[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_2220":2221,"_2222":59,"_2223":15,"_2224":15,"_2225":15,"_2226":15,"_2227":15,"_2228":15,"_2229":2230},"routes/s.$postId",{"_9":10,"_11":12,"_13":-7,"_14":15,"_16":15,"_17":-5,"_18":19},"kind","post_with_profile","postWithProfile",{"_20":21,"_22":23},"referrer","preferIntrinsicAspectRatioForOgImage",false,"enforceRenderedOgImg","ogImageVariantOverride","defaultOgDescription","ChatGPT helps you get answers, find inspiration, and be more productive.","post",{"_42":43,"_44":45,"_46":-5,"_47":-5,"_48":-5,"_49":-5,"_50":51,"_52":53,"_35":54,"_55":56,"_57":15},"profile",{"_24":25,"_26":25,"_27":28,"_29":-5,"_30":-5,"_31":32,"_33":15,"_34":-5,"_35":-5,"_36":-5,"_37":15,"_38":-5,"_39":-5,"_40":-5,"_41":15},"user_id","anonymous","username","profile_picture_url","https://cdn.openai.com/sora/images/profile_placeholder_v4.png","profile_picture_id","is_default_profile_picture","follower_count",0,"is_following","display_name","permalink","can_cameo","verified","character_count","owner_profile","social_context","follows_you","id","cd_6a6086e550c48191a5646ab69e7ea0c3","posted_at",1784710885.315645,"text","og_title","og_description","og_image_variant","attachments",[65],"preview_image_url","https://ogimg.chatgpt.com/?postId=cd_6a6086e550c48191a5646ab69e7ea0c3","https://chatgpt.com/s/cd_6a6086e550c48191a5646ab69e7ea0c3","permissions",{"_58":59,"_60":15,"_61":15,"_62":59,"_63":64},"use_experimental_unfurl","can_read",true,"can_write","can_delete","can_remix","share_setting","public",{"_42":66,"_67":68,"_9":69,"_70":71,"_72":73,"_74":75,"_76":77,"_78":79,"_80":-5},"cd_6a6086e550c48191a5646ab69e7ea0c3-attachment-0","tags",[],"codex","task",{"_42":2180,"_120":2181,"_333":2182,"_2183":59,"_83":84,"_2184":15,"_2185":2186,"_296":15,"_2187":2188,"_2189":-5,"_2190":2191},"current_user_turn",{"_93":346,"_42":85,"_97":346,"_1180":2160,"_1182":2161,"_1184":1185,"_133":-5,"_120":1186},"current_assistant_turn",{"_93":94,"_42":84,"_95":-5,"_96":-5,"_97":94,"_98":1702,"_100":1703,"_102":103,"_104":-5,"_105":1704,"_107":1705,"_109":1706,"_111":1707,"_113":114,"_115":-5,"_116":117,"_118":1708,"_120":121,"_122":-5,"_123":124,"_125":1709,"_127":128,"_129":130,"_131":-5,"_132":-5,"_133":85,"_134":1710,"_136":1711,"_138":-5,"_139":15,"_140":141,"_142":-5},"current_diff_task_turn",{"_93":94,"_42":84,"_95":-5,"_96":-5,"_97":94,"_98":1244,"_100":1245,"_102":103,"_104":-5,"_105":1246,"_107":1247,"_109":1248,"_111":1249,"_113":114,"_115":-5,"_116":117,"_118":1250,"_120":121,"_122":-5,"_123":124,"_125":1251,"_127":128,"_129":130,"_131":-5,"_132":-5,"_133":85,"_134":1252,"_136":1253,"_138":-5,"_139":15,"_140":141,"_142":-5},"turns",{"_81":82,"_83":84},"example_task_info","turn_mapping",{"_85":86,"_84":87},"current_turn_id","task_e_6a6086e371f48322bb1a5826fac9b9bb~assttrn_e_6a6086e4b59c83228db4d075e3c3cd0e","task_e_6a6086e371f48322bb1a5826fac9b9bb~usertrn_e_6a6086e48eac83229defbb3c4fce40e4",{"_42":85,"_88":1178,"_90":1179,"_92":-5},{"_42":84,"_88":89,"_90":91,"_92":85},"turn",{"_93":94,"_42":84,"_95":-5,"_96":-5,"_97":94,"_98":99,"_100":101,"_102":103,"_104":-5,"_105":106,"_107":108,"_109":110,"_111":112,"_113":114,"_115":-5,"_116":117,"_118":119,"_120":121,"_122":-5,"_123":124,"_125":126,"_127":128,"_129":130,"_131":-5,"_132":-5,"_133":85,"_134":135,"_136":137,"_138":-5,"_139":15,"_140":141,"_142":-5},"children",[],"parent","type","assistant","sibling_turn_ids","attempt_placement","role","output_items",[1057,1058,1059],"child_turns",[],"conversation_id","None","error","latest_event",{"_1052":1053,"_46":1054,"_1055":1056},"worklog",{"_1026":1027},"app_server_events",{"_356":1025},"thread_events",{"_356":357},"turn_status","completed","cancellation_requested_at","pull_request_status","externally_created","pull_request_data",{"_325":326,"_316":327,"_328":329,"_330":15,"_331":59,"_332":15,"_333":334,"_335":336,"_337":288,"_338":128,"_339":340,"_341":130,"_342":343,"_344":-5,"_345":-5,"_346":347,"_348":349,"_350":351,"_352":353,"_354":351},"created_at",1784710884.709523,"internal_only_rollouts","environment_id","6a4f4a07a864819196abaa21176f9e31","environment",{"_42":124,"_214":215,"_216":217,"_218":15,"_219":220,"_221":222,"_223":224,"_225":-5,"_226":-5,"_227":15,"_228":229,"_230":231,"_232":231,"_233":234,"_235":236,"_237":238,"_239":-5,"_240":241,"_242":243,"_244":245,"_246":247,"_55":-5,"_120":248,"_249":250,"_251":252,"_253":254,"_255":15,"_256":15},"branch","claude/capture-governance-audit-deferrals","base_commit_sha","21c1b72e800a25461f8182ce64c89685c8299269","branch_name","direct_push_pushed_commit_sha","previous_turn_id","logs",{"_134":194},"proxy_events",[143,144,145,146,147,148,149,150,151,152,153,154,155,156],"debug_metadata","discarded","model_version","gpt-5.5","languages",{"_157":193,"_159":160,"_161":162,"_163":172,"_165":173,"_167":168,"_169":32,"_170":-5},{"_157":189,"_159":190,"_161":191,"_163":172,"_165":192,"_167":168,"_169":32,"_170":-5},{"_157":188,"_159":160,"_161":162,"_163":164,"_165":166,"_167":168,"_169":32,"_170":-5},{"_157":186,"_159":160,"_161":162,"_163":175,"_165":166,"_167":168,"_169":187,"_170":-5},{"_157":185,"_159":160,"_161":162,"_163":172,"_165":173,"_167":168,"_169":32,"_170":-5},{"_157":184,"_159":160,"_161":162,"_163":164,"_165":166,"_167":168,"_169":32,"_170":-5},{"_157":182,"_159":160,"_161":162,"_163":175,"_165":166,"_167":168,"_169":183,"_170":-5},{"_157":181,"_159":160,"_161":162,"_163":172,"_165":180,"_167":168,"_169":32,"_170":-5},{"_157":179,"_159":160,"_161":162,"_163":164,"_165":180,"_167":168,"_169":32,"_170":-5},{"_157":178,"_159":160,"_161":162,"_163":172,"_165":173,"_167":168,"_169":32,"_170":-5},{"_157":177,"_159":160,"_161":162,"_163":164,"_165":166,"_167":168,"_169":32,"_170":-5},{"_157":174,"_159":160,"_161":162,"_163":175,"_165":166,"_167":168,"_169":176,"_170":-5},{"_157":171,"_159":160,"_161":162,"_163":172,"_165":173,"_167":168,"_169":32,"_170":-5},{"_157":158,"_159":160,"_161":162,"_163":164,"_165":166,"_167":168,"_169":32,"_170":-5},"timestamp","2026-07-22T09:02:53.756733","decision","allow","reason","checks passed","method","GET","domain","github.com","protocol","HTTP/1.1","size","path","2026-07-22T09:02:53.673807","CONNECT","github.com:443","2026-07-22T09:02:02.117991","POST",704,"2026-07-22T09:02:02.042793","2026-07-22T09:02:01.938234","2026-07-22T09:01:36.417293","chatgpt.com:18080","2026-07-22T09:01:36.349013","2026-07-22T09:01:34.700768",179,"2026-07-22T09:01:34.571590","2026-07-22T09:01:34.450142","2026-07-22T09:01:34.052223",102,"2026-07-22T09:01:33.861472","2026-07-22T09:01:33.780139","block","domain