' /tmp/theirs.md; echo '---OURS last ids---'; rg '^\\| #0' /tmp/ours.md",{"_470":791,"_449":450,"_472":456},{"_542":792,"_513":778,"_42":793,"_477":794,"_208":546,"_547":-5,"_93":548},"{\"cmd\":\"git show :2:docs/outstanding-issues.md > /tmp/ours.md; git show :3:docs/outstanding-issues.md > /tmp/theirs.md; tail -n +25 /tmp/ours.md | head -n 90; echo '---THEIRS ids---'; rg '^\\\\| #0' /tmp/theirs.md; echo '---OURS last ids---'; rg '^\\\\| #0' /tmp/ours.md\",\"workdir\":\"/workspace/Database\",\"max_output_tokens\":30000}","fc_040c0fdc22270fa6016a60660966ac8197be7499b9cf1c0c4c",{"_482":456},{"_470":796,"_449":450,"_472":456},{"_473":-5,"_494":797,"_42":798,"_477":799,"_498":800,"_93":500},"gAAAAABqYGYJZQnmW4T9wV2T3wkFr3YYh98eKhbsx0JeVjvdXYoLJLbgX2deZrENBI1EfKQBHz2jSsUJK6z1ZtUv3CewU0IFrlXBVlQrfP0lIahBjUtEq-tj0JoC1SNr9L_hWEgRd15wDVUDwpNvRvRyyjnJu2gZDR9PFvmzcIu8oJdChm7484l7bA2YZPITV2xo411Z4ERVZgCzjKCtbwMukQe_p7S-PEL8jjYqFhw2vY4nF4m-EhCWpAFxk-2nHKpX9G45EEDVYB3pBFFV4f40xUGzUZaPZNrtnngFdlF_UBS_btee2x1c7gRQo4R5sbHcfSc4f9hmB8Axi_HLikiIBpVGABmxtous9t-YDkV8RfL1u0V5QUV8CE3cDx7K0Ec8YkF9UXWW3DM6mv1LCa_0JJWqtMst4Jl3bOKXMmg7yodbLS36_XGOAWChNyQ5pZcSEhUU5bR9LSEI9Gb0SwGoszldGKuvzHtxBZtsckvEUyiNmSE6QVUtYbsIw5iwp-lhen6nKssESP-mNrAYjjGCuBktycSeeV9u7AN1M-efqy-Jt_reLE-Y9LBmuJtxslo5x4ChgGBBP08f9SKBaY9PwvC40y-SNIhC4kmg4dZuhkULtGY1ZNYFlhVY15F8GRvU-YsxjpvizBmvmrBzNaywFzw-ziGgc7bWGpHHbpoFlSqbYVwwjX4D9CbndrfGlpKDzmrktCh5bfmSY73MmgrSediHMZQQZlPhowU37p28qKtNumQ5FlyuYhHi-NI_t6Gpxih8Fiqjcs9EBVgT7MVgKlPyaUg6C4PfWAo-R1TKvBthGLlmUBLAehrkAYPRQUpoQQHd5dfpUfF6rHhGJgwYCr3JRTEOIc-wuYO_Aoi80JYFEwsRHLmx-r2tgoHWu_FyHjdEDGsUHMlZh4E-cGXg8ImNkaSX-jt4UNuQH3yNivY5sr-YpZLK5e5XlP39GavWkwunpOsjTiQ4pe_RvEw31_nXvtBGYTTAWvBEGhInpdD6mAi7hTdIHBveLkDP0-5pzQOTF29ij1xf4EdzJeBik24hdUSwqBWkxH3fE7D2CqnAZnhvI7j118kVOSFf512t784Y9c-tBXc3z6LE589nJdlLs8KUC0qQbD6B9XtCs_mqWn9r8HlWFqzwmqvA5qTQagWfsk-7-pI_IwUm1Sm7ljgYCpHNaZmJsGsw3ufYMSckyRMrUg-5TWMZIgEjsSCZ3OLbmaDa","rs_040c0fdc22270fa6016a6066064fd08197b4ed0cbe8416c755",{"_482":456},[801],{"_46":802,"_93":504},"**Renumbering PR commits to avoid conflicts**",{"_488":804,"_470":805,"_449":450,"_472":456},1784702473442,{"_473":806,"_42":798,"_498":807,"_93":500},[],[802],{"_488":809,"_470":810,"_449":450,"_472":456},1784702469074,{"_522":811,"_524":812,"_526":813,"_528":529,"_454":814,"_531":32,"_42":815,"_532":816,"_534":535,"_463":114,"_93":536},"30:<<<<<<< HEAD\n62:=======\n92:>>>>>>> origin/main\n# Outstanding Issues, Recommendations & Tasks\n\nDurable, cross-session memory of everything still outstanding for this repo: open **tasks**,\n**recommendations** not yet acted on, and **issues** not yet resolved. Chat context is ephemeral\n(sessions summarise and reset); this file is not — it is the single source of truth the\n[`/issues` skill](../.claude/skills/issues/SKILL.md) reads back and updates.\n\n**Rule of thumb:** if it is worth remembering after this session ends, it belongs here.\n\n## How this is used\n\n- Say `/issues` in Claude Code → the skill reads this file and states the open items back,\n grouped by priority with a one-line summary count. Nothing is mutated on a plain read.\n- `/issues add …`, `/issues done `, `/issues capture`, and friends mutate the tables below.\n The full command surface lives in the skill file.\n- Every mutation keeps this file committed so the memory survives across sessions and worktrees.\n\n## Conventions\n\n- **ID** is a monotonic `#NNN`, never reused. Allocate the next number above the current max\n across _both_ tables (open + resolved).\n- **Pri**: `P1` (do next / blocking), `P2` (should do), `P3` (nice-to-have / revisit-when).\n- **Type**: `task` (a concrete unit of work), `rec` (a recommendation to weigh), or\n `issue` (a defect / risk / gap).\n- **Detail / next action** is the smallest thing that would move the item forward.\n- **Source** points at where it came from: a doc, a PR (`#123`), a file:line, or `session YYYY-MM-DD`.\n- Resolving an item moves its row to **Resolved / archive** with the date and a one-line outcome —\n rows are archived, not deleted, so the history stays auditable.\n\n<<<<<<< HEAD\n\n\n## Open items\n\n| ID | Pri | Type | Summary | Detail / next action | Source | Added |\n| ---- | --- | ----- | ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n| #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 |\n| #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 |\n| #006 | P2 | issue | Globe \"Language & region\" button had no handler | Fixed in this PR to the disabled \"Coming soon\" placeholder convention (`aria-disabled` + sr-only note). Wire to a real language/region settings screen when one exists, then drop the placeholder state. | `src/components/clinical-dashboard/master-search-header.tsx:1829`; session 2026-07-21 | 2026-07-21 |\n| #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 |\n| #009 | P3 | rec | Confirm `/api/jobs` is intentionally server/ops-only | No client `fetch()` reaches `/api/jobs` (only tests import it). Confirm it is a deliberate ops/manual surface; if abandoned, remove it. | `src/app/api/jobs/route.ts` | 2026-07-21 |\n| #010 | P3 | task | Un-built \"Coming soon\" controls across forms/favourites | ~10 disabled placeholders (forms refine/reset, favourites sort/add/new-set, move-to-set, remove-favourite). Correctly flagged (`aria-disabled` + \"Coming soon\"), not defects — wire when the underlying features land. | `forms-search-results-page.tsx`; `favourites-hub.tsx`; `favourites-command-library-page.tsx` | 2026-07-21 |\n| #011 | P3 | task | Auth DB-connection allocation is operator-only | Supabase Auth (GoTrue) is capped at ~10 absolute DB connections (Supabase perf advisor). Switch to **percentage-based** allocation in the Supabase **dashboard** before the first compute scale-up — **not settable via SQL/MCP** (operator-owned). Verify via a staging soak + an approval-gated read-only advisor re-check. | `docs/auth-connection-cap-runbook.md`; `docs/process-hardening.md` (Known follow-up debts) | 2026-07-21 |\n| #012 | P3 | rec | Slim the lazy cross-mode differentials chunk | `cross-mode-differentials.ts` is dynamically imported (correctly code-split **out** of the initial/dashboard bundle — verified), but it pulls the full ~860 KB differentials snapshot (~125 KB gzip lazy chunk) just to build a tiny `{slug,title,clinicalHinge}` + presentations + aliases catalog. A precomputed lightweight index (generator + drift check, like the `specifiers-content` split / medications `fields=index`) would cut that lazy chunk ~5–10×. Not a bundle leak — an M-effort slim. | `src/lib/cross-mode-differentials.ts`; `src/components/clinical-dashboard/cross-mode-links.tsx:150`; session 2026-07-21 (build:analyze) | 2026-07-21 |\n| #013 | P3 | rec | Route-chunk + mockup catalogue JSON weight | `build:analyze`: `/specifiers` ships `specifiers-search-index.json` (~180 KB parsed), `/forms` ships `forms-catalog.json` (~132 KB), `/formulation` ships `formulation-content.json` (~52 KB, client-side local search — needs index/full split or a search endpoint, architectural). All route-scoped (not initial bundle). Also `*-mockups.tsx` (~100 KB across chunks) build though `/mockups` 404s in prod — exclude from the prod artifact. | session 2026-07-21 (build:analyze) | 2026-07-21 |\n| #014 | P3 | rec | Realize the `next/image` win on signed previews | `next.config` `images` (AVIF + `*.supabase.co` `remotePatterns` pinned to the project host, from #1024) is currently inert — signed document/image previews still render as raw ``. Route them through `next/image` to actually get AVIF + lazy optimization. | #1024; `src/components/clinical-dashboard/signed-image.tsx`; session 2026-07-21 | 2026-07-21 |\n| #016 | P3 | rec | \"Big but not easy\" structural + motion perf | Deferred larger levers: (a) nonce-CSP forces every product route to `ƒ Dynamic` (zero static generation) — evaluate Partial Prerendering / static shells for the static clinical catalogues (DSM/differentials/therapy/specifiers/formulation); (b) sidebar expand/collapse animates `grid-template-columns` (biggest smoothness cost, motion-gated — needs a transform-overlay rethink); (c) Therapy Compass fetches 692 KB / 2.5 MB JSON client-side (defer until interaction + confirm brotli); (d) settings/setup/admin dialogs static-imported into the home chunk (`next/dynamic` them). | session 2026-07-21 (build route table + design audit) | 2026-07-21 |\n| #017 | P3 | task | Field Web-Vitals baseline via live Lighthouse | In-sandbox runtime vitals were blocked (prod server hard-requires Supabase secrets; dev-mode CLS measured excellent at 0.00–0.04, content-first pages 0.000). Run Lighthouse against `psychiatry.tools` for real LCP/INP/CLS to prioritize #012–#016 by measured impact rather than reasoning. | session 2026-07-21 (measurement pass) | 2026-07-21 |\n| #018 | P2 | task | Monitoring retrieval-depth trio misses schedules | quality-lithium-monitoring-range, quality-antipsychotic-metabolic-monitoring, quality-adhd-medication-monitoring still fail targeting (\"no schedule/interval\") after the #1040 gate parity — their live chunk sets apparently surface no admissible schedule sentence. Diagnose via read-only chunk queries + run #61 dump artifact (30d retention) to split corpus-content vs retrieval-depth vs fact-extraction; fix shape TBD after diagnosis. A retrieval-side fix is a protected surface (canary pair, fresh ~$2-4 authorization). | run #61 targeting misses; branch-review-ledger 2026-07-21 | 2026-07-21 |\n| #019 | P2 | task | Comparison-class coverage: admission doc never in top-5 | admission-discharge-comparison misses its expected admission-side doc on every canary (#57-#61) — top-5 carries discharge-planning + unrelated docs only. Same \"why doesn't retrieval surface X\" species as #018; diagnose jointly. Ground-truth already widened (#1020); the residual is genuine comparison-class retrieval coverage. | runs #57-#61; PR #1020 replay verdict | 2026-07-21 |\n| #020 | P3 | task | Validate eval:quality cost readout post-fix | The estimator fix landed in PR #1050 (zero-usage cases count $0 with rates configured; provider-attempted cases with missing usage stay n/a). Remaining action: confirm the next canary run prints a real dollar figure in Answer Metrics, then archive this row. | PR #1050; run #60/#61 Answer Metrics tables | 2026-07-21 |\n| #021 | P3 | rec | E-3d H2 residual: strong/comparison generation discards | approx. 