is not in allowlist","chatgpt.com:443","2026-07-22T09:01:33.732373",[195,196,197],{"_198":210,"_200":211},{"_198":206,"_200":207},{"_198":199,"_200":201},"key",{"_202":203,"_93":204,"_120":205},"value","file_00000000eebc81f792b3537a69273fcd","name","warm_up_git_repo_1784710889","UserSetupScript","2026-07-22T09:01:29.191559",{"_202":208,"_93":204,"_120":209},"file_00000000fb0481f790cfa2f77258fc42","auto_setup","2026-07-22T08:22:13.764488",{"_202":212,"_93":204,"_120":213},"file_00000000220881f78bd885585f275454","setup_autodetect","2026-07-22T08:22:01.158894","machine_id","wham-public/wham-universal","label","BigSimmo/Database","is_pinned","description","Database environment","workspace_dir","/workspace","agent_network_access",{"_318":319,"_320":69,"_321":-5,"_322":-5,"_323":-5,"_324":-5},"codex_github_direct","github_connector_id","enable_gitlab_webhooks","repos",[278],"setup","","maintenance_setup","repo_map",{"_278":279},"env_vars",{"_260":261,"_262":263,"_264":265,"_266":267,"_268":269,"_270":271,"_272":273,"_274":275,"_276":277},"secrets",{},"secrets_with_domains","task_count",1231,"creator_id","user-meqzK8tcEkFfh4X5tXfIqXyp","share_settings","workspace","share_targets",[],1783581192.606357,"auto_setup_settings",{"_259":59},"cache_settings",{"_257":59,"_258":231},"etag","\"06003ee4-0000-0200-0000-6a6085bb0000\"","enable_authtranslator","enable_docker_in_docker","post_setup_cache_enabled","cache_invalidation_key","use_auto_setup","CODEX_ENV_PYTHON_VERSION","3.12","CODEX_ENV_NODE_VERSION","20","CODEX_ENV_RUBY_VERSION","3.4.4","CODEX_ENV_RUST_VERSION","1.89.0","CODEX_ENV_GO_VERSION","1.24.3","CODEX_ENV_BUN_VERSION","1.2.14","CODEX_ENV_PHP_VERSION","8.4","CODEX_ENV_JAVA_VERSION","21","CODEX_ENV_SWIFT_VERSION","6.1","github-1243497866",{"_42":280,"_202":281,"_282":283,"_284":217,"_285":286,"_287":288,"_289":290,"_291":292,"_293":294,"_295":64,"_296":15,"_297":-5,"_298":-5,"_299":-5,"_300":-5,"_301":-5,"_302":-5,"_169":303,"_304":-5,"_55":305},"1243497866","Database","owner",{"_310":311,"_42":312,"_93":313,"_314":315,"_316":317},"repository_full_name","clone_url","https://github.com/BigSimmo/Database.git","default_branch","main","git_commits_url","https://api.github.com/repos/BigSimmo/Database/git/commits{/sha}","git_refs_url","https://api.github.com/repos/BigSimmo/Database/git/refs{/sha}","git_url","git://github.com/BigSimmo/Database.git","visibility","archived","allow_auto_merge","allow_merge_commit","allow_rebase_merge","allow_squash_merge","allow_update_branch","language",63073,"master_branch",{"_306":15,"_307":15,"_308":15,"_309":15},"admin","maintain","push","pull","login","BigSimmo",87357024,"User","avatar_url","https://avatars.githubusercontent.com/u/87357024?v=4","url","https://api.github.com/users/BigSimmo","mode","on","preset_allowlist","allowlist_domains","allowlist_rules","denylist_domains","safe_methods_only","number",1072,"https://github.com/BigSimmo/Database/pull/1072","state","open","merged","mergeable","draft","title","docs(issues): capture source-governance audit deferrals (#025-#030)","body","## Summary\r\n\r\nThe source-governance audit shipped its regression-safe subset in #1051 and deferred the rest. Those deferrals existed only in #1051's PR body and session context ΓÇö so once #1051 merges they'd effectively vanish from the repo's durable memory. This captures them in `docs/outstanding-issues.md` (6 rows, `#025`ΓÇô`#030`).\r\n\r\n**The important one is `#025`.** The audit reported three ranking \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at `0`, and `selectBestSourceRecommendation` ignores governance metadata. Filing those as open tasks would have been actively harmful ΓÇö they are **deliberate, measured decisions, not debt**:\r\n\r\n> Blanket governance metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to **16/23** (doc-recall@5 **1.0 ΓåÆ 0.76**, mrr 0.75 ΓåÆ 0.64). The corpus is only partially metadata-enriched and `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` ΓÇö so **\"unknown\" Γëá \"bad\"**, and blanket weighting swings ranking ~0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected, PR #118).\r\n\r\nSo `#025` is written as a **guardrail with the measurement attached**, not a todo ΓÇö it exists to stop a future session \"fixing\" a known regression back into the ranker.\r\n\r\nThe rest are genuine, correctly-scoped follow-ups:\r\n\r\n| Row | Item |\r\n| --- | --- |\r\n| `#026` | Governance metadata absent from the LLM prompt (generation-surface; needs `eval:rag` + approval; same \"unknown Γëá bad\" hazard) |\r\n| `#027` | Answer cache can serve stale governance metadata ΓÇö **already mitigated** by explicit invalidation; residual risk only, next action is a regression test |\r\n| `#028` | Threshold-conflict detection covers only ANC/WBC/platelets (broadening carries false-positive risk) |\r\n| `#029` | No explicit `is_public` flag ΓÇö visibility is implicit `owner_id IS NULL` |\r\n| `#030` | D5 `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` parked OFF (product decision) |\r\n\r\nAudit item 12 (canary automation) is **deliberately not filed** ΓÇö already covered by the blocking `pr-policy` RAG-impact gate plus the weekly scheduled 44-case canary. Filing it would be a false todo.\r\n\r\n## Verification\r\n\r\n- [x] `npx prettier --check docs/outstanding-issues.md` ΓÇö clean\r\n- [x] `npm run docs:check-links` ΓÇö passed, 1103 repo path references resolve\r\n\r\nDocs-only; no code, no behaviour, no provider calls. The non-`#025`ΓÇô`#030` line changes are prettier re-padding the aligned markdown table (whitespace only) because the new Detail cells are the widest in the column.\r\n\r\n## Risk and rollout\r\n\r\n- Risk: none ΓÇö documentation only.\r\n- Rollback: single-commit revert.\r\n- Provider or production effects: None.\r\n\r\n≡ƒñû Generated with [Claude Code](https://claude.com/claude-code)\r\n\r\n\r\n## Summary by CodeRabbit\r\n\r\n* **Documentation**\r\n * Expanded the ΓÇ£Open itemsΓÇ¥ list with six newly tracked entries (IDs `#032`ΓÇô#037), including priority/type, summaries, and next actions.\r\n * Updated the documentΓÇÖs next-issue marker to reflect the next available item ID.\r\n\r\n\n## Sweep note\nGovernance audit deferrals landed as **#032-#037** (not #025-#030) because main already used #025-#030 for webhook/observability items; `next-id=038`.\r\n","base","head","base_sha","bf9a50836a445441f4d224686c54f1c4af257b6a","head_sha","merge_commit_sha","50ed7b3e420172eefd3b98a8f11ed5b9be245f61","comments","diff","user",{"_310":311,"_202":311,"_355":-5,"_314":315,"_42":312},"commits",2,"changed_files",1,"additions",7,"deletions","email","events",[358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437],{"_163":998,"_439":999},{"_163":456,"_439":993},{"_163":988,"_439":989},{"_163":460,"_439":979},{"_163":460,"_439":971},{"_163":460,"_439":965},{"_163":478,"_439":954},{"_163":478,"_439":949},{"_163":460,"_439":941},{"_163":478,"_439":938},{"_163":460,"_439":930},{"_163":460,"_439":925},{"_163":478,"_439":916},{"_163":460,"_439":911},{"_163":478,"_439":906},{"_163":460,"_439":900},{"_163":460,"_439":895},{"_163":478,"_439":886},{"_163":460,"_439":881},{"_163":478,"_439":876},{"_163":460,"_439":868},{"_163":460,"_439":863},{"_163":460,"_439":859},{"_163":478,"_439":848},{"_163":478,"_439":843},{"_163":460,"_439":835},{"_163":460,"_439":830},{"_163":460,"_439":826},{"_163":478,"_439":815},{"_163":478,"_439":810},{"_163":460,"_439":802},{"_163":460,"_439":797},{"_163":478,"_439":788},{"_163":460,"_439":783},{"_163":478,"_439":778},{"_163":460,"_439":770},{"_163":460,"_439":765},{"_163":478,"_439":756},{"_163":460,"_439":751},{"_163":478,"_439":746},{"_163":460,"_439":738},{"_163":460,"_439":733},{"_163":478,"_439":724},{"_163":460,"_439":719},{"_163":478,"_439":714},{"_163":460,"_439":704},{"_163":460,"_439":699},{"_163":460,"_439":695},{"_163":478,"_439":684},{"_163":478,"_439":679},{"_163":460,"_439":671},{"_163":460,"_439":666},{"_163":460,"_439":662},{"_163":478,"_439":651},{"_163":478,"_439":646},{"_163":460,"_439":638},{"_163":460,"_439":633},{"_163":460,"_439":629},{"_163":478,"_439":616},{"_163":478,"_439":611},{"_163":460,"_439":603},{"_163":460,"_439":598},{"_163":478,"_439":589},{"_163":460,"_439":584},{"_163":478,"_439":579},{"_163":460,"_439":571},{"_163":460,"_439":566},{"_163":460,"_439":562},{"_163":478,"_439":551},{"_163":478,"_439":546},{"_163":460,"_439":538},{"_163":460,"_439":529},{"_163":478,"_439":509},{"_163":460,"_439":501},{"_163":478,"_439":496},{"_163":460,"_439":484},{"_163":478,"_439":479},{"_163":460,"_439":461},{"_163":456,"_439":457},{"_163":438,"_439":440},"turn/completed","params",{"_441":442,"_88":443},"threadId","019f890f-1147-73a0-b413-e43f041c7dd3",{"_444":445,"_446":447,"_104":-5,"_42":448,"_449":450,"_451":452,"_453":454,"_455":114},"completedAt",1784710996,"durationMs",102136,"019f890f-1290-7c51-b00f-da732e976c7e","items",[],"itemsView","notLoaded","startedAt",1784710894,"status","thread/status/changed",{"_455":458,"_441":442},{"_93":459},"idle","rawResponseItem/completed",{"_462":463,"_441":442,"_464":448},"item",{"_465":466,"_467":-5,"_42":468,"_469":470,"_471":472,"_97":94,"_93":473},"turnId","content",[475],"end_turn","msg_0ae0f51be7c974a3016a60874eaf988194981c3a1e5c7f6a2d","internal_chat_message_metadata_passthrough",{"_474":448},"phase","final_answer","message","turn_id",{"_46":476,"_93":477},"### Summary\n* Merged state was already present on `claude/capture-governance-audit-deferrals`, so I made a single follow-up conflict-resolution commit on that same PR branch: `84ad8dcd26908493c96c2fd2d1d97b17ece2ddd0`.\n* Preserved the latest `main` ledger entries through `#030`, restored sequential numbering by placing the governance deferrals at `#031`–`#036`, and advanced `issues:next-id` to `037`. 【F:docs/outstanding-issues.md†L30-L66】\n* Fixed the stale governance cross-reference so the LLM-prompt deferral now points at the adjacent governance-ranking guardrail `#031`, not the unrelated `#025`. 【F:docs/outstanding-issues.md†L61-L62】\n\n### Push result\n* ❌ Exact push failure: `fatal: could not read Username for 'https://github.com': No such device or address`\n* The local branch is ahead by 1 commit; the commit that needs pushing is `84ad8dcd26908493c96c2fd2d1d97b17ece2ddd0`.\n\n**Testing**\n* ✅ `git diff --check`\n* ✅ `npx prettier --check docs/outstanding-issues.md`\n* ✅ `npm run docs:check-links`\n* ❌ `git push origin HEAD:claude/capture-governance-audit-deferrals` — failed because GitHub HTTPS credentials are unavailable in this environment: `fatal: could not read Username for 'https://github.com': No such device or address`","output_text","item/completed",{"_480":481,"_462":482,"_441":442,"_464":448},"completedAtMs",1784710996332,{"_42":468,"_471":472,"_46":476,"_93":483},"agentMessage",{"_462":485,"_441":442,"_464":448},{"_465":-5,"_486":487,"_42":488,"_469":489,"_490":491,"_93":492},"encrypted_content","gAAAAABqYIdOIcgCt3TKX0jHIfnuHoWDwLuWuKwZK_8M9qY9zuohXOuCTeLuwwH1g-hVQPqH_zNLBeh3godlrXwn3f8269oBFv4ZwYszOV4X5f2EqGesfzvG5XmZJEKkeqLCVxL-Cbe2CzQSJP0VhJC-eODIzgeUtCy1AFSSvFus9LSsfdsIKEkHoCvzaGP_fLQob18xCN7CvRcJRPbRDxvE4ftQ0CXPoQRKu4u6_9rdHrbl0j7VT6XJFWUJkhNHG9bnUqC8FG9IYoRSHEP63rWKEnW3NZ97oW07ru83orkBgEo-qmWai5wMyIeMMVokI-eA2HrwHuqyWle9vyq3HzYmkDk5ElI1qKcVvWij-HeDYfjzYkTyMHNEIGlBMrLfbpfilbMBPlSxymEcN5Hj39drKP1-T6jnnUUK2rvlN-kFigIrUpCbLY4dvV6t-ewuAxmh25-s975uKegR3FabWOAo_Uj-qPJH2BiU9LIDmg1UXx53bxr9xyUp9PUx2BGCbH0aJjfVCX20v3KNuuhT4f8ijdO-tMZ_RM9zGfEPw0KFmKKHeOsP-NoAucI3O-xJicD5MOv6qVT6kZfuMbtXhJvmPZLTpzevvxs1aNW5xyfMdr7oXMJ74t-Q4zAbLHBiGAhdW7vusei4Yq7f97CpwwodXYe81KQhqsUFidlifOsEJfGmKRP7D8PdLTop4UN9cx2dtmalYfd4a2Kb7AF7AszIup7WiWYAT1lx-VCqPrXRxzKWBbO9CbteIojjyCludAvjxGNLs6CjUjqZDRjq0Is_m2Ya3vGVBWFMo6XP9zMp5C0Oii-u7ce2omAxxES4dIb5E25lC02KM-NYJ5ozvSkMVDF2TEKcl0lDYP2mV1SsXMuLUe4wGWgI7NZe0kqadRvxvSwaTJU1nwNoVHLtbNO4O0gsIG4ZO0vGXMncYCyeMwDwkRqIH-cLdJG1vllcHYbFRNAVIvDQbFfsOdz0H6KRigcjQp271od4uEEnKmrnxNWdDLfsE7BUVNdRXqGRq1zN8XHe3cR0DijudMZrq1I65oALLwje82wkFwIfarwSwxob0VsDTWqwxpS-RpQ8RAHBiTLEtXAwUQgbdskCtAfJBg0lBfQRhenjUQ4IgMHaF26iZ81z2A_hDuZ_AQo7el5ftN_kdlBp200clkCi4ZtSUITbPMxZZJa4X2unbypbzitAJHSum4D0PTwq7bx8Ek6kYevRyqzIWfQGgKp56O-HPSEG493TaMnlYetM_g5LYgqJfRo0b74CICT-UlLCRY9lF5E2RnZy","rs_0ae0f51be7c974a3016a60874d081c8194a1dc153732194114",{"_474":448},"summary",[493],"reasoning",{"_46":494,"_93":495},"**Clarifying exact push failure with commit SHA**","summary_text",{"_480":497,"_462":498,"_441":442,"_464":448},1784710990706,{"_465":499,"_42":488,"_490":500,"_93":492},[],[494],{"_462":502,"_441":442,"_464":448},{"_503":504,"_42":-5,"_469":505,"_506":507,"_93":508},"call_id","call_IjWdZsiNpyKRa5NCvbkODXGP",{"_474":448},"output","Chunk ID: 9e63f7\nWall time: 0.0013 seconds\nProcess exited with code 0\nOriginal token count: 18170\nOutput:\nWarning: truncated output (original token count: 18170)\nTotal output lines: 42\n\n 27\t- Resolving an item moves its row to **Resolved / archive** with the date and a one-line outcome —\n 28\t rows are archived, not deleted, so the history stays auditable.