6 generation attempts per full 44-case run still fail the final quality gate and fall to extractive on strong-route comparison/complex shapes (the designed-conservative outcome). PARKED: weakest cost/benefit on the queue — a wave (approx. $2-4 pair + reviewer cycle) to shave seconds off a few hard cases. Revisit only if latency/waste complaints or a cheaper lever appears. | E-3c design record; runs #59-#61 diagnostics | 2026-07-21 |\n| #022 | P2 | task | Source-governance metadata refresh (operator) | Governance warning rate ~0.84 across canaries: stale/review-required/unknown source metadata on most top results. Operator work (document review-status attestation in the app), not a code defect. Next action: generate the prioritized refresh worklist ($0 read-only) and schedule a metadata pass. | runs #57-#61 Source Governance tables; docs/observability-slos.md | 2026-07-21 |\n| #023 | P3 | task | Read Sunday 2026-07-26 scheduled-run artifacts | The 18:00 UTC scheduled runs deliver three free datapoints at once: first full-44 weekly canary (validates the #1044 ANSWER_CASE_LIMIT raise), browser-matrix flake second datapoint (webkit ui-route-coverage now reproduced + root-caused 2026-07-22 → see #024; firefox ui-formulation:91 still awaits a datapoint), and the irrelevant@10 labeling-audit artifact (§3.1 human-decision class). Read all three, then disposition. | sessions 2026-07-20/21; branch-review-ledger convergence notes | 2026-07-21 |\n| #024 | P3 | issue | WebKit e2e `_rsc`-prefetch access-control-checks errors | verify:release:offline on `main` ce32fe170 (2026-07-22) reproduced #023's webkit clause: **6/6 deterministic** failures in `tests/ui-route-coverage.spec.ts` (Therapy Compass; DSM home/comparison; Specifier comparison/map; Differential stream), each a `pageerror … ?_rsc=… due to access control checks` on Next.js RSC prefetch — Chromium + Firefox clean. Not merge-blocking (required gate `test:e2e:pr` is chromium-only; the full webkit matrix is advisory/release-time). Most likely a Playwright route-interception × WebKit interaction, not a Safari user defect. Next: decide (a) allow/mock the `_rsc` routes for the `webkit` e2e project, or (b) confirm real Safari impact — before trusting the full-matrix webkit gate at release. NB the 2 other webkit fails (`ui-stress:412`, `ui-universal-search:210`) passed on isolated re-run = true flake. | session 2026-07-22 (verify:release:offline, `main` ce32fe170); refines #023 | 2026-07-22 |\n| #025 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so \"unknown\" ≠ \"bad\" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 |\n| #026 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same \"unknown ≠ bad\" hazard as #025 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |\n| #027 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 |\n| #028 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |\n| #029 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |\n| #030 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 |\n=======\n\n\n## Open items\n\n| ID | Pri | Type | Summary | Detail / next action | Source | Added |\n| ---- | --- | ----- | ------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n| #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 |\n| #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 |\n| #006 | P2 | issue | Globe \"Language & region\" button had no handler | Fixed in this PR to the disabled \"Coming soon\" placeholder convention (`aria-disabled` + sr-only note). Wire to a real language/region settings screen when one exists, then drop the placeholder state. | `src/components/clinical-dashboard/master-search-header.tsx:1829`; session 2026-07-21 | 2026-07-21 |\n| #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 |\n| #009 | P3 | rec | Confirm `/api/jobs` is intentionally server/ops-only | No client `fetch()` reaches `/api/jobs` (only tests import it). Confirm it is a deliberate ops/manual surface; if abandoned, remove it. | `src/app/api/jobs/route.ts` | 2026-07-21 |\n| #010 | P3 | task | Un-built \"Coming soon\" controls across forms/favourites | ~10 disabled placeholders (forms refine/reset, favourites sort/add/new-set, move-to-set, remove-favourite). Correctly flagged (`aria-disabled` + \"Coming soon\"), not defects — wire when the underlying features land. | `forms-search-results-page.tsx`; `favourites-hub.tsx`; `favourites-command-library-page.tsx` | 2026-07-21 |\n| #011 | P3 | task | Auth DB-connection allocation is operator-only | Supabase Auth (GoTrue) is capped at ~10 absolute DB connections (Supabase perf advisor). Switch to **percentage-based** allocation in the Supabase **dashboard** before the first compute scale-up — **not settable via SQL/MCP** (operator-owned). Verify via a staging soak + an approval-gated read-only advisor re-check. | `docs/auth-connection-cap-runbook.md`; `docs/process-hardening.md` (Known follow-up debts) | 2026-07-21 |\n| #012 | P3 | rec | Slim the lazy cross-mode differentials chunk | `cross-mode-differentials.ts` is dynamically imported (correctly code-split **out** of the initial/dashboard bundle — verified), but it pulls the full ~860 KB differentials snapshot (~125 KB gzip lazy chunk) just to build a tiny `{slug,title,clinicalHinge}` + presentations + aliases catalog. A precomputed lightweight index (generator + drift check, like the `specifiers-content` split / medications `fields=index`) would cut that lazy chunk ~5–10×. Not a bundle leak — an M-effort slim. | `src/lib/cross-mode-differentials.ts`; `src/components/clinical-dashboard/cross-mode-links.tsx:150`; session 2026-07-21 (build:analyze) | 2026-07-21 |\n| #013 | P3 | rec | Route-chunk + mockup catalogue JSON weight | `build:analyze`: `/specifiers` ships `specifiers-search-index.json` (~180 KB parsed), `/forms` ships `forms-catalog.json` (~132 KB), `/formulation` ships `formulation-content.json` (~52 KB, client-side local search — needs index/full split or a search endpoint, architectural). All route-scoped (not initial bundle). Also `*-mockups.tsx` (~100 KB across chunks) build though `/mockups` 404s in prod — exclude from the prod artifact. | session 2026-07-21 (build:analyze) | 2026-07-21 |\n| #014 | P3 | rec | Realize the `next/image` win on signed previews | `next.config` `images` (AVIF + `*.supabase.co` `remotePatterns` pinned to the project host, from #1024) is currently inert — signed document/image previews still render as raw ``. Route them through `next/image` to actually get AVIF + lazy optimization. | #1024; `src/components/clinical-dashboard/signed-image.tsx`; session 2026-07-21 | 2026-07-21 |\n| #016 | P3 | rec | \"Big but not easy\" structural + motion perf | Deferred larger levers: (a) nonce-CSP forces every product route to `ƒ Dynamic` (zero static generation) — evaluate Partial Prerendering / static shells for the static clinical catalogues (DSM/differentials/therapy/specifiers/formulation); (b) sidebar expand/collapse animates `grid-template-columns` (biggest smoothness cost, motion-gated — needs a transform-overlay rethink); (c) Therapy Compass fetches 692 KB / 2.5 MB JSON client-side (defer until interaction + confirm brotli); (d) settings/setup/admin dialogs static-imported into the home chunk (`next/dynamic` them). | session 2026-07-21 (build route table + design audit) | 2026-07-21 |\n| #017 | P3 | task | Field Web-Vitals baseline via live Lighthouse | In-sandbox runtime vitals were blocked (prod server hard-requires Supabase secrets; dev-mode CLS measured excellent at 0.00–0.04, content-first pages 0.000). Run Lighthouse against `psychiatry.tools` for real LCP/INP/CLS to prioritize #012–#016 by measured impact rather than reasoning. | session 2026-07-21 (measurement pass) | 2026-07-21 |\n| #018 | P2 | task | Monitoring retrieval-depth trio misses schedules | quality-lithium-monitoring-range, quality-antipsychotic-metabolic-monitoring, quality-adhd-medication-monitoring still fail targeting (\"no schedule/interval\") after the #1040 gate parity — their live chunk sets apparently surface no admissible schedule sentence. Diagnose via read-only chunk queries + run #61 dump artifact (30d retention) to split corpus-content vs retrieval-depth vs fact-extraction; fix shape TBD after diagnosis. A retrieval-side fix is a protected surface (canary pair, fresh ~$2-4 authorization). | run #61 targeting misses; branch-review-ledger 2026-07-21 | 2026-07-21 |\n| #019 | P2 | task | Comparison-class coverage: admission doc never in top-5 | admission-discharge-comparison misses its expected admission-side doc on every canary (#57-#61) — top-5 carries discharge-planning + unrelated docs only. Same \"why doesn't retrieval surface X\" species as #018; diagnose jointly. Ground-truth already widened (#1020); the residual is genuine comparison-class retrieval coverage. | runs #57-#61; PR #1020 replay verdict | 2026-07-21 |\n| #020 | P3 | task | Validate eval:quality cost readout post-fix | The estimator fix landed in PR #1050 (zero-usage cases count $0 with rates configured; provider-attempted cases with missing usage stay n/a). Remaining action: confirm the next canary run prints a real dollar figure in Answer Metrics, then archive this row. | PR #1050; run #60/#61 Answer Metrics tables | 2026-07-21 |\n| #021 | P3 | rec | E-3d H2 residual: strong/comparison generation discards | approx. 6 generation attempts per full 44-case run still fail the final quality gate and fall to extractive on strong-route comparison/complex shapes (the designed-conservative outcome). PARKED: weakest cost/benefit on the queue — a wave (approx. $2-4 pair + reviewer cycle) to shave seconds off a few hard cases. Revisit only if latency/waste complaints or a cheaper lever appears. | E-3c design record; runs #59-#61 diagnostics | 2026-07-21 |\n| #022 | P2 | task | Source-governance metadata refresh (operator) | Governance warning rate ~0.84 across canaries: stale/review-required/unknown source metadata on most top results. Operator work (document review-status attestation in the app), not a code defect. Next action: generate the prioritized refresh worklist ($0 read-only) and schedule a metadata pass. | runs #57-#61 Source Governance tables; docs/observability-slos.md | 2026-07-21 |\n| #023 | P3 | task | Read Sunday 2026-07-26 scheduled-run artifacts | The 18:00 UTC scheduled runs deliver three free datapoints at once: first full-44 weekly canary (validates the #1044 ANSWER_CASE_LIMIT raise), browser-matrix flake second datapoint (webkit ui-route-coverage now reproduced + root-caused 2026-07-22 → see #024; firefox ui-formulation:91 still awaits a datapoint), and the irrelevant@10 labeling-audit artifact (§3.1 human-decision class). Read all three, then disposition. | sessions 2026-07-20/21; branch-review-ledger convergence notes | 2026-07-21 |\n| #024 | P3 | issue | WebKit e2e `_rsc`-prefetch access-control-checks errors | verify:release:offline on `main` ce32fe170 (2026-07-22) reproduced #023's webkit clause: **6/6 deterministic** failures in `tests/ui-route-coverage.spec.ts` (Therapy Compass; DSM home/comparison; Specifier comparison/map; Differential stream), each a `pageerror … ?