\n 29\t\n 30\t\n 31\t\n 32\t## Open items\n 33\t\n 34\t| ID | Pri | Type | Summary | Detail / next action | Source | Added |\n 35\t| ---- | --- | ----- | ------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n 36\t| #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 |\n 37\t| #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 |\n 38\t| #006 | P2 | issue | Globe \"Language & region\" button had no handler | Fixed in this PR to the disabled \"Coming soon\" placeholder convention (`aria-disabled` + sr-only note). Wire to a real language/region settings screen when one exists, then drop the placeholder state. | `src/components/clinical-dashboard/master-search-header.tsx:1829`; session 2026-07-21 | 2026-07-21 |\n 39\t| #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 |\n 40\t| #009 | P3 | rec | Confirm `/api/jobs` is intentionally server/ops-only | No client `fetch()` reaches `/api/jobs` (only tests import it). Confirm it is a deliberate ops/manual surface; if abandoned, remove it. | `src/app/api/jobs/route.ts` | 2026-07-21 |\n 41\t| #010 | P3 | task | Un-built \"Coming soon\" controls across forms/favourites | ~10 disabled placeholders (forms refine/reset, favourites sort/add/new-set, move-to-set, remove-favourite). Correctly flagged (`aria-disabled` + \"Coming soon\"), not defects — wire when the underlying features land. | `forms-search-results-page.tsx`; `favourites-hub.tsx`; `favourites-command-library-page.tsx` | 2026-07-21 |\n 42\t| #011 | P3 | task | Auth DB-connection allocation is operator-only | Supabase Auth (GoTrue) is capped at ~10 absolute DB connections (Supabase perf advisor). Switch to **percentage-based** allocation in the Supabase **dashboard** before the first compute scale-up — **not settable via SQL/MCP** (operator-owned). Verify via a staging soak + an approval-gated read-only advisor re-check. | `docs/auth-connection-cap-runbook.md`; `docs/process-hardening.md` (Known follow-up debts) | 2026-07-21 |\n 43\t| #012 | P3 | rec | Slim the lazy…8170 tokens truncated… | session 2026-07-22 webhook review | 2026-07-22 |\n 58\t| #028 | P3 | rec | Runtime error tracking (Sentry or similar) | No error tracking in the repo — production exceptions on `psychiatry.tools`, including how often `RAG_PROVIDER_MODE=auto` silently degrades to source-only, are invisible. Weigh adding `@sentry/nextjs` (dependency + DSN secret + instrumentation) vs cost; alert → chat/issue. Provider-backed; needs explicit sign-off before adding the dependency. | session 2026-07-22 webhook review | 2026-07-22 |\n 59\t| #029 | P2 | issue | 12 of 30 answer-quality cases return the fallback stub | run #61 --dump-answers: 12/30 quality cases emit the source_backed_review_fallback boilerplate with answer_sections: [], all grounded with 4-6 citations. Some still PASS targeting because the stub echoes query keywords (the contraindication/document_lookup matchers need only a keyword), so the targeting metric MASKS the problem for those intents. Superset of #018 — fix in the extractive composer, validate with the provider-backed answer eval. | run #61 dump artifact; session 2026-07-22 | 2026-07-22 |\n 60\t| #030 | P3 | issue | Wide-tier alias lets one doc satisfy both comparison slots | In src/lib/eval-document-matching.ts, \"Admission to Discharge for Mental Health Inpatients\" appears in BOTH the AdmissionCommunityPts and Discharge alias lists, so a single document can satisfy both expectedFiles slots and make allHit true — a latent false-pass on admission-discharge cases. Not firing today (that doc is not in the failing top-5) but it would mask a real miss. Tighten the tables so one doc cannot fill both sides. | src/lib/eval-document-matching.ts:32-65; session 2026-07-22 | 2026-07-22 |\n 61\t| #031 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so \"unknown\" ≠ \"bad\" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 |\n 62\t| #032 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same \"unknown ≠ bad\" hazard as #031 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |\n 63\t| #033 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 |\n 64\t| #034 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |\n 65\t| #035 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |\n 66\t| #036 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 |\n 67\t\n84ad8dc (HEAD -> claude/capture-governance-audit-deferrals) docs(issues): finish ledger conflict resolution\n","function_call_output",{"_480":510,"_462":511,"_441":442,"_464":448},1784710987635,{"_512":513,"_514":515,"_516":517,"_518":519,"_446":351,"_520":32,"_42":504,"_521":522,"_523":524,"_455":114,"_93":525},"aggregatedOutput"," 27\t- Resolving an item moves its row to **Resolved / archive** with the date and a one-line outcome —\n 28\t rows are archived, not deleted, so the history stays auditable.\n 29\t\n 30\t\n 31\t\n 32\t## Open items\n 33\t\n 34\t| ID | Pri | Type | Summary | Detail / next action | Source | Added |\n 35\t| ---- | --- | ----- | ------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n 36\t| #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 |\n 37\t| #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 |\n 38\t| #006 | P2 | issue | Globe \"Language & region\" button had no handler | Fixed in this PR to the disabled \"Coming soon\" placeholder convention (`aria-disabled` + sr-only note). Wire to a real language/region settings screen when one exists, then drop the placeholder state. | `src/components/clinical-dashboard/master-search-header.tsx:1829`; session 2026-07-21 | 2026-07-21 |\n 39\t| #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 |\n 40\t| #009 | P3 | rec | Confirm `/api/jobs` is intentionally server/ops-only | No client `fetch()` reaches `/api/jobs` (only tests import it). Confirm it is a deliberate ops/manual surface; if abandoned, remove it. | `src/app/api/jobs/route.ts` | 2026-07-21 |\n 41\t| #010 | P3 | task | Un-built \"Coming soon\" controls across forms/favourites | ~10 disabled placeholders (forms refine/reset, favourites sort/add/new-set, move-to-set, remove-favourite). Correctly flagged (`aria-disabled` + \"Coming soon\"), not defects — wire when the underlying features land. | `forms-search-results-page.tsx`; `favourites-hub.tsx`; `favourites-command-library-page.tsx` | 2026-07-21 |\n 42\t| #011 | P3 | task | Auth DB-connection allocation is operator-only | Supabase Auth (GoTrue) is capped at ~10 absolute DB connections (Supabase perf advisor). Switch to **percentage-based** allocation in the Supabase **dashboard** before