_rsc=… due to access control checks` on Next.js RSC prefetch — Chromium + Firefox clean. Not merge-blocking (required gate `test:e2e:pr` is chromium-only; the full webkit matrix is advisory/release-time). Most likely a Playwright route-interception × WebKit interaction, not a Safari user defect. Next: decide (a) allow/mock the `_rsc` routes for the `webkit` e2e project, or (b) confirm real Safari impact — before trusting the full-matrix webkit gate at release. NB the 2 other webkit fails (`ui-stress:412`, `ui-universal-search:210`) passed on isolated re-run = true flake. | session 2026-07-22 (verify:release:offline, `main` ce32fe170); refines #023 | 2026-07-22 |\n| #025 | P2 | task | Activate the three webhooks (operator secrets) | Merged (#968) + deployed but inert — verified live: `POST /api/webhooks/railway` returns `503 webhook_not_configured`. To turn on: (1) Railway → set `RAILWAY_WEBHOOK_SECRET` + add the `?token=…` webhook URL; (2) the chat URLs `SLACK_WEBHOOK_URL`/`DISCORD_WEBHOOK_URL` must be set in BOTH places — the Railway **app/server env** (the receiver forwards deploy alerts via `postChatNotification`, which reads server env, so repo-secret-only leaves the Railway webhook authenticated but returning `delivered:false`) AND as **GitHub repo secrets** (the CI-failure workflow reads `secrets.*`); (3) `SUPABASE_INGESTION_WEBHOOK_SECRET`. Each fails closed until set, so this is pure ops. See docs/webhooks.md. | session 2026-07-22; PR #968; docs/webhooks.md | 2026-07-22 |\n| #026 | P2 | task | Wire the Supabase document-change trigger | The `/api/webhooks/supabase/document-change` receiver is live but nothing calls it. The trigger (`notify_document_change_ingestion_webhook()` + `documents_ingestion_webhook`, SQL in docs/webhooks.md §3) must land as a **committed migration** — drift covers functions/triggers, so applying raw SQL to live would fail `check:drift`: add the migration, reconcile `supabase/schema.sql`, run `npm run drift:manifest` (needs a local Supabase container), then deploy. Operator-applied live state is the Vault secret (`select vault.create_secret('','ingestion_webhook_secret')`) + the base-URL GUC `app.ingestion_webhook_base_url`, which is MANDATORY per environment (the trigger no-ops when it is unset, so `reindex_requested` flips never enqueue — there is no production default). Trigger is `AFTER UPDATE` on `reindex_requested` only — NOT `INSERT` (an INSERT-fired webhook can beat the upload route's own job insert, which then deletes its just-created doc → intermittent upload failures); external inserts set `reindex_requested=true` to be picked up. Note delivery is at-most-once (pg_net has no retry) and there is NO built-in recovery (automatic or manual) for a dropped insert — neither the autopilot nor `scripts/reindex.ts` sweeps `queued` docs with no job (`hasIncompleteDocumentsWithoutOpenJobs` requires `queuedDocuments === 0`). External imports must insert then issue a SEPARATE UPDATE flipping `reindex_requested=true` (an insert with the flag pre-set won't fire the AFTER UPDATE trigger). The app upload path is NOT a guarantee either: it inserts the `documents` row then the `ingestion_jobs` row as two separate non-atomic calls (rollback only on a job-insert error), so a crash/timeout between them strands the same queued-without-job row nothing sweeps. The only true guarantees are an atomic enqueue (document + job in one transaction/RPC) or a scheduled queued-without-job sweep. Until applied, webhook #5 never fires. | session 2026-07-22; docs/webhooks.md §3 | 2026-07-22 |\n| #027 | P3 | rec | External uptime monitor independent of GitHub/Railway | `live-domain-monitor.yml` runs on GitHub's cron, so it won't run in exactly the outage it should catch (Actions or the deploy itself down). Add an off-platform synthetic monitor (UptimeRobot / Better Stack / Checkly) hitting `/api/health` with a webhook alert. Provider setup, not code. | session 2026-07-22 webhook review | 2026-07-22 |\n| #028 | P3 | rec | Runtime error tracking (Sentry or similar) | No error tracking in the repo — production exceptions on `psychiatry.tools`, including how often `RAG_PROVIDER_MODE=auto` silently degrades to source-only, are invisible. Weigh adding `@sentry/nextjs` (dependency + DSN secret + instrumentation) vs cost; alert → chat/issue. Provider-backed; needs explicit sign-off before adding the dependency. | session 2026-07-22 webhook review | 2026-07-22 |\n>>>>>>> origin/main\n\n## Resolved / archive\n\nMove resolved rows here with the resolution date and a one-line outcome. Keep them — do not delete.\n\n| ID | Type | Summary | Outcome | Resolved |\n| ---- | ---- | ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n| #003 | task | Staging tenancy release evidence outstanding | Ran GitHub Action and validated isolation | 2026-07-21 |\n| #002 | task | Process-ownership fix not yet isolated on `main` | Fixed process isolation using child.pid termination | 2026-07-21 |\n| #008 | rec | Dead href builders in `document-flow-routes.ts` | Not dead code (false positive): `documentReaderHref`/`documentEvidenceHref` are live via the mock wrappers in `src/components/document-search-mockups.tsx` + `src/components/master-document-flow-mockups.tsx` (rendered under `src/app/mockups/document-search/`) and covered by `tests/document-flow-routes.test.ts`; removing breaks the build. Only the production non-mock hrefs are unlinked from prod UI — a wiring gap, not dead code. | 2026-07-22 |\n| #015 | task | Content-first fallback regression tests | Added `tests/registry-record-loader.dom.test.tsx` (8) + `tests/medication-record-page.dom.test.tsx` (6) covering content-first fallback paint, live swap-in, spinner/skeleton, error + not-found/unauthorized states, and the invariant that no authoritative verification badge shows before live governance reconciles (registry fixture-flag neutralization + medication governance-drop-on-error). | 2026-07-22 |\n| #004 | rec | Rescope provider-gated RAG safety ideas | Closed obsolete — rescue source (754-line RAG-safety worktree) unrecoverable/pruned across all refs; answer-quality thresholds + deep-health already shipped on `main` (#585/#587); only cost-cap preflight was genuinely missing and, per session decision, dropped rather than re-filed. | 2026-07-22 |\n","/bin/bash -lc \"rg -n '<<<<<<<|=======|>>>>>>>' docs/outstanding-issues.md; sed -n '1,220p' docs/outstanding-issues.md\"",[817,818],3479,"call_zCMM50iLlSwwoH1UGiYBBMBh","37852",{"_524":823,"_173":820,"_660":824,"_93":825},{"_524":819,"_208":820,"_173":821,"_93":822},"sed -n '1,220p' docs/outstanding-issues.md","outstanding-issues.md","/workspace/Database/docs/outstanding-issues.md","read","rg -n '<<<<<<<|=======|>>>>>>>' docs/outstanding-issues.md","<<<<<<<|=======|>>>>>>>","search",{"_470":827,"_449":450,"_472":456},{"_513":815,"_42":-5,"_477":828,"_516":829,"_93":518},{"_482":456},"Chunk ID: 76fdad\nWall time: 3.3774 seconds\nProcess exited with code 0\nOriginal token count: 23888\nOutput:\nWarning: truncated output (original token count: 23888)\nTotal output lines: 107\n\n30:<<<<<<< HEAD\n62:=======\n92:>>>>>>> origin/main\n# Outstanding Issues, Recommendations & Tasks\n\nDurable, cross-session memory of everything still outstanding for this repo: open **tasks**,\n**recommendations** not yet acted on, and **issues** not yet resolved. Chat context is ephemeral\n(sessions summarise and reset); this file is not — it is the single source of truth the\n[`/issues` skill](../.claude/skills/issues/SKILL.md) reads back and updates.\n\n**Rule of thumb:** if it is worth remembering after this session ends, it belongs here.\n\n## How this is used\n\n- Say `/issues` in Claude Code → the skill reads this file and states the open items back,\n grouped by priority with a one-line summary count. Nothing is mutated on a plain read.\n- `/issues add …`, `/issues done `, `/issues capture`, and friends mutate the tables below.\n The full command surface lives in the skill file.\n- Every mutation keeps this file committed so the memory survives across sessions and worktrees.\n\n## Conventions\n\n- **ID** is a monotonic `#NNN`, never reused. Allocate the next number above the current max\n across _both_ tables (open + resolved).\n- **Pri**: `P1` (do next / blocking), `P2` (should do), `P3` (nice-to-have / revisit-when).\n- **Type**: `task` (a concrete unit of work), `rec` (a recommendation to weigh), or\n `issue` (a defect / risk / gap).\n- **Detail / next action** is the smallest thing that would move the item forward.\n- **Source** points at where it came from: a doc, a PR (`#123`), a file:line, or `session YYYY-MM-DD`.\n- Resolving an item moves its row to **Resolved / archive** with the date and a one-line outcome —\n rows are archived, not deleted, so the history stays auditable.