the first compute scale-up — **not settable via SQL/MCP** (operator-owned). Verify via a staging soak + an approval-gated read-only advisor re-check. | `docs/auth-connection-cap-runbook.md`; `docs/process-hardening.md` (Known follow-up debts) | 2026-07-21 |\n 43\t| #012 | P3 | rec | Slim the lazy cross-mode differentials chunk | `cross-mode-differentials.ts` is dynamically imported (correctly code-split **out** of the initial/dashboard bundle — verified), but it pulls the full ~860 KB differentials snapshot (~125 KB gzip lazy chunk) just to build a tiny `{slug,title,clinicalHinge}` + presentations + aliases catalog. A precomputed lightweight index (generator + drift check, like the `specifiers-content` split / medications `fields=index`) would cut that lazy chunk ~5–10×. Not a bundle leak — an M-effort slim. | `src/lib/cross-mode-differentials.ts`; `src/components/clinical-dashboard/cross-mode-links.tsx:150`; session 2026-07-21 (build:analyze) | 2026-07-21 |\n 44\t| #013 | P3 | rec | Route-chunk + mockup catalogue JSON weight | `build:analyze`: `/specifiers` ships `specifiers-search-index.json` (~180 KB parsed), `/forms` ships `forms-catalog.json` (~132 KB), `/formulation` ships `formulation-content.json` (~52 KB, client-side local search — needs index/full split or a search endpoint, architectural). All route-scoped (not initial bundle). Also `*-mockups.tsx` (~100 KB across chunks) build though `/mockups` 404s in prod — exclude from the prod artifact. | session 2026-07-21 (build:analyze) | 2026-07-21 |\n 45\t| #014 | P3 | rec | Realize the `next/image` win on signed previews | `next.config` `images` (AVIF + `*.supabase.co` `remotePatterns` pinned to the project host, from #1024) is currently inert — signed document/image previews still render as raw ``. Route them through `next/image` to actually get AVIF + lazy optimization. | #1024; `src/components/clinical-dashboard/signed-image.tsx`; session 2026-07-21 | 2026-07-21 |\n 46\t| #016 | P3 | rec | \"Big but not easy\" structural + motion perf | Deferred larger levers: (a) nonce-CSP forces every product route to `ƒ Dynamic` (zero static generation) — evaluate Partial Prerendering / static shells for the static clinical catalogues (DSM/differentials/therapy/specifiers/formulation); (b) sidebar expand/collapse animates `grid-template-columns` (biggest smoothness cost, motion-gated — needs a transform-overlay rethink); (c) Therapy Compass fetches 692 KB / 2.5 MB JSON client-side (defer until interaction + confirm brotli); (d) settings/setup/admin dialogs static-imported into the home chunk (`next/dynamic` them). | session 2026-07-21 (build route table + design audit) | 2026-07-21 |\n 47\t| #017 | P3 | task | Field Web-Vitals baseline via live Lighthouse | In-sandbox runtime vitals were blocked (prod server hard-requires Supabase secrets; dev-mode CLS measured excellent at 0.00–0.04, content-first pages 0.000). Run Lighthouse against `psychiatry.tools` for real LCP/INP/CLS to prioritize #012–#016 by measured impact rather than reasoning. | session 2026-07-21 (measurement pass) | 2026-07-21 |\n 48\t| #018 | P2 | task | Targeting misses are answer-composition, NOT retrieval-depth | DIAGNOSED 2026-07-22 from the run #61 --dump-answers artifact: retrieval is healthy (grounded=true, 4-6 citations, high_confidence_extractive_retrieval). lithium + adhd return the source_backed_review_fallback boilerplate stub (\"a full written answer could not be completed just now\") with answer_sections: []; metabolic returns a mangled 73-char fragment (\"The guidance for metabolic is that compliance, monitoring and evaluation.\"). NOT corpus-content, NOT retrieval-depth. Root cause is the extractive composer (src/lib/rag/rag-extractive-answer.ts). Do NOT widen the eval matcher (rag-eval-cases.ts:192) — the stub contains monitoring/maintenance/level/range, so widening would make stubs falsely PASS. Fix is a protected-surface answer-behaviour change (provider-backed answer-quality eval + approval). | run #61 dump artifact; session 2026-07-22 | 2026-07-21 |\n 49\t| #019 | P2 | task | Admission doc dropped by answer-stage re-rank, not retrieval | DIAGNOSED 2026-07-22 from run #61 artifacts: retrieval coverage is PERFECT — golden documentRecallAt5=1, reciprocalRankAt10=1, missingDocumentSubstrings=[], with \"Admission of Community Patients (AKG).pdf\" at raw rank 4-5 (matches the strict alias AdmissionCommunityPts). The answer stage then DROPS it from answer.sources top-5 and promotes \"Falls Prevention and Management (AKG).pdf\" (raw rank 8, off-topic) in its place. So the defect is post-retrieval evidence balancing (cross-document-synthesis.ts balanceCrossDocumentResults / rankAnswerEvidence), NOT comparison-class retrieval coverage. Separately: nothing guarantees BOTH sides of a comparison are represented — comparison_multi_document_gate (rag.ts:2043) is satisfied by any 2 distinct docs. Fix = protected surface (canary pair + ~$2-4 approval). | run #61 artifacts; session 2026-07-22 | 2026-07-21 |\n 50\t| #020 | P3 | task | Validate eval:quality cost readout post-fix | The estimator fix landed in PR #1050 (zero-usage cases count $0 with rates configured; provider-attempted cases with missing usage stay n/a). Remaining action: confirm the next canary run prints a real dollar figure in Answer Metrics, then archive this row. | PR #1050; run #60/#61 Answer Metrics tables | 2026-07-21 |\n 51\t| #021 | P3 | rec | E-3d H2 residual: strong/comparison generation discards | approx. 6 generation attempts per full 44-case run still fail the final quality gate and fall to extractive on strong-route comparison/complex shapes (the designed-conservative outcome). PARKED: weakest cost/benefit on the queue — a wave (approx. $2-4 pair + reviewer cycle) to shave seconds off a few hard cases. Revisit only if latency/waste complaints or a cheaper lever appears. | E-3c design record; runs #59-#61 diagnostics | 2026-07-21 |\n 52\t| #022 | P2 | task | Source-governance metadata refresh (operator) | Governance warning rate ~0.84 across canaries: stale/review-required/unknown source metadata on most top results. Operator work (document review-status attestation in the app), not a code defect. Next action: generate the prioritized refresh worklist ($0 read-only) and schedule a metadata pass. | runs #57-#61 Source Governance tables; docs/observability-slos.md | 2026-07-21 |\n 53\t| #023 | P3 | task | Read Sunday 2026-07-26 scheduled-run artifacts | The 18:00 UTC scheduled runs deliver three free datapoints at once: first full-44 weekly canary (validates the #1044 ANSWER_CASE_LIMIT raise), browser-matrix flake second datapoint (webkit ui-route-coverage now reproduced + root-caused 2026-07-22 → see #024; firefox ui-formulation:91 still awaits a datapoint), and the irrelevant@10 labeling-audit artifact (§3.1 human-decision class). Read all three, then disposition. | sessions 2026-07-20/21; branch-review-ledger convergence notes | 2026-07-21 |\n 54\t| #024 | P3 | issue | WebKit e2e `_rsc`-prefetch access-control-checks errors | verify:release:offline on `main` ce32fe170 (2026-07-22) reproduced #023's webkit clause: **6/6 deterministic** failures in `tests/ui-route-coverage.spec.ts` (Therapy Compass; DSM home/comparison; Specifier comparison/map; Differential stream), each a `pageerror … ?