\n\n<<<<<<< HEAD\n\n\n## Open items\n\n| ID | Pri | Type | Summary | Detail / next action | Source | Added |\n| ---- | --- | ----- | ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n| #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 |\n| #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 |\n| #006 | P2 | issue | Globe \"Language & region\" button had no handler | Fixed in this PR to the disabled \"Coming soon\" placeholder convention (`aria-disabled` + sr-only note). Wire to a real language/region settings screen when one exists, then drop the placeholder state. | `src/components/clinical-dashboard/master-search-header.tsx:1829`; session 2026-07-21 | 2026-07-21 |\n| #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 |\n| #009 | P3 | rec | Confirm `/api/jobs` is intentionally server/ops-only | No client `fetch()` reaches `/api/jobs` (only tests import it). Confirm it is a deliberate ops/manual surface; if abandoned, remove it. | `src/app/api/jobs/route.ts` | 2026-07-21 |\n| #010 | P3 | task | Un-built \"Coming soon\" controls across forms/favourites | ~10 disabled placeholders (forms refine/reset, favourites sort/add/new-set, move-to-set, remove-favourite). Correctly flagged (`aria-disabled` + \"Coming soon\"), not defects — wire when the underlying features land. | `forms-search-results-page.tsx`; `favourites-hub.tsx`; `favourites-command-library-page.tsx` | 2026-07-21 |\n| #011 | P3 | task | Auth DB-connection allocation is operator-only | Supabase Auth (GoTrue) is capped at ~10 absolute DB connections (Supabase perf advisor). Switch to **percentage-based** allocation in the Supabase **dashboard** before the first compute scale-up — **not settable via SQL/MCP** (operator-owned). Verify via a staging soak + an approval-gated read-only advisor re-check. | `docs/auth-connection-cap-runbook.md`; `docs/process-hardening.md` (Known follow-up debts) | 2026-07-21 |\n| #012 | P3 | rec | Slim the lazy cross-mode differentials chunk | `cross-mode-differentials.ts` is dynamically imported (correctly code-split **out** of the initial/dashboard bundle — verified), but it pulls the full ~860 KB differentials snapshot (~125 KB gzip lazy chunk) just to build a tiny `{slug,title,clinicalHinge}` + presentations + aliases catalog. A precomputed lightweight index (generator + drift check, like the `specifiers-content` split / medications `fields=index`) would cut that lazy chunk ~5–10×. Not a bundle leak — an M-effort slim. | `src/lib/cross-mode-differentials.ts`; `src/components/clinical-dashboard/cross-mode-links.tsx:150`; session 2026-07-21 (build:analyze) | 2026-07-21 |\n| #013 | P3 | rec | Route-chunk + mockup catalogue JSON weight | `build:analyze`: `/specifiers` ships `specifiers-search-index.json` (~180 KB parsed), `/forms` ships `forms-catalog.json` (~132 KB), `/formulation` ships `formulation-content.json` (~52 KB, client-side local search — needs index/full split or a search endpoint, architectural). All route-scoped (not initial bundle). Also `*-mockups.tsx` (~100 KB across chunks) build though `/mockups` 404s in prod — exclude from the prod artifact. | session 2026-07-21 (build:analyze) | 2026-07-21 |\n| #014 | P3 | rec | Realize the `next/image` win on signed previews | `next.config` `images` (AVIF + `*.supabase.co` `remotePatterns` pinned to the project host, from #1024) is currently inert — signed document/image previews still render as raw ``. Route them through `next/image` to actually get AVIF + lazy optimization. | #1024; `src/components/clinical-dashboard/signed-image.tsx`; session 2026-07-21 | 2026-07-21 |\n| #016 | P3 | rec | \"Big but not easy\" structural + motion perf | Deferred larger levers: (a) nonce-CSP forces every product route to `ƒ Dynamic` (zero static generation) — evaluate Partial Prerendering / static shells for the static clinical catalogues (DSM/differentials/therapy/specifiers/formulation); (b) sidebar expand/collapse animates `grid-template-columns` (biggest smoothness cost, motion-gated — needs a transform-overlay rethink); (c) Therapy Compass fetches 692 KB / 2.5 MB JSON client-side (defer until interaction + confirm brotli); (d) settings/setup/admin dialogs static-imported into the home chunk (`next/dynamic` them). | session 2026-07-21 (build route table + design audit) | 2026-07-21 |\n| #017 | P3 | task | Field Web-Vitals baseline via live Lighthouse | In-sandbox runtime vitals were blocked (prod server hard-requires Supabase secrets; dev-mode CLS measured excellent at 0.00–0.04, content-first pages 0.000). Run Lighthouse against `psychiatry.tools` for real LCP/INP/CLS to prioritize #012–#016 by measured impact rather than reasoning. …13888 tokens truncated… | E-3c design record; runs #59-#61 diagnostics | 2026-07-21 |\n| #022 | P2 | task | Source-governance metadata refresh (operator) | Governance warning rate ~0.84 across canaries: stale/review-required/unknown source metadata on most top results. Operator work (document review-status attestation in the app), not a code defect. Next action: generate the prioritized refresh worklist ($0 read-only) and schedule a metadata pass. | runs #57-#61 Source Governance tables; docs/observability-slos.md | 2026-07-21 |\n| #023 | P3 | task | Read Sunday 2026-07-26 scheduled-run artifacts | The 18:00 UTC scheduled runs deliver three free datapoints at once: first full-44 weekly canary (validates the #1044 ANSWER_CASE_LIMIT raise), browser-matrix flake second datapoint (webkit ui-route-coverage now reproduced + root-caused 2026-07-22 → see #024; firefox ui-formulation:91 still awaits a datapoint), and the irrelevant@10 labeling-audit artifact (§3.1 human-decision class). Read all three, then disposition. | sessions 2026-07-20/21; branch-review-ledger convergence notes | 2026-07-21 |\n| #024 | P3 | issue | WebKit e2e `_rsc`-prefetch access-control-checks errors | verify:release:offline on `main` ce32fe170 (2026-07-22) reproduced #023's webkit clause: **6/6 deterministic** failures in `tests/ui-route-coverage.spec.ts` (Therapy Compass; DSM home/comparison; Specifier comparison/map; Differential stream), each a `pageerror … ?_rsc=… due to access control checks` on Next.js RSC prefetch — Chromium + Firefox clean. Not merge-blocking (required gate `test:e2e:pr` is chromium-only; the full webkit matrix is advisory/release-time). Most likely a Playwright route-interception × WebKit interaction, not a Safari user defect. Next: decide (a) allow/mock the `_rsc` routes for the `webkit` e2e project, or (b) confirm real Safari impact — before trusting the full-matrix webkit gate at release. NB the 2 other webkit fails (`ui-stress:412`, `ui-universal-search:210`) passed on isolated re-run = true flake. | session 2026-07-22 (verify:release:offline, `main` ce32fe170); refines #023 | 2026-07-22 |\n| #025 | P2 | task | Activate the three webhooks (operator secrets) | Merged (#968) + deployed but inert — verified live: `POST /api/webhooks/railway` returns `503 webhook_not_configured`. To turn on: (1) Railway → set `RAILWAY_WEBHOOK_SECRET` + add the `?token=…` webhook URL; (2) the chat URLs `SLACK_WEBHOOK_URL`/`DISCORD_WEBHOOK_URL` must be set in BOTH places — the Railway **app/server env** (the receiver forwards deploy alerts via `postChatNotification`, which reads server env, so repo-secret-only leaves the Railway webhook authenticated but returning `delivered:false`) AND as **GitHub repo secrets** (the CI-failure workflow reads `secrets.*`); (3) `SUPABASE_INGESTION_WEBHOOK_SECRET`. Each fails closed until set, so this is pure ops. See docs/webhooks.md. | session 2026-07-22; PR #968; docs/webhooks.md | 2026-07-22 |\n| #026 | P2 | task | Wire the Supabase document-change trigger | The `/api/webhooks/supabase/document-change` receiver is live but nothing calls it. The trigger (`notify_document_change_ingestion_webhook()` + `documents_ingestion_webhook`, SQL in docs/webhooks.md §3) must land as a **committed migration** — drift covers functions/triggers, so applying raw SQL to live would fail `check:drift`: add the migration, reconcile `supabase/schema.sql`, run `npm run drift:manifest` (needs a local Supabase container), then deploy. Operator-applied live state is the Vault secret (`select vault.create_secret('','ingestion_webhook_secret')`) + the base-URL GUC `app.ingestion_webhook_base_url`, which is MANDATORY per environment (the trigger no-ops when it is unset, so `reindex_requested` flips never enqueue — there is no production default). Trigger is `AFTER UPDATE` on `reindex_requested` only — NOT `INSERT` (an INSERT-fired webhook can beat the upload route's own job insert, which then deletes its just-created doc → intermittent upload failures); external inserts set `reindex_requested=true` to be picked up. Note delivery is at-most-once (pg_net has no retry) and there is NO built-in recovery (automatic or manual) for a dropped insert — neither the autopilot nor `scripts/reindex.ts` sweeps `queued` docs with no job (`hasIncompleteDocumentsWithoutOpenJobs` requires `queuedDocuments === 0`). External imports must insert then issue a SEPARATE UPDATE flipping `reindex_requested=true` (an insert with the flag pre-set won't fire the AFTER UPDATE trigger). The app upload path is NOT a guarantee either: it inserts the `documents` row then the `ingestion_jobs` row as two separate non-atomic calls (rollback only on a job-insert error), so a crash/timeout between them strands the same queued-without-job row nothing sweeps. The only true guarantees are an atomic enqueue (document + job in one transaction/RPC) or a scheduled queued-without-job sweep. Until applied, webhook #5 never fires. | session 2026-07-22; docs/webhooks.md §3 | 2026-07-22 |\n| #027 | P3 | rec | External uptime monitor independent of GitHub/Railway | `live-domain-monitor.yml` runs on GitHub's cron, so it won't run in exactly the outage it should catch (Actions or the deploy itself down). Add an off-platform synthetic monitor (UptimeRobot / Better Stack / Checkly) hitting `/api/health` with a webhook alert. Provider setup, not code. | session 2026-07-22 webhook review | 2026-07-22 |\n| #028 | P3 | rec | Runtime error tracking (Sentry or similar) | No error tracking in the repo — production exceptions on `psychiatry.tools`, including how often `RAG_PROVIDER_MODE=auto` silently degrades to source-only, are invisible. Weigh adding `@sentry/nextjs` (dependency + DSN secret + instrumentation) vs cost; alert → chat/issue. Provider-backed; needs explicit sign-off before adding the dependency. | session 2026-07-22 webhook review | 2026-07-22 |\n>>>>>>> origin/main\n\n## Resolved / archive\n\nMove resolved rows here with the resolution date and a one-line outcome. Keep them — do not delete.\n\n| ID | Type | Summary | Outcome | Resolved |\n| ---- | ---- | ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n| #003 | task | Staging tenancy release evidence outstanding | Ran GitHub Action and validated isolation | 2026-07-21 |\n| #002 | task | Process-ownership fix not yet isolated on `main` | Fixed process isolation using child.pid termination | 2026-07-21 |\n| #008 | rec | Dead href builders in `document-flow-routes.ts` | Not dead code (false positive): `documentReaderHref`/`documentEvidenceHref` are live via the mock wrappers in `src/components/document-search-mockups.tsx` + `src/components/master-document-flow-mockups.tsx` (rendered under `src/app/mockups/document-search/`) and covered by `tests/document-flow-routes.test.ts`; removing breaks the build. Only the production non-mock hrefs are unlinked from prod UI — a wiring gap, not dead code. | 2026-07-22 |\n| #015 | task | Content-first fallback regression tests | Added `tests/registry-record-loader.dom.test.tsx` (8) + `tests/medication-record-page.dom.test.tsx` (6) covering content-first fallback paint, live swap-in, spinner/skeleton, error + not-found/unauthorized states, and the invariant that no authoritative verification badge shows before live governance reconciles (registry fixture-flag neutralization + medication governance-drop-on-error). | 2026-07-22 |\n| #004 | rec | Rescope provider-gated RAG safety ideas | Closed obsolete — rescue source (754-line RAG-safety worktree) unrecoverable/pruned across all refs; answer-quality thresholds + deep-health already shipped on `main` (#585/#587); only cost-cap preflight was genuinely missing and, per session decision, dropped rather than re-filed. | 2026-07-22 |\n",{"_470":831,"_449":450,"_472":456},{"_542":832,"_513":815,"_42":833,"_477":834,"_208":546,"_547":-5,"_93":548},"{\"cmd\":\"rg -n '<<<<<<<|=======|>>>>>>>' docs/outstanding-issues.md; sed -n '1,220p' docs/outstanding-issues.md\",\"workdir\":\"/workspace/Database\",\"max_output_tokens\":30000}","fc_040c0fdc22270fa6016a6066008240819791bef16999c64673",{"_482":456},{"_470":836,"_449":450,"_472":456},{"_473":-5,"_494":837,"_42":838,"_477":839,"_498":840,"_93":500},"gAAAAABqYGYAMyIda7uPla_tUj65qiInjQO_lDIsJ6zlpRhMciKOCw2XRPAzGFBqPUW-68K3RzUrHY1Hh0TJP-JJKLBi-3Y2-Dp4HzWrc7BYUcyZHuBzXc2WpophXwxTKcA3sMgx1xdmVkyWSZ3XqEJWO0409F73T1RRQQI5vD3i9QHxYq4Jve_NVObR28JQk1QEAoDRVp7Yqo7bdnbrg1qsRtrAwCOjTD5Q5jhT5vw3oEFUfu2RNfAu0zGZb-OhNRNTakmXKgQZYPdbx33ZboXO8vOfonWZCLKis9HxdhYgueIdHRM7bVdQw31TxSKUrPfU-vPn7gQzx_gWrtoy-uXmwq5fJTyo6TSzYCD799aKMo6W9N6soupRhQ06wlKr_DrZJCkAV1jjEpW3xvvIm5yTFa_aWwt3SBZSyP_iXwhV77RdLuRqhozaPLaLOGriwZe_c0BzBRpEKRqi9DTkKdvl9E_9nQxLmRnx6N93aEg8IErgSAJ6JdjkhIcOzm1fl5btRQVRiBOkO2eDpmeqot6uToTk92g56pTSPlXy9g9QBX5bdmWnWydcEhLY3Sm1Sqoi4pxLQ_0BdHZSFQYag_O9E0CDwUxMda3CiFK9lB-0wcEd59iwOu2vPY82hznDJZAWEbcKS5Si9xi8G9YrTT48JbNu4-2rSZEDzzVxGJO-z4q-yuhZUBnDW41q1Ia6iSxs2NHhywLX1TTzMZu_3Sm_-56FUcB5wIHysdxWnfW8MDbFpMHBxufcw8GHaYyOQQCk-CPYCBgGg1FSYMJ1uEtKyk-vxOQ4Jbhr4_x-W7EG2jlmVLPj1VDadfnkzW3LA6MD1tZKtbfPXPJ0ibHnh9ns30EQnFQgUsHvf2ghW4LoeE-6fukCUAwsOAZP-EKDIZIA6po_hXdkviY393ZcGhCtqR_3Tq7nY1JcUjZxVALdDABIxKNqEy9qpTUuKJh7_SQDjcWVHDMq","rs_040c0fdc22270fa6016a6065ffcda0819798b7ced59d7da7fe",{"_482":456},[841],{"_46":842,"_93":504},"**Inspecting file for issues**",{"_488":844,"_470":845,"_449":450,"_472":456},1784702464529,{"_473":846,"_42":838,"_498":847,"_93":500},[],[842],{"_470":849,"_449":450,"_472":456},{"_513":850,"_42":-5,"_477":851,"_516":852,"_93":518},"call_aU4dzSGEYBF3TfVFj2uvAtXi",{"_482":456},"Chunk ID: f8ff7b\nWall time: 0.0007 seconds\nProcess exited with code 1\nOriginal token count: 43\nOutput:\nAuto-merging docs/outstanding-issues.md\nCONFLICT (content): Merge conflict in docs/outstanding-issues.md\nAutomatic merge failed; fix conflicts and then commit the result.\n",{"_488":854,"_470":855,"_449":450,"_472":456},1784702461028,{"_522":856,"_524":857,"_526":858,"_528":529,"_454":32,"_531":354,"_42":850,"_532":859,"_534":535,"_463":860,"_93":536},"Auto-merging docs/outstanding-issues.md\nCONFLICT (content): Merge conflict in docs/outstanding-issues.md\nAutomatic merge failed; fix conflicts and then commit the result.\n","/bin/bash -lc 'git merge --no-edit origin/main'",[861],"90198","failed",{"_524":862,"_93":539},"git merge --no-edit origin/main",{"_470":864,"_449":450,"_472":456},{"_542":865,"_513":850,"_42":866,"_477":867,"_208":546,"_547":-5,"_93":548},"{\"cmd\":\"git merge --no-edit origin/main\",\"workdir\":\"/workspace/Database\",\"yield_time_ms\":30000,\"max_output_tokens\":20000}","fc_040c0fdc22270fa6016a6065fbf5d08197813b4b9b12595430",{"_482":456},{"_488":869,"_470":870,"_449":450,"_472":456},1784702456450,{"_522":871,"_524":872,"_526":873,"_528":529,"_454":874,"_531":32,"_42":875,"_532":876,"_534":535,"_463":114,"_93":536},"From https://github.com/BigSimmo/Database\n * [new branch] main -> origin/main\nFrom https://github.com/BigSimmo/Database\n * [new ref] refs/pull/1072/head -> origin/pr-1072\nwork eb2a83c\norigin/main 98a1bed\norigin/pr-1072 eb2a83c\n## work\n","/bin/bash -lc \"git fetch https://github.com/BigSimmo/Database.git main:refs/remotes/origin/main && git fetch https://github.com/BigSimmo/Database.git pull/1072/head:refs/remotes/origin/pr-1072 && git branch -a --format='%(refname:short) %(objectname:short)' | sed -n '1,20p' && git status --short --branch\"",[877],976,"call_36jDfYS7lNl41LZjN4nRVK8m","3372",{"_524":878,"_93":539},"git fetch https://github.com/BigSimmo/Database.git main:refs/remotes/origin/main && git fetch https://github.com/BigSimmo/Database.git pull/1072/head:refs/remotes/origin/pr-1072 && git branch -a --format='%(refname:short) %(objectname:short)' | sed -n '1,20p' && git status --short --branch",{"_470":880,"_449":450,"_472":456},{"_513":875,"_42":-5,"_477":881,"_516":882,"_93":518},{"_482":456},"Chunk ID: c295cd\nWall time: 0.8747 seconds\nProcess exited with code 0\nOriginal token count: 64\nOutput:\nFrom https://github.com/BigSimmo/Database\n * [new branch] main -> origin/main\nFrom https://github.com/BigSimmo/Database\n * [new ref] refs/pull/1072/head -> origin/pr-1072\nwork eb2a83c\norigin/main 98a1bed\norigin/pr-1072 eb2a83c\n## work\n",{"_470":884,"_449":450,"_472":456},{"_542":885,"_513":875,"_42":886,"_477":887,"_208":546,"_547":-5,"_93":548},"{\"cmd\":\"git fetch https://github.com/BigSimmo/Database.git main:refs/remotes/origin/main && git fetch https://github.com/BigSimmo/Database.git pull/1072/head:refs/remotes/origin/pr-1072 && git branch -a --format='%(refname:short) %(objectname:short)' | sed -n '1,20p' && git status --short --branch\",\"workdir\":\"/workspace/Database\",\"yield_time_ms\":30000,\"max_output_tokens\":20000}","fc_040c0fdc22270fa6016a6065f4d6988197b21f4ce54edc6819",{"_482":456},{"_470":889,"_449":450,"_472":456},{"_473":-5,"_494":890,"_42":891,"_477":892,"_498":893,"_93":500},"gAAAAABqYGX00p6-FA0q-4zsmc8_qhinmxNHZyqK9rmKVREitomfgpFb1511gTL9FByOvxoI_L_jss7M4EKWx4lBVNaFb8uiAtFS8uh6Qmri91VVKbFRj6lRiXZ-qNjm2kj5uEWw7fiPcJrYSJ7e-TXJdseV_jE_witwBBJrv8mP-tgPOCCwfBktXirwuJ9fRh7RvIGTDwktW7oG2eyjacAaoy1h1ckVtEbovvZxlHXuPDb9onMov3nqWuxTswO0TiXS7SylVbwNdBNfkDqwKIz3nUP_7G4UeHIQYC8tRwWEgOwLhzvKXw-S2cImvRxYqHQAGsLTZUu5lfXD-8t0HBjpnhMUZ1GNphOjh2g_fmtd5t_AjmaZNGK-19bFZ34OPhTH91jwd0FrTK_2cs2llAy3Ckca5Odp0QjUMKTy0iOSFYFUHxnb9Ugep73LawqoiWNMwrPwLsvjolQJSZQ1dD-flsdEDtPWsDf4eZaTAgfgOrXzbIOBIfKvSDsR8Ah0LI0uebbZemwvtWCUrR5kBHJYpTVpuy9TfWc80W_1Jgw6wefbcrW67Ocf3HmKKqCGOCd9avjdG0VV57qHNjkImeSb4IJAm3qBawlkqGBPjE7yHsja-VDmtnH6o3zV79vQoS7yOHUEFL_iV9-LUTpvIlu1yISOmMB1rAcbMfrnWtsCnEH1WWE2GqmH21N_vnDUG2DeSKHgLYOzQvxCLxBpKqc89nvMX4ric86Poymkc02wD_mnBK5c2eZUE4aesMGApZ5vBZXc54KPDb3Z_ho6ATfq0p-eRzrpS9rE655QgYl__o2rmCksl04WqpzEzIycSpBijaOaZYpvIAsPf5qaFSdTa-kPmarWugVMlJyDWG5yaFaW_UyTFfVcPNF5oeqNsBO-90cMwFkkGLiF-P3FofucYp1TOUaCPEKQBt7R8fkcva_Mxvg_FB2Li_ta2Tvl4vjFnitTlj5tP_nlJye4qz1SB5NStakD7Gi9sv4SIGEHjhFk4qJWnPIwVI7O-4yX25Kz1z1VRXmTYt_mrEpyKTcciB5Eu1A938PoAeeYdsFByUMeNiue9qZxe4CwEmPDDFfiI_ETSu9j5DXcaKZutiN3Ur0vsWbwnhPh6t48JUNxghWr6m_jBWmjvck4vaVlQSI1XIzsk13JCbK7f21hGhb37r5enmMOMWBZZHrAJrwCEpncvtxqtRQ=","rs_040c0fdc22270fa6016a6065f374608197a412d86605318084",{"_482":456},[894],{"_46":895,"_93":504},"**Planning local branch simulation**",{"_488":897,"_470":898,"_449":450,"_472":456},1784702452853,{"_473":899,"_42":891,"_498":900,"_93":500},[],[895],{"_470":902,"_449":450,"_472":456},{"_513":903,"_42":-5,"_477":904,"_516":905,"_93":518},"call_oTJLIXI2n3iwfWKnchR5nGVA",{"_482":456},"Chunk ID: e9fe6c\nWall time: 0.0008 seconds\nProcess exited with code 0\nOriginal token count: 20\nOutput:\nwork eb2a83c \neb2a83c18bf14a6a5722de91cf69fcc235767cf1 refs/heads/work\n## work\n",{"_488":907,"_470":908,"_449":450,"_472":456},1784702449366,{"_522":909,"_524":910,"_526":911,"_528":529,"_454":32,"_531":32,"_42":903,"_532":912,"_534":535,"_463":114,"_93":536},"work eb2a83c \neb2a83c18bf14a6a5722de91cf69fcc235767cf1 refs/heads/work\n## work\n","/bin/bash -lc \"git remote -v; git branch -a --format='%(refname:short) %(objectname:short) %(upstream:short)'; git show-ref | tail -30; git status --short --branch\"",[913],"35859",{"_524":914,"_93":539},"git remote -v; git branch -a --format='%(refname:short) %(objectname:short) %(upstream:short)'; git show-ref | tail -30; git status --short --branch",{"_470":916,"_449":450,"_472":456},{"_542":917,"_513":903,"_42":918,"_477":919,"_208":546,"_547":-5,"_93":548},"{\"cmd\":\"git remote -v; git branch -a --format='%(refname:short) %(objectname:short) %(upstream:short)'; git show-ref | tail -30; git status --short --branch\",\"workdir\":\"/workspace/Database\",\"max_output_tokens\":12000}","fc_040c0fdc22270fa6016a6065f0290881979333054d22bffc62",{"_482":456},{"_470":921,"_449":450,"_472":456},{"_473":-5,"_494":922,"_42":923,"_477":924,"_498":925,"_93":500},"gAAAAABqYGXwolBFETNB574MnGgE9MwVQ15s_ZrOYiLMzoACERwNbkiUvofHlPa0FPhmJ3NAeeeqCg8NszwZngJb_iW-1D-XnH24IGpdOxd-MmIPPnoemVEIixh-RM2ZtosxNQhl7DLuDXUWmQhlDLrN68mzSU4ypqBEv2vT8_z_dVez0Hj2lS-BS5u7_RXnHQ8EhC_szklrDKLw0Q80uUlOSsD-eS3hbhp2pJ3rgWzpPCHjELH-R5XSYEMTd3GZsM_a1QabfPjTHdD9CmdetDnzk8k6eS_OE7DTvEcQoPllsQsqfwVCKrPz7lpnTiEoR1MnG8ioqjKOaziBAeqbq26UaW4ObKEiyGoZJNLR2gOF2ZXGJOcJdc88VPV2Mxn4L3NBpWJsqEKa9RJgIrwsOtc_RfnXOpR4qGyHEB-P0ROgiIsrPtM0eq_NgzmCFBJhv78wXh2mAUTDslcOgZoHcZ0Mej52-4eTY-PlFNcsRN7pa1Ml2_9l0w1JVZaCl2htD_KvmUCV1X5Uw5t-5fg7TM3eXm2ocDsVXMPvn-9NJGkv9XA-vt13IAo-jOIvpeofKUbEW0R-bsGR_nj2YccUSQ_gfGBy6uNSif-Sy2xsx2bw8LBte4yP2LIOOW6nYWT9aDEXaoo7lsoQzrHRUUgCpfH3ZYOmkZMQaGWmmR_Ce_fksRyFkudg5fMSkLIMUSp78OQ9llpRfF4LSuzKcpzlrub1ru__lkh_lEUTzKc0GqU43SLsjFgptVU75fStjMnAjWuLcGt4sWFLsuhJHo4cJzM8eBHMdPQfbwsaXOBkHdBf2Sbj3qQz4-qvlDXoBMJXC1-8no4myrqKu3FB-0srX-zZzF9nMCAhPBkQ3AOsltwrC0e6USdn9d5IuPNevTGkw-i-wNX3Bd52cpxFTeSgyosz8SkA6UCYGYaeKZ_7N_250mRE1nVGMbcsYZ7vCJS4Ls77h0nd0GFTjEU4eItZAvgOHSBYsoXqfB9oqpvf2FwB64THC50b1vQpJ8ss0NnstK73xbNmAIdlKJllzcY4Z3BLxKd_FMYCrA==","rs_040c0fdc22270fa6016a6065ef534c8197896c60aa222b91df",{"_482":456},[926],{"_46":927,"_93":504},"**Evaluating remote output truncation**",{"_488":929,"_470":930,"_449":450,"_472":456},1784702448171,{"_473":931,"_42":923,"_498":932,"_93":500},[],[927],{"_470":934,"_449":450,"_472":456},{"_513":935,"_42":-5,"_477":936,"_516":937,"_93":518},"call_wdKcKtvpcIrfBzXgxomHqTbC",{"_482":456},"Chunk ID: 248104\nWall time: 0.0001 seconds\nProcess exited with code 128\nOriginal token count: 46\nOutput:\nfatal: 'origin' does not appear to be a git repository\nfatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\nand the repository exists.\n",{"_488":939,"_470":940,"_449":450,"_472":456},1784702446200,{"_522":941,"_524":942,"_526":943,"_528":529,"_454":32,"_531":944,"_42":935,"_532":945,"_534":535,"_463":860,"_93":536},"fatal: 'origin' does not appear to be a git repository\nfatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\nand the repository exists.\n","/bin/bash -lc 'git fetch origin main && git status --short --branch && git rev-parse HEAD origin/main && git merge --no-edit origin/main'",[946],128,"13809",{"_524":947,"_93":539},"git fetch origin main && git status --short --branch && git rev-parse HEAD origin/main && git merge --no-edit origin/main",{"_470":949,"_449":450,"_472":456},{"_542":950,"_513":935,"_42":951,"_477":952,"_208":546,"_547":-5,"_93":548},"{\"cmd\":\"git fetch origin main && git status --short --branch && git rev-parse HEAD origin/main && git merge --no-edit origin/main\",\"workdir\":\"/workspace/Database\",\"yield_time_ms\":30000,\"max_output_tokens\":20000}","fc_040c0fdc22270fa6016a6065ed53d4819794932b8ef235e56d",{"_482":456},{"_470":954,"_449":450,"_472":456},{"_473":-5,"_494":955,"_42":956,"_477":957,"_498":958,"_93":500},"gAAAAABqYGXtu0Izdf62VWOs_TpbsnaL3MlsLvv-sy0OYsHY4dTftFUYLdk0Ttq8Ew1IfCxflb0rSzTQTpdP1loAU4c4sbujTn_Bl9O-YZm1o7JaJEhA4i-2VPzoQTgHEByXJ1TgJXI1GXNX7mjhp0g6Bg572ePMLpP04glkn4mY0gcK7uSbzASyrH9fB7o9356eRFPkxfG9fXXVmXfiLX0ZaQIh_-3qOkliomxLEXgK9cDYEQCPbDHvvGvR4MrCrOcRkIr8532bLIw-kURAzPpuXfyXqm_SpT6YZnPJiNSJjvppZu3THDr1owDjO2S4--SMsn2FesvmU4fCzDVjfRIpPgBJpwvOlI0ZOXwhH0L4sx5jljQFn66wFHZMzkuNAa-ViUpGWsfIY-VyhlZHjs7CSePfScWX0I5AHSkF2SfdLygh378NRGOx_vGyiHW4z7NJiNMby1WCYpQpl1YMPWbQaCVZLuzocKIzy_O9F-CkuMAIJpoqeEFQVEMr54gNiGExfWFtK3TUITxdxRb3m8GIQg2MICEBU1PQmTGpEiaaSDhiiLTpvB949Jz_ftnkInSaJUYizB2NZGt_76b8zY7BglWzrMeTlJ-sKRnjyu_-1VtUsgLVIuYnlEq7xfQaZqR9zPaA5oPZfU8NlnGIcYNKGxVA3dgwhxj2iQaJNy1EKzLK3OtxCu2TIpckLz7369Rb8IZmHUXEWKu8t0PqWX2rzgleTZwWSS1X6A5J1kCh8QVlNOsnITBqwcNkOd-6DK-DL6hDgYwb_6E_zDxuWcniWq4yvlVbbYOTomuyYPP4cCr4eqPl1Km1zoOQkSRhwXA-2jPiLitqU1Wqeh09O3e02k2Zik1rgy8EHPpvOsjYSL06q0fdWXbAPgg1W3I-BY_NI4Fl4upLnRgnPrK-IHO7n3N7uZQqX6cqimm0hL4CLZc9ndRkQU7acibeuOWg0-GTEyU2f1xOXI6Z6a7PXyoahN7d_pqwBpPBaVfYJdVvxUMkFe5L76-aVPrAu7NSS_Zvg8tyPxdxVtOJ4ogqX1E7k166DJVnNxPSzD1w4eq265uzqTWYOUKB-c-w5jWkUBZCwFvQDWXLWsAIEHyvTB3WJU6r8Big2U8of-_NCxaJVGpSRYc1ClL3X47O7O3ORkaaWK4grfLd6IwfAo89323zCJVbuGGbUeQ-TBluU9RTUUliC--wrauAOlcXEx3WuqzuELLxPsLaE7GAzQsajJPtv_kBUJ5EWYK5nuDc2ceEx7J1G9cNO07xgzjYpYjtPrbfFkZchTyUcR7vLruuNNTMFvX1IPDbcLA3qPc6gpMEm0y5-nCoxkPWGVaTR4sU4E7MM0ocMnl19rpampgDxxnTREBhuobKqVBLV5A76vJPYuim94TVKCkrTMVwqsjkPGbwvg_tqKmd","rs_040c0fdc22270fa6016a6065eb87248197bedafda26f8179b6",{"_482":456},[959],{"_46":960,"_93":504},"**Planning branch conflict resolution**",{"_488":962,"_470":963,"_449":450,"_472":456},1784702445343,{"_473":964,"_42":956,"_498":965,"_93":500},[],[960],{"_488":967,"_470":968,"_449":450,"_472":456},1784702442286,{"_522":969,"_524":970,"_526":971,"_528":529,"_454":972,"_531":32,"_42":973,"_532":974,"_534":535,"_463":114,"_93":536},"{\n dev: 'node scripts/dev-free-port.mjs',\n preinstall: 'node scripts/check-node-engine.cjs',\n postinstall: 'node scripts/install-git-hooks.mjs',\n 'hooks:install': 'node scripts/install-git-hooks.mjs',\n 'guard:push': 'node scripts/guard-push.mjs',\n 'guard:push:self-test': 'node scripts/guard-push.mjs --self-test',\n 'check:base-freshness': 'node scripts/check-base-freshness.mjs',\n ensure: 'node scripts/ensure-local-server.mjs',\n build: 'node scripts/run-heavy.mjs --npm-script build:internal',\n 'build:internal': 'node scripts/guard-next-build.mjs && node --max-old-space-size=8192 ./node_modules/next/dist/bin/next build --webpack && node scripts/check-client-bundle-secrets.mjs',\n 'build:analyze': 'node scripts/build-analyze.mjs',\n 'check:bundle-budget': 'node scripts/check-bundle-budget.mjs',\n start: 'node scripts/dev-free-port.mjs start',\n lint: 'node scripts/run-heavy.mjs --npm-script lint:internal',\n 'lint:internal': 'node --max-old-space-size=8192 ./node_modules/eslint/bin/eslint.js src tests scripts worker supabase playwright eslint.config.mjs next.config.ts playwright.config.ts playwright.visual.config.ts vitest.config.mts --max-warnings 0 --no-error-on-unmatched-pattern --cache --cache-location node_modules/.cache/eslint/',\n typecheck: 'node scripts/run-heavy.mjs --npm-script typecheck:internal',\n 'typecheck:internal': 'node ./node_modules/typescript/bin/tsc --noEmit',\n test: 'node scripts/run-vitest.mjs run --reporter=dot',\n 'test:focused': 'node scripts/test-focused.mjs',\n 'test:live': 'node scripts/run-live-tests.mjs',\n 'test:coverage': 'node scripts/run-vitest.mjs run --coverage',\n 'test:e2e': 'node scripts/run-playwright.mjs',\n 'test:e2e:all': 'node scripts/run-playwright.mjs',\n 'test:e2e:accessibility': 'node scripts/run-playwright.mjs tests/ui-accessibility.spec.ts --project=chromium',\n 'test:e2e:pwa': 'node scripts/run-playwright.mjs tests/ui-pwa.spec.ts --project=chromium',\n 'test:e2e:critical': 'node scripts/run-playwright.mjs --project=chromium --grep @critical',\n 'test:e2e:regression': 'node scripts/run-playwright.mjs --project=chromium --grep-invert \"@critical|@quarantine|@mockup\"',\n 'test:e2e:pr': 'node scripts/run-playwright.mjs --project=chromium --grep-invert \"@quarantine|@mockup\"',\n 'test:e2e:quarantine': 'node scripts/run-playwright.mjs --project=chromium --grep @quarantine --pass-with-no-tests',\n 'test:e2e:mockups': 'node scripts/run-playwright.mjs --project=chromium-mockups',\n 'test:e2e:advisory': 'node scripts/run-playwright.mjs --project=chromium --project=chromium-mockups --grep \"@quarantine|@mockup\" --pass-with-no-tests',\n 'test:e2e:chromium': 'node scripts/run-playwright.mjs --project=chromium --project=chromium-mockups',\n 'test:e2e:visual': 'node scripts/run-playwright.mjs --config=playwright.visual.config.ts',\n 'test:cross-tenant:staging': 'node scripts/run-tsx.mjs scripts/test-cross-tenant-staging.ts',\n 'verify:cheap': 'node scripts/run-heavy.mjs --npm-script verify:cheap:internal',\n 'verify:cheap:internal': 'npm run check:runtime && npm run check:github-actions && npm run check:ci-scope && npm run check:ci-triage && npm run check:pr-policy && npm run check:gate-manifest && npm run sitemap:check && npm run docs:check-index && npm run check:knip && npm run check:maintainability-budgets && npm run brand:check && npm run check:therapy-data-index && npm run check:type-scale && npm run check:icon-scale && npm run check:design-system-contract && npm run check:function-grants && npm run check:owner-scope && npm run lint && npm run typecheck && npm run test',\n 'verify:pr-local': 'node scripts/verify-pr-local.mjs',\n 'verify:ui': 'npm run check:runtime && npm run test:e2e:pr',\n 'verify:release': 'npm run check:runtime && npm run lint && npm run typecheck && npm run test && npm run build && npm run test:e2e && npm run check:production-readiness && npm run governance:release && npm run eval:quality:release',\n 'verify:release:offline': 'node scripts/verify-release-offline.mjs',\n 'ci:env-check': 'node scripts/check-ci-env.mjs',\n 'check:github-actions': 'node scripts/check-github-action-pins.mjs',\n 'check:client-bundle-secrets': 'node scripts/check-client-bundle-secrets.mjs',\n 'check:knip': 'knip --no-progress --include dependencies,unlisted,unresolved,duplicates',\n 'check:knip:exports': 'knip --no-progress --exports --no-exit-code',\n 'check:maintainability-budgets': 'node scripts/check-maintainability-budgets.mjs',\n 'check:ci-scope': 'node scripts/ci-change-scope.mjs --self-test',\n 'check:ci-triage': 'node scripts/ci-triage.mjs --self-test',\n 'check:gate-manifest': 'node scripts/check-gate-manifest.mjs',\n 'check:pr-policy': 'node scripts/pr-policy.mjs --self-test && node scripts/check-pr-policy-workflow.mjs',\n 'check:env-parity': 'node scripts/check-env-parity.mjs',\n 'sweep:branch-ledger': 'node scripts/sweep-branch-ledger.mjs',\n 'docs:check-links': 'node scripts/check-docs-links.mjs',\n 'docs:check-scripts': 'node scripts/check-docs-script-refs.mjs',\n 'deps:report': 'node scripts/dependency-report.mjs',\n 'docs:check-index': 'node scripts/check-codebase-index-coverage.mjs',\n 'sitemap:update': 'node scripts/run-tsx.mjs scripts/generate-site-map.ts',\n 'sitemap:check': 'node scripts/run-tsx.mjs scripts/generate-site-map.ts --check',\n 'brand:update': 'node scripts/run-tsx.mjs scripts/generate-brand-assets.ts',\n 'brand:check': 'node scripts/run-tsx.mjs scripts/generate-brand-assets.ts --check',\n 'check:therapy-data-index': 'node scripts/build-therapies-index.mjs --check',\n 'check:runtime': 'node scripts/run-tsx.mjs scripts/check-runtime.ts',\n 'check:codex-autofix-workflow': 'node scripts/check-codex-autofix-workflow.mjs',\n 'check:deployment-readiness': 'node scripts/deployment-boot-smoke.mjs',\n 'check:edge:functions': 'node scripts/check-edge-functions.mjs',\n 'check:production-readiness': 'node scripts/run-tsx.mjs scripts/production-readiness.ts',\n 'check:production-readiness:ci': 'node scripts/run-tsx.mjs scripts/production-readiness.ts --ci',\n format: 'prettier --write .',\n 'format:check': 'prettier --check .',\n 'format:changed': 'node scripts/check-format-changed.mjs',\n worker: 'node scripts/run-tsx.mjs worker/index.ts',\n 'worker:once': 'node scripts/run-tsx.mjs worker/index.ts --once',\n 'build:worker': 'node scripts/build-worker.mjs',\n 'import:docs': 'node scripts/run-tsx.mjs scripts/import-documents.ts',\n 'import:docs:20': 'node scripts/run-tsx.mjs scripts/import-documents.ts --queue-batch-size 20',\n 'measure:wrapped-dose-units': 'node scripts/run-tsx.mjs scripts/measure-wrapped-dose-prevalence.ts',\n 'enrich:documents': 'node scripts/run-tsx.mjs scripts/enrich-documents.ts',\n 'enrich:backfill': 'node scripts/run-tsx.mjs scripts/backfill-enrichment.ts',\n 'classify:documents': 'node scripts/run-tsx.mjs scripts/classify-documents.ts',\n 'audit:source-governance': 'node scripts/run-tsx.mjs scripts/audit-source-governance.ts',\n 'audit:source-governance:release': 'npm run audit:source-governance -- --debt-policy docs/release-source-metadata-debt-2026-06-30.json',\n 'governance:release': 'npm run check:document-label-coverage && npm run check:document-label-governance && npm run audit:source-governance:release',\n 'check:document-label-coverage': 'node scripts/run-tsx.mjs scripts/check-document-label-coverage.ts',\n 'check:document-label-governance': 'node scripts/run-tsx.mjs scripts/check-document-label-governance.ts',\n 'check:retrieval-owner-migration': 'node scripts/run-tsx.mjs scripts/check-retrieval-owner-migration.ts',\n 'check:m13-migration': 'node scripts/run-tsx.mjs scripts/archive/check-m13-migration.ts',\n 'check:july8-live-batch': 'node scripts/run-tsx.mjs scripts/archive/check-july8-live-batch.ts',\n 'backfill:gold-labels': 'node scripts/run-tsx.mjs scripts/backfill-gold-document-labels.ts',\n 'backfill:smart-v2-labels': 'npm run classify:documents -- --all-owners --limit 5000 --only-missing-smart-v2',\n 'tags:backfill': 'node scripts/run-tsx.mjs scripts/backfill-document-tags.ts',\n 'index:backfill': 'node scripts/run-tsx.mjs scripts/backfill-smart-index.ts',\n 'visual:backfill': 'node scripts/run-tsx.mjs scripts/backfill-visual-intelligence.ts',\n 'backfill:text-normalization': 'node scripts/run-tsx.mjs scripts/backfill-text-normalization.ts',\n 'backfill:source-metadata': 'node scripts/run-tsx.mjs scripts/backfill-source-metadata.ts',\n 'backfill:unknown-status': 'node scripts/run-tsx.mjs scripts/derive-unknown-status.ts',\n 'check:supabase-project': 'node scripts/run-tsx.mjs scripts/check-supabase-project.ts',\n 'auth:set-administrator': 'node scripts/run-tsx.mjs scripts/set-site-administrator.ts',\n 'check:indexing': 'node scripts/run-tsx.mjs scripts/check-indexing.ts',\n 'check:type-scale': 'node scripts/check-type-scale.mjs --strict',\n 'check:icon-scale': 'node scripts/check-icon-scale.mjs --strict',\n 'check:design-system-contract': 'node scripts/check-design-system-contract.mjs',\n 'check:function-grants': 'node scripts/check-function-grants.mjs',\n 'check:owner-scope': 'node scripts/check-owner-scope-api.mjs',\n 'recover:ingestion': 'node scripts/run-tsx.mjs scripts/recover-ingestion-queue.ts',\n 'registry:seed': 'node scripts/run-tsx.mjs scripts/seed-registry-records.ts',\n 'registry:embed': 'node scripts/run-tsx.mjs scripts/embed-registry-records.ts',\n 'registry:reconcile-governance': 'node scripts/run-tsx.mjs scripts/reconcile-registry-governance.ts',\n 'services:import': 'node scripts/run-tsx.mjs scripts/import-services-export.ts',\n 'differentials:import': 'node scripts/run-tsx.mjs scripts/import-differentials-export.ts',\n 'differentials:seed': 'node scripts/run-tsx.mjs scripts/seed-differential-records.ts',\n 'medications:import': 'node scripts/run-tsx.mjs scripts/import-medications-export.ts',\n 'medications:seed': 'node scripts/run-tsx.mjs scripts/seed-medication-records.ts',\n reindex: 'node scripts/run-tsx.mjs scripts/reindex.ts',\n 'reindex:health': 'node scripts/run-tsx.mjs scripts/reindex-health.ts',\n 'ingestion:autopilot': 'node scripts/run-tsx.mjs scripts/ingestion-autopilot.ts',\n 'flake:ledger': 'node scripts/flake-ledger.mjs',\n 'check:rag:fixtures': 'node scripts/check-rag-fixtures.mjs',\n 'reindex:cleanup-staged': 'node scripts/run-tsx.mjs scripts/cleanup-abandoned-reindex-generations.ts',\n 'images:re-stamp-generation': 'node scripts/run-tsx.mjs scripts/reindex-image-generation-metadata.ts',\n 'supabase:recovery-status': 'node scripts/run-tsx.mjs scripts/supabase-recovery-status.ts',\n 'promote:query-misses': 'node scripts/run-tsx.mjs scripts/promote-query-misses.ts',\n 'promote:public-documents': 'node scripts/run-tsx.mjs scripts/promote-public-documents-batch.ts',\n 'promote:public-documents:batch': 'node scripts/run-tsx.mjs scripts/promote-public-documents-batch.ts',\n 'audit:public-document-approvals': 'node scripts/run-tsx.mjs scripts/audit-public-document-approvals.ts',\n 'check:default-acl': 'node scripts/run-tsx.mjs scripts/check-default-acl.ts',\n 'eval:rag': 'node scripts/run-eval-safe.mjs scripts/eval-rag.ts',\n 'eval:rag:offline': 'node scripts/eval-rag-offline.mjs',\n 'eval:answer-quality': 'node scripts/run-eval-safe.mjs scripts/eval-answer-quality.ts',\n 'eval:quality': 'node scripts/run-eval-safe.mjs scripts/eval-quality.ts',\n 'eval:quality:release': 'npm run eval:quality -- --fail-on-threshold --source-metadata-debt docs/release-source-metadata-debt-2026-06-30.json',\n 'eval:quality:release:offline': 'npm run eval:quality -- --provider-mode offline --fail-on-threshold --source-metadata-debt docs/release-source-metadata-debt-2026-06-30.json',\n 'eval:retrieval': 'node scripts/run-eval-safe.mjs scripts/eval-retrieval.ts',\n 'eval:retrieval:quality': 'node scripts/run-eval-safe.mjs scripts/eval-retrieval.ts --mode quality',\n 'eval:retrieval:index-unit-vector': 'node scripts/run-eval-safe.mjs scripts/eval-retrieval.ts --mode quality --force-embedding --json-out artifacts/retrieval/index-unit-vector.json',\n 'eval:retrieval:compare': 'node scripts/run-tsx.mjs scripts/compare-retrieval-eval.ts',\n 'eval:retrieval:latency': 'node scripts/run-eval-safe.mjs scripts/eval-retrieval.ts --mode latency --case-timeout-ms 25000 --p90-ms 20000',\n 'eval:assertions': 'node scripts/run-tsx.mjs scripts/eval-assertions.ts',\n 'eval:search': 'node scripts/run-tsx.mjs scripts/eval-search.ts',\n 'eval:search:api': 'node scripts/run-tsx.mjs scripts/eval-search-api.ts',\n 'retrieval:health': 'node scripts/run-tsx.mjs scripts/retrieval-health.ts',\n 'profile:retrieval': 'node scripts/run-tsx.mjs scripts/profile-retrieval-rpcs.ts',\n 'warm:retrieval': 'node scripts/run-tsx.mjs scripts/warm-retrieval-cache.ts',\n 'tune:search-weights': 'node scripts/run-tsx.mjs scripts/tune-search-weights.ts',\n 'build:ranking-snapshot': 'node scripts/run-tsx.mjs scripts/build-ranking-snapshot.ts',\n 'eval:trend': 'node scripts/eval-trend.mjs',\n 'cleanup:storage': 'node scripts/run-tsx.mjs scripts/cleanup-storage.ts',\n 'purge:query-logs': 'node scripts/run-tsx.mjs scripts/purge-query-logs.ts',\n 'audit:tables': 'node scripts/run-tsx.mjs scripts/audit-tables.ts',\n samples: 'node scripts/run-tsx.mjs scripts/generate-sample-documents.ts',\n 'samples:check': 'node scripts/run-tsx.mjs scripts/check-sample-extraction.ts',\n 'workflow:run': 'node scripts/external-workflow.mjs run',\n 'workflow:status': 'node scripts/external-workflow.mjs status',\n 'workflow:verify': 'node scripts/external-workflow.mjs verify',\n 'workflow:deps': 'node scripts/external-workflow.mjs deps',\n 'workflow:clean-state': 'node scripts/external-workflow.mjs clean-state',\n 'workflow:export': 'node scripts/external-workflow.mjs export',\n 'workflow:handoff': 'node scripts/external-workflow.mjs handoff',\n 'workflow:flightplan': 'node scripts/productivity-workflow.mjs flightplan',\n 'workflow:triage': 'node scripts/productivity-workflow.mjs triage',\n 'workflow:clinical-proof': 'node scripts/productivity-workflow.mjs clinical-proof',\n 'workflow:design-sweep': 'node scripts/productivity-workflow.mjs design-sweep',\n 'workflow:rag-lab': 'node scripts/productivity-workflow.mjs rag-lab',\n 'workflow:operator-closeout': 'node scripts/productivity-workflow.mjs operator-closeout',\n 'workflow:lifecycle': 'node scripts/productivity-workflow.mjs lifecycle',\n skills: 'node scripts/list-database-skills.mjs',\n 'check:skills': 'node scripts/list-database-skills.mjs --check',\n 'check:drift': 'node scripts/run-tsx.mjs scripts/check-drift.ts',\n 'check:migration-history': 'node scripts/run-tsx.mjs scripts/check-migration-history-alignment.ts',\n 'drift:manifest': 'node scripts/run-tsx.mjs scripts/generate-drift-manifest.ts'\n}\n","/bin/bash -lc \"printf '---AGENTS root---\\\\n'; cat AGENTS.md; printf '\\\\n---git---\\\\n'; git status --short --branch; git branch --show-current; git remote -v; git log --oneline -5; git worktree list; printf '\\\\n---scripts---\\\\n'; node -e \\\"const p=require('./package.json'); console.log(p.scripts)\\\"\"",[975],238,"call_aDkV4HGhizaJLoWHzMOVZom5","58637",{"_524":976,"_93":539},"printf '---AGENTS root---\\n'; cat AGENTS.md; printf '\\n---git---\\n'; git status --short --branch; git branch --show-current; git remote -v; git log --oneline -5; git worktree list; printf '\\n---scripts---\\n'; node -e \"const p=require('./package.json'); console.log(p.scripts)\"",{"_470":978,"_449":450,"_472":456},{"_513":973,"_42":-5,"_477":979,"_516":980,"_93":518},{"_482":456},"Chunk ID: 62bfc8\nWall time: 0.1371 seconds\nProcess exited with code 0\nOriginal token count: 15649\nOutput:\nWarning: truncated output (original token count: 15649)\nTotal output lines: 758\n\n/bin/bash: line 1: printf: --: invalid option\nprintf: usage: printf [-v var] format [arguments]\n\n\n# This is NOT the Next.js you know\n\nThis version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` before writing any code. Heed deprecation notices.\n\n\n\n\n\n## Dependency shortcut\n\nWhen the user types exactly `dependency` as the entire task message, after trimming surrounding whitespace, treat it as a shortcut for safe dependency maintenance. This is a Codex chat shortcut, not an app feature, script, automation, or CI workflow.\n\nGoal:\nUpdate direct project dependencies to the newest stable compatible versions, regenerate the existing lockfile, identify source/config/test code that relies on old dependency behavior, make the smallest safe compatibility changes, and verify the result. Do not rewrite the project, switch package managers, discard user work, commit, push, deploy, or run destructive cleanup without explicit confirmation.\n\nStart with read-only inspection:\n\n- Check branch, upstream, worktrees, recent relevant history, and `git status`.\n- If on `main`, `master`, `develop`, `release/*`, or another protected/base branch, create/switch to `codex/dependency-maintenance` before editing, if safe.\n- Inspect manifests, lockfiles, package-manager config, runtime/toolchain files, workspace layout, CI config, scripts, and documented checks.\n- Detect repo-local install/dev/test/build/watch/server processes that could race dependency updates.\n- Preserve all existing staged, unstaged, and untracked user work.\n\nPackage-manager rules:\n\n- Use the package manager already used by the repo: npm, pnpm, yarn, bun, pip, poetry, uv, cargo, go, bundler, gradle, maven, dotnet, or equivalent.\n- Do not switch package managers or create a new lockfile type.\n- Respect engines, runtime versions, lockfiles, workspaces, wrappers, and repo conventions.\n- In monorepos or polyglot repos, update each ecosystem through its native workspace-aware workflow.\n\nDependency update rules:\n\n- Identify outdated direct production and development dependencies.\n- Compare both manifest ranges and locked/installed versions against latest stable compatible releases.\n- Treat “outdated packages found” exit codes as normal where applicable.\n- Avoid prerelease, alpha, beta, canary, rc, next, nightly, and experimental versions unless the stable channel points there and explain why.\n- Do not use force or legacy flags that bypass peer, engine, resolver, or lockfile integrity checks unless explicitly approved.\n- Do not run forced audit fixes or broad destructive codemods.\n- If latest is incompatible, use the newest compatible version and document why.\n- Group risky updates coherently, such as framework plus plugins, test runner plus coverage, lint core plus plugins, or runtime plus adapter packages.\n\nCompatibility audit:\n\n- For every major update and every core framework/runtime/build/test/lint/UI/database update, inspect release notes, migration guides, peer ranges, engines, and changelogs when available.\n- Search source, tests, scripts, config, and CI for imports, APIs, CLI flags, config keys, environment variables, plugin names, generated types, or file paths tied to changed dependencies.\n- If old dependency behavior is used, make the smallest safe migration that preserves behavior.\n- If migration is large, risky, architectural, or product-affecting, stop after discovery and provide a concrete fix plan with affected files, package versions, sequence, and verification commands.\n- Add or adjust focused tests only when needed to prove migrated behavior.\n\nGenerated and sensitive files:\n\n- Do not intentionally keep dependency directories, build outputs, caches, logs, local state, test artifacts, browser artifacts, `.env*`, secrets, keys, tokens, credentials, or machine-local config.\n- Manifest and existing lockfile changes are allowed.\n\nVerification:\n\n- Run a cheap baseline first when useful to distinguish pre-existing failures.\n- After updates, run install/dependency validation, then relevant lint, type check, tests, build, smoke/UI/a11y, codegen, integration checks, or equivalent.\n- For frontend/browser-facing changes, run browser/UI verification when framework, bundler, router, styling, test runner, or browser automation changed.\n- If a check fails, fix dependency-related breakage and rerun the smallest failing check before broader checks.\n- Run non-mutating audit/vulnerability checks when available.\n- Confirm no repo-owned dev server, watcher, or temporary process was left running unless requested.\n\nFinal response for `dependency` must include:\n\n- Branch and worktree state.\n- Package manager, runtime, manifests, and lockfiles detected.\n- Outdated dependencies found.\n- Dependencies updated, old version -> new version.\n- Dependencies not updated and why.\n- Files changed.\n- Compatibility migrations and old APIs found/fixed.\n- Checks run and results.\n- Checks not run and why.\n- Audit/vulnerability summary.\n- Generated/untracked files left behind.\n- Branch movement, external repo changes, or process cleanup observed.\n- Risks or follow-up work.\n- Confirmation that no commit or push was made unless explicitly requested.\n\nAfter setup:\n\n- Verify root `AGENTS.md` contains exactly one `## Dependency shortcut` section.\n- Show the final diff for `AGENTS.md`.\n- Summarize what changed.\n- Confirm no dependency update, install, test, build, audit, commit, or push was performed.\n\n\n\n\n\n## Bug-hunter shortcut\n\nWhen the user types exactly `bug-hunter` as the entire task message, after trimming surrounding whitespace, treat it as a shortcut for targeted defect discovery.\n\nExecution rules:\n\n- Invoke the `bug-hunter` skill first.\n- Prioritize reproducible defects over code style, naming, or formatting feedback.\n- Trace realistic failure paths: invalid input, empty states, retries, race/concurrency issues, stale state/cache, network/auth failures, permissions, and boundary values.\n- For each finding, include trigger, expected behavior, actual risk, and the smallest proof (or targeted test/check) that would catch it.\n- If no high-confidence defect is found, explicitly state that and list the most likely residual risk area.\n\nScope and safety:\n\n- Keep the hunt scoped to code touched by the user request unless the defect clearly crosses module boundaries.\n- Do not make broad refactors while hunting; propose minimal fixes for confirmed issues.\n- Run the smallest focused verification for each confirmed defect, then expand only if needed.\n\n\n\n\n\n## Codex review throttling and routing\n\nDo not review branches opportunistically. Review the current changed diff, PR, or branch only when the user explicitly asks for review/audit/hunter/cleanup/upload work, when CI/check failures are the task, or when the current change touches high-risk areas that require a targeted review before handoff.\n\nUse `docs/codex-review-protocol.md` as the shared review protocol for every repo-local review skill, branch/PR review, audit, bug hunt, release-readiness check, and PR/CI review.\n\nBefore reviewing a branch or PR:\n\n- Check `docs/branch-review-ledger.md` if it exists.\n- Resolve the target with `git rev-parse `.\n- If the same branch/ref and HEAD SHA were already reviewed for the same scope, summarize the prior ledger outcome and skip the repeat review unless the user explicitly requests a fresh pass.\n- If the target HEAD changed, review only the changed scope and update the ledger after the review.\n\nBefore reviewing multiple branches:\n\n- Build a short branch inventory first: branch, upstream, ahead/behind, last commit, and merged status.\n- Skip branches already merged into `main`.\n- Skip unchanged branches already recorded in `docs/branch-review-ledger.md`.\n- Do not re-review every branch after ordinary coding tasks.\n- If a repeated request targets unchanged reviewed branches, summarize the prior result and ask before doing another full pass.\n\nReview routing:\n\n- `diff-review`: Use for explicit review of the current diff, PR, or named branch. Findings first, ordered by severity, with file/line evidence.\n- `bug-hunter`: Use only for the exact `bug-hunter` shortcut or an explicit defect-hunt request. Prioritize reproducible bugs and smallest proof.\n- `repo-auditor`: Use for explicit repo-wide audit/refactor/dead-code/import/dependency-structure requests. Treat outputs as triage, not automatic delete lists.\n- `release-readiness`: Use for explicit release, merge, PR readiness, or handoff confidence requests. Do not run provider-backed gates without confirmation.\n- `branch-cleanup`: Use only when the prompt explicitly asks for branch cleanup/hygiene or branch deletion candidates. Apply `docs/branch-cleanup-guide.md` and the review ledger before inspecting branch diffs.\n- `pr-ci-fix`: Confirmation-required for this repo. GitHub/GitLab API calls, PR comments, CI reruns, commits, and pushes require explicit user approval and must respect the upload/handoff rules. Exception: an explicit `Run PR` sweep carries this approval (see \"## Run PR shortcut\").\n\nWhen a branch or PR review completes, record the reviewed branch/ref, HEAD SHA, date, scope, outcome, and checks in `docs/branch-review-ledger.md`.\n\n\n\n\n\n# Local server safety\n\n- If the user says `run`, execute `npm run ensure` and return the printed URL.\n- If the user asks for UI/frontend changes, browser QA, screenshots, mobile checks, or a local app link, run `npm run ensure` before opening or testing the app, even if the user did not say `run`.\n- Never assume `localhost:3000`, `localhost:3001`, or `localhost:3002`.\n- Never attach to a local server unless `/api/local-project-id` confirms it is this project.\n- Do not kill or modify other projects' local servers. If the stable project port is busy, let `npm run ensure` choose the next safe project URL.\n- Do not run a permanent watcher. Only start or verify the server when the current chat task needs the app or the user asks to run it.\n\n\n\n\n\n# Process hardening phases\n\n- For non-trivial source/config/test changes, prefer `npm run verify:cheap` as the first broad gate and `npm run verify:pr-local` before PR handoff when the change is ready. The PR-local gate runs the full unit suite once, then conditionally adds the production build/client-bundle scan and RAG fixture/manifest validation. Browser, dependency-audit, Docker/Supabase replay, and provider-backed checks remain separate gates. Use `npm run verify:pr-local -- --dry-run --files ` to inspect selection without running commands. The broader `--extended` plan is dry-run only unless explicit approval is reflected by `ALLOW_EXTENDED_PR_LOCAL=true`.\n- Run one heavy Database command at a time across all worktrees. Do not install while a repository test, build, lint, typecheck, or server command is active. Avoid aggressive short-interval polling, and do not repeat an unchanged full gate after it passes.\n- For UI, frontend, browser, routing, styling, reduced-motion, or forced-colors changes, run `npm run ensure` before browser work and use `npm run verify:ui` as the Chromium UI gate.\n- For release or handoff confidence, use `npm run verify:release`; this includes the full Playwright project set.\n- For clinical ingestion, answer generation, source governance, privacy, production-readiness, or environment changes, run the smallest relevant domain check plus `npm run check:production-readiness`.\n- For pull requests that touch ingestion, answer generation, search/ranking, source rendering, document access, privacy, production env, or clinical output, complete the clinical governance preflight in `.github/pull_request_template.md`.\n- Track known verification debts and staged process improvements in `docs/process-hardening.md` instead of relying on chat-only memory.\n\n\n\n\n\n# Page and button wiring\n\nInteractive controls and routes follow conventions the codebase already holds to. Before adding\nor moving a button, link, or route, read `docs/wiring-conventions.md`. A control that advertises an\naction must perform one; a page that ships must be reachable.\n\n- **Buttons.** Every interactive `