_rsc=… due to access control checks` on Next.js RSC prefetch — Chromium + Firefox clean. Not merge-blocking (required gate `test:e2e:pr` is chromium-only; the full webkit matrix is advisory/release-time). Most likely a Playwright route-interception × WebKit interaction, not a Safari user defect. Next: decide (a) allow/mock the `_rsc` routes for the `webkit` e2e project, or (b) confirm real Safari impact — before trusting the full-matrix webkit gate at release. NB the 2 other webkit fails (`ui-stress:412`, `ui-universal-search:210`) passed on isolated re-run = true flake. | session 2026-07-22 (verify:release:offline, `main` ce32fe170); refines #023 | 2026-07-22 |\n 55\t| #025 | P2 | task | Activate the three webhooks (operator secrets) | Merged (#968) + deployed but inert — verified live: `POST /api/webhooks/railway` returns `503 webhook_not_configured`. To turn on: (1) Railway → set `RAILWAY_WEBHOOK_SECRET` + add the `?token=…` webhook URL; (2) the chat URLs `SLACK_WEBHOOK_URL`/`DISCORD_WEBHOOK_URL` must be set in BOTH places — the Railway **app/server env** (the receiver forwards deploy alerts via `postChatNotification`, which reads server env, so repo-secret-only leaves the Railway webhook authenticated but returning `delivered:false`) AND as **GitHub repo secrets** (the CI-failure workflow reads `secrets.*`); (3) `SUPABASE_INGESTION_WEBHOOK_SECRET`. Each fails closed until set, so this is pure ops. See docs/webhooks.md. | session 2026-07-22; PR #968; docs/webhooks.md | 2026-07-22 |\n 56\t| #026 | P2 | task | Wire the Supabase document-change trigger | The `/api/webhooks/supabase/document-change` receiver is live but nothing calls it. The trigger (`notify_document_change_ingestion_webhook()` + `documents_ingestion_webhook`, SQL in docs/webhooks.md §3) must land as a **committed migration** — drift covers functions/triggers, so applying raw SQL to live would fail `check:drift`: add the migration, reconcile `supabase/schema.sql`, run `npm run drift:manifest` (needs a local Supabase container), then deploy. Operator-applied live state is the Vault secret (`select vault.create_secret('','ingestion_webhook_secret')`) + the base-URL GUC `app.ingestion_webhook_base_url`, which is MANDATORY per environment (the trigger no-ops when it is unset, so `reindex_requested` flips never enqueue — there is no production default). Trigger is `AFTER UPDATE` on `reindex_requested` only — NOT `INSERT` (an INSERT-fired webhook can beat the upload route's own job insert, which then deletes its just-created doc → intermittent upload failures); external inserts set `reindex_requested=true` to be picked up. Note delivery is at-most-once (pg_net has no retry) and there is NO built-in recovery (automatic or manual) for a dropped insert — neither the autopilot nor `scripts/reindex.ts` sweeps `queued` docs with no job (`hasIncompleteDocumentsWithoutOpenJobs` requires `queuedDocuments === 0`). External imports must insert then issue a SEPARATE UPDATE flipping `reindex_requested=true` (an insert with the flag pre-set won't fire the AFTER UPDATE trigger). The app upload path is NOT a guarantee either: it inserts the `documents` row then the `ingestion_jobs` row as two separate non-atomic calls (rollback only on a job-insert error), so a crash/timeout between them strands the same queued-without-job row nothing sweeps. The only true guarantees are an atomic enqueue (document + job in one transaction/RPC) or a scheduled queued-without-job sweep. Until applied, webhook #5 never fires. | session 2026-07-22; docs/webhooks.md §3 | 2026-07-22 |\n 57\t| #027 | P3 | rec | External uptime monitor independent of GitHub/Railway | `live-domain-monitor.yml` runs on GitHub's cron, so it won't run in exactly the outage it should catch (Actions or the deploy itself down). Add an off-platform synthetic monitor (UptimeRobot / Better Stack / Checkly) hitting `/api/health` with a webhook alert. Provider setup, not code. | session 2026-07-22 webhook review | 2026-07-22 |\n 58\t| #028 | P3 | rec | Runtime error tracking (Sentry or similar) | No error tracking in the repo — production exceptions on `psychiatry.tools`, including how often `RAG_PROVIDER_MODE=auto` silently degrades to source-only, are invisible. Weigh adding `@sentry/nextjs` (dependency + DSN secret + instrumentation) vs cost; alert → chat/issue. Provider-backed; needs explicit sign-off before adding the dependency. | session 2026-07-22 webhook review | 2026-07-22 |\n 59\t| #029 | P2 | issue | 12 of 30 answer-quality cases return the fallback stub | run #61 --dump-answers: 12/30 quality cases emit the source_backed_review_fallback boilerplate with answer_sections: [], all grounded with 4-6 citations. Some still PASS targeting because the stub echoes query keywords (the contraindication/document_lookup matchers need only a keyword), so the targeting metric MASKS the problem for those intents. Superset of #018 — fix in the extractive composer, validate with the provider-backed answer eval. | run #61 dump artifact; session 2026-07-22 | 2026-07-22 |\n 60\t| #030 | P3 | issue | Wide-tier alias lets one doc satisfy both comparison slots | In src/lib/eval-document-matching.ts, \"Admission to Discharge for Mental Health Inpatients\" appears in BOTH the AdmissionCommunityPts and Discharge alias lists, so a single document can satisfy both expectedFiles slots and make allHit true — a latent false-pass on admission-discharge cases. Not firing today (that doc is not in the failing top-5) but it would mask a real miss. Tighten the tables so one doc cannot fill both sides. | src/lib/eval-document-matching.ts:32-65; session 2026-07-22 | 2026-07-22 |\n 61\t| #031 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so \"unknown\" ≠ \"bad\" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 |\n 62\t| #032 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same \"unknown ≠ bad\" hazard as #031 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |\n 63\t| #033 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 |\n 64\t| #034 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |\n 65\t| #035 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |\n 66\t| #036 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 |\n 67\t\n84ad8dc (HEAD -> claude/capture-governance-audit-deferrals) docs(issues): finish ledger conflict resolution\n","command","/bin/bash -lc \"nl -ba docs/outstanding-issues.md | sed -n '27,67p'\ngit log -1 --oneline --decorate\"","commandActions",[526],"cwd","/workspace/Database","exitCode","processId","20875","source","unifiedExecStartup","commandExecution",{"_514":527,"_93":528},"nl -ba docs/outstanding-issues.md | sed -n '27,67p'\ngit log -1 --oneline --decorate","unknown",{"_462":530,"_441":442,"_464":448},{"_531":532,"_503":504,"_42":533,"_469":534,"_202":535,"_536":-5,"_93":537},"arguments","{\"cmd\":\"nl -ba docs/outstanding-issues.md | sed -n '27,67p'\\ngit log -1 --oneline --decorate\",\"workdir\":\"/workspace/Database\",\"yield_time_ms\":10000,\"max_output_tokens\":20000}","fc_0ae0f51be7c974a3016a60874ad97081949e138645f96795a6",{"_474":448},"exec_command","namespace","function_call",{"_462":539,"_441":442,"_464":448},{"_465":-5,"_486":540,"_42":541,"_469":542,"_490":543,"_93":492},"gAAAAABqYIdKO7OEJ0Bba8F-VJyuWjGGnxzxCwFmwBxBl1rd86JouFhsbRS2UWVjVEC5A4hF49y_X3Re9tBe6JE-s1FZWMH7gzATRvqLPaMt2w0u01NmN7r716sKegATKDIPuhPkx83nhqCC7-WM2gu39MazL5QTWw0u-8roDJh3wqwLG45Bw-_cprZfJ3jEfMqC2LYEJjvvcVMeUROUjaKHJEvqAF5r0-39HckusHDxA5sk298L9ckNB-z6ACkLMG9Go8Ovz4K_fGyX-LFIg5u-mP5Jt_DRX86169qYouKfaVxhIoHctqFdBOy_Gzc1keu7j1ZGeUvzyXtTP0cL8I632-Xh8O3SHzCx6JiPsACHq6gBsMKLER5uaqzKf0hg4TGE6kJnSA3YCvZyqekeP9eJrT_XzYjoC2ostQy6hvQtFq4W7Xohv0E607SyaST7e0MZPRnELKYZg1sI037b8TrgQ993pyLzxa8Z1cJrze0cqXp-LTyoqS405QAT4uIzc0RYkAyWTNm-5rQ-AwFMFLIWR2aVBjcKPOh9mj7wskqRZ5uvWjrW3PW8R7RCcD7EwhrZy7dMg_rKPaTRAPSqZ6r7LEEuNTY1tNlWsaO8QyIMmHtDN5Iu10a7_Aq8FWd3SFz2xqGu-VmuEw_Jzrl8RWZSsGwLAA8gTQrIsyZLmFCJ83wgwYsqMQBct2_5aZSU84c-7b36RJU2SbKRWGXhha6-efAIp1_4uCreuWsfxE8PCs7K18coPIv0KV6kqzTcUwnsRtfvWrmvqEGfsYf0xPXGAejtozsf0haS-IxTZFyBt82W5xnX5S5m_NRULma9aeMTCZB6CiBNFPMRA4lOFni6EgAEZwBM-SEWvp5Di5rARIWUaS13nunm-MuDgW1hODoqkRDyLPxFyjFXtvgiZdCem0QS2UKUkkBg1xhcBjPmwz66n_YY7Lu4f2-HM7dE8DaQXAaBZC30nWC4isuMq4zIh4PU6FqMtUpzbimuCnsX1MRpRb-cnZmz2zSbZqMtWsS7VJcOqKRy35TiSKubVXLMn8H_Mnp0OflJ0A4vrs2F9jhudDxTAC1piSkNyViJEJDWDhEa7HTER-i3BM8_kPwwSaSK3nure9xtjzyRTzWownXbuRp1cH2WLVhfOKOe9Jpu2QIXtgigkfFBuJzlIoQeMape4iWhcWFZNcCWi3JX1z993TradNOhhtP9QfE0Mz-yLI-nbbYbzRjCUWb-qDW23FpfQvbKz_u98sr0QTYt9g1dh3tMCfZCxq_dCkbrt87rq7sTvLxqy2Oke8dQh87bt1BpzY73DTkkD9UtqkUojFPMr0U8aaY=","rs_0ae0f51be7c974a3016a608748fc0c81948e8143dd289438ee",{"_474":448},[544],{"_46":545,"_93":495},"**Resolving PR creation conflict**",{"_480":547,"_462":548,"_441":442,"_464":448},1784710986880,{"_465":549,"_42":541,"_490":550,"_93":492},[],[545],{"_480":552,"_462":553,"_441":442,"_464":448},1784710982315,{"_512":554,"_514":555,"_516":556,"_518":519,"_446":557,"_520":32,"_42":558,"_521":559,"_523":524,"_455":114,"_93":525},"GITHUB_TOKEN unset\nGH_TOKEN unset\nGIT_ASKPASS unset\nSSH_AUTH_SOCK unset\n","/bin/bash -lc \"python3 - <<'PY'\nimport os\nfor k in ['GITHUB_TOKEN','GH_TOKEN','GIT_ASKPASS','SSH_AUTH_SOCK']:\n print(k, 'set' if os.environ.get(k) else 'unset')\nPY\"",[560],688,"call_dfnyHOfC9QEnHbnmLE8IcsPy","84343",{"_514":561,"_93":528},"python3 - <<'PY'\nimport os\nfor k in ['GITHUB_TOKEN','GH_TOKEN','GIT_ASKPASS','SSH_AUTH_SOCK']:\n print(k, 'set' if os.environ.get(k) else 'unset')\nPY",{"_462":563,"_441":442,"_464":448},{"_503":558,"_42":-5,"_469":564,"_506":565,"_93":508},{"_474":448},"Chunk ID: 15a7f0\nWall time: 0.5874 seconds\nProcess exited with code 0\nOriginal token count: 18\nOutput:\nGITHUB_TOKEN unset\nGH_TOKEN unset\nGIT_ASKPASS unset\nSSH_AUTH_SOCK unset\n",{"_462":567,"_441":442,"_464":448},{"_531":568,"_503":558,"_42":569,"_469":570,"_202":535,"_536":-5,"_93":537},"{\"cmd\":\"python3 - <<'PY'\\nimport os\\nfor k in ['GITHUB_TOKEN','GH_TOKEN','GIT_ASKPASS','SSH_AUTH_SOCK']:\\n print(k, 'set' if os.environ.get(k) else 'unset')\\nPY\",\"workdir\":\"/workspace/Database\",\"yield_time_ms\":10000,\"max_output_tokens\":2000}","fc_0ae0f51be7c974a3016a6087441978819496d63d3163e908a4",{"_474":448},{"_462":572,"_441":442,"_464":448},{"_465":-5,"_486":573,"_42":574,"_469":575,"_490":576,"_93":492},"gAAAAABqYIdELKrcWRVc6ytY5_CkDQfubAfqJYp2j8ilbVpD_McxpzPoRShuifwTnq6COohcEGmGwyXcBc36WJPq_iW_aOMd_cstK83yvyGiUMYZYJtZLxZEcOEgs3tF26TdZJSmLbERUoZJCnI-CQKJW7KZp202rv9Bt3ON47P4kILktzlyf6af4I2KlPpGRF4w772ruhoajwnqlhuvMKTC6ST5HnE7sMJsRp3V93emJXqrNd_HxH54niY0Db4s4q-LMXotT9Wzp_8IeSnO_fefEn0ZdWS_t4KSqmseUqp34Ov_9CHstNZkS5MHrL5haRURa6-1eOCKJeYJ8kxIUnxACGp2Tlm-DKNq_VK_Tc3vBH0cgScx_c8-sE39A7yNBzSLxi5Xcc0coXUlSW21_fCRt_A5yZQpDDITpeaupSUzyeqTWR-V8FJIFgL19PepZsD-EAt7F3-NqPo446SF_iw3jG8rd__MxGajwcTIuITQyhT4pgR60YR-QOFY7QXfnfoWV9l6WDQ8KSgTbM9DdTjZKrc_-Pf9VGTHrnl_7IW9Qze0V0oLUBPIEn45XcZK9OFcctNqZAA2e6IndwXaHKmnkO74EGe24puRfiCOoBRQc6xgBg5vd6JG5HV1JujW4kRIq0RUhu47zahajnZU4750KA1f2xfsfIo6yAIadV1hGRzvuCTlRM2lQs3ZccTJ4p3FCBdKogSG6KZ84Ek3arMKIzA6OpXGGFrTaW9-aMw1mRrkpGm10pCjaRXC_xSku4EMx8R_fXmHZLs9gqErczt92VIiXkLvfl-RUjrUKcqgPwcjjl2lwk-2Eg7HT3mgErQLsf4zkMyJlOctthn_ZY3nKYRK-0iOOcLAAS45zBmzUutdZXysCD72hY6Mwpq3Zdxh8l_nz6mIrCCDHUM60Gp2fCnkMWkwXHIjcwODDKesEmJx95s8AdH3wJerDKYNn4UUuZFpFxp_mJtH9tBGdFypeVcMSaSkJvPWl1jdRCyqkOytFnh0Dj0=","rs_0ae0f51be7c974a3016a60874356648194ac6b4992e249032f",{"_474":448},[577],{"_46":578,"_93":495},"**Checking GitHub CLI availability**",{"_480":580,"_462":581,"_441":442,"_464":448},1784710980137,{"_465":582,"_42":574,"_490":583,"_93":492},[],[578],{"_462":585,"_441":442,"_464":448},{"_503":586,"_42":-5,"_469":587,"_506":588,"_93":508},"call_FfuBGzvm2gnpgIA8Gb6iXYL8",{"_474":448},"Chunk ID: 41a973\nWall time: 0.0002 seconds\nProcess exited with code 0\nOriginal token count: 27\nOutput:\n## claude/capture-governance-audit-deferrals...origin/claude/capture-governance-audit-deferrals [ahead 1]\n",{"_480":590,"_462":591,"_441":442,"_464":448},1784710978054,{"_512":592,"_514":593,"_516":594,"_518":519,"_446":32,"_520":32,"_42":586,"_521":595,"_523":524,"_455":114,"_93":525},"## claude/capture-governance-audit-deferrals...origin/claude/capture-governance-audit-deferrals [ahead 1]\n","/bin/bash -lc 'command -v gh && gh auth status || true\ngit status --short --branch'",[596],"31795",{"_514":597,"_93":528},"command -v gh && gh auth status || true\ngit status --short --branch",{"_462":599,"_441":442,"_464":448},{"_531":600,"_503":586,"_42":601,"_469":602,"_202":535,"_536":-5,"_93":537},"{\"cmd\":\"command -v gh && gh auth status || true\\ngit status --short --branch\",\"workdir\":\"/workspace/Database\",\"yield_time_ms\":10000,\"max_output_tokens\":12000}","fc_0ae0f51be7c974a3016a60874150848194be79dfc42ac75c3a",{"_474":448},{"_462":604,"_441":442,"_464":448},{"_465":-5,"_486":605,"_42":606,"_469":607,"_490":608,"_93":492},"gAAAAABqYIdBq1eIqe5l05nDfPPT9Ecm7quggL84TNct9Y6zAGV5PEmTh5F9-C49IB9BssMXyhE8SF00waBHmINfy1P2NG6AysJbv7sxp26UT8O9PHQeNZr-vAOyF3uNQJNOP8t_asLCpRYYXqrVD87tdiKy07JAgEzdt8wSX9mSEh7Vtj-_wRRBCQJB0safy2-Kkh5NWdaynLsVML69RfGxdFkZK5y6Fem1Hjbdc0l6etKKspTZDC6iZjkMza8qNvGAgYhKYOTg5HcuCjKjnlwlUlYo25lm77vl-cHhV0O6zT2dX7e8XqKsu_MBlg8zlNLK0p_v_wGgF4wYpKH6wE299nzqsxGdWqu3JNfsMRY88MyJZLP9sXajojAlIUjMMkiiW0VtIrmgkE1jaHqoz_h7xSHnyN7zEGwasuCYwue4rTcvEOqnZg7lyyjcEweAVRDeDw5PRpu7Whz8gr-E7S9dltGMkVeZThL3JWYh26O_yeKR0d4aCoZ3eY-94Yp9EK5mck_zg6LvsedmRWi4esh6UQqXlQZHDUXMa4eu4Cuq_dMT24-GqZVzZWGDsMG1ZTTQh3Njx-Gxiy0kureQdMDsLpWYxIKdofkreyQjLmIkg36MRkhCXaHUPSNQjNojO6SDl5Zfb4lvXM-fcmpZ_ltXhP1FWpo9u95e04n88vkdYkM8Ir5Y7MK7-0aQM1fcWRfBIoJk3iVCO81Hs43bc_lJfWByjSyKUUFZ4DNzS0caFaM5u96XvcAqmwATI9MSOMCG2I1qhg-f_9a6FrTb0pKT0nSQQsaGgFDpQ3oAFBxhdLleM-Jex9pfDDj1oUQ6kNuSM0Z0YDTI0wl1-7859yXqg8xkfaHhOkHZ10ikbTxcAgb8cgMyjUAVgi60TN0zrBB4gHhkGyf8hvgyqHX2vaCOdBPYF6f0TNANue0bJXVhz6I7Z1-KE0pOXoo_0JulxuW_sFre3uX2fMKLix0pUD6iNOkcVHU5IvH9IP7XLt2n1SdB0zcrh1Q=","rs_0ae0f51be7c974a3016a60874087e08194bd6c2e60ab6bfc81",{"_474":448},[609],{"_46":610,"_93":495},"**Planning push failure handling**",{"_480":612,"_462":613,"_441":442,"_464":448},1784710977332,{"_465":614,"_42":606,"_490":615,"_93":492},[],[610],{"_480":617,"_462":618,"_441":442,"_464":448},1784710973974,{"_512":619,"_514":620,"_516":621,"_518":519,"_446":622,"_520":623,"_42":624,"_521":625,"_523":524,"_455":626,"_93":525},"fatal: could not read Username for 'https://github.com': No such device or address\n","/bin/bash -lc 'git status --short\ngit add docs/outstanding-issues.md\ngit commit -m \"docs(issues): finish ledger conflict resolution\"\ngit rev-parse HEAD\ngit push origin HEAD:claude/capture-governance-audit-deferrals'",[627],320,128,"call_bYK2A7QwV6cJJVCkmqNEjp8p","39189","failed",{"_514":628,"_93":528},"git status --short\ngit add docs/outstanding-issues.md\ngit commit -m \"docs(issues): finish ledger conflict resolution\"\ngit rev-parse HEAD\ngit push origin HEAD:claude/capture-governance-audit-deferrals",{"_462":630,"_441":442,"_464":448},{"_503":624,"_42":-5,"_469":631,"_506":632,"_93":508},{"_474":448},"Chunk ID: 7c8ffb\nWall time: 0.2202 seconds\nProcess exited with code 128\nOriginal token count: 76\nOutput:\n M docs/outstanding-issues.md\n[claude/capture-governance-audit-deferrals 84ad8dc] docs(issues): finish ledger conflict resolution\n 1 file changed, 7 insertions(+), 7 deletions(-)\n84ad8dcd26908493c96c2fd2d1d97b17ece2ddd0\nfatal: could not read Username for 'https://github.com': No such device or address\n",{"_462":634,"_441":442,"_464":448},{"_531":635,"_503":624,"_42":636,"_469":637,"_202":535,"_536":-5,"_93":537},"{\"cmd\":\"git status --short\\ngit add docs/outstanding-issues.md\\ngit commit -m \\\"docs(issues): finish ledger conflict resolution\\\"\\ngit rev-parse HEAD\\ngit push origin HEAD:claude/capture-governance-audit-deferrals\",\"workdir\":\"/workspace/Database\",\"yield_time_ms\":30000,\"max_output_tokens\":20000}","fc_0ae0f51be7c974a3016a60873c9f0881949ff21340941b6aa3",{"_474":448},{"_462":639,"_441":442,"_464":448},{"_465":-5,"_486":640,"_42":641,"_469":642,"_490":643,"_93":492},"gAAAAABqYIc8xApSgaej3DedRceKBRdxnG_6RPJbrW9QCNO5rdGhX5El-pFgp0SRBGQDT9lRROcmHUR3g0bhvUob1Cm8Z6ERblLBu0xL050bdLU1g0NxyHZV_0yrlrqOylmt77J2MnxD4-Af-uqOLkXlswlv5GU6AjWG1pti_n7QzO5MvFPx7vn1NVK3xda2_iDc9v7v_8NdIMj_c56EVL-KIQoEkEN-jBL4ZP1rndzltAXjJV4CbB-zGee2NZAr4Cy4wWh_Rr6FVgOKYcYOIa0CC6gU9a_Gn90HoMjLum2euYmrQRojVjPcdIZHPKVkto_ZKNH-yHCET2ha9QhasbaPxav1Wt-6qASm3HdYxbejH2UxGhtt6UYzb_tGqoVCxTquuBIibo76bXFl4oUlaahALqd635u9GyP_sYnxo40XLEp3oIpyGRGophSgrBg-0l28Fsso13hVlshfUtdmCRHXAucRqphDCPlkzmbe3NrXX0ygFaaNSJll_caEpI0DBPAKsrdADHtUdhE765AakVmaz41p49ymsnewlz8RirDLVrHd2ckkbUFdw4_CEoApWS_al_G1TEi1NoHGT3nhzInLZKmnVqVGCkl7FJqdtoNyWYnXZZK_TGEiar1LIay-gYPbjpHYJTl__ov4jJApL1yMkzDxvXxpf2yDDAE94_czlYbHn5KUJfUMyW9OHBnYKHwYyIabVR4-is7yIiZn2M81ufoPFAz93snyvsRc1A46JRMO_F8P5VyyIHmBEw31d4sGgc_plGfMVyiE2_axaEFJNb10lPaRDy4ZQXZywLoJHqpMnuPfcKdzcE1PJsIDFC9eWDgZC9BR1aionZsTOeKx813RqXNTAHloEaz9tYAKGfDMYZzp9QDwluKE9cdmvTU9YGVNkkNCp71sXI9zUsWuYDGit4XI-2v0HSPgsP_1QwNPnLrE1pQQKgr2ovyq-daVeZRxMNkm_yUEYMgAMOnieW3UO8RWvAF44K3ahhHK4ErSmVusIEoIde1F-QxeRuJRisqEWQbka49DoEkCIFN2i7LEH5M5wg==","rs_0ae0f51be7c974a3016a60873b47908194b20ec5a6a56ad8ee",{"_474":448},[644],{"_46":645,"_93":495},"**Preparing commit and push with credentials**",{"_480":647,"_462":648,"_441":442,"_464":448},1784710972641,{"_465":649,"_42":641,"_490":650,"_93":492},[],[645],{"_480":652,"_462":653,"_441":442,"_464":448},1784710968686,{"_512":654,"_514":655,"_516":656,"_518":519,"_446":657,"_520":32,"_42":658,"_521":659,"_523":524,"_455":114,"_93":525},"npm warn Unknown env config \"http-proxy\". This will stop working in the next major version of npm.\nnpm warn Unknown project config \"allow-scripts\". This will stop working in the next major version of npm.\nChecking formatting...\nAll matched files use Prettier code style!\nnpm warn Unknown env config \"http-proxy\". This will stop working in the next major version of npm.\nnpm warn Unknown project config \"allow-scripts\". This will stop working in the next major version of npm.\n\n> prompt-for-codex-medical-knowledge-base@0.1.0 docs:check-links\n> node scripts/check-docs-links.mjs\n\ndocs link check passed: 1115 repo path references resolve.\n","/bin/bash -lc \"set -e\nprintf 'next-id='; sed -n 's/.*issues:next-id=\\\\([0-9]\\\\+\\\\).*/\\\\1/p' docs/outstanding-issues.md\nawk -F'|' '/\"'^'\"\\\\| #[0-9]+/{gsub(/[ #]/,\\\"\\\",\"'$2); print $2}'\"' docs/outstanding-issues.md | sort -n | awk 'BEGIN{prev=0; ok=1} \"'$1>prev+1{print \"gap before\", $1; ok=0} {prev=$1} END{if(ok) print \"no gaps\"}'\"'\ngit diff --check\nnpx prettier --check docs/outstanding-issues.md\nnpm run docs:check-links\"",[660],1858,"call_c9eFxhqoT9zPhfDZnKlx7Wh7","3007",{"_514":661,"_93":528},"set -e\nprintf 'next-id='; sed -n 's/.*issues:next-id=\\([0-9]\\+\\).*/\\1/p' docs/outstanding-issues.md\nawk -F'|' '/^\\| #[0-9]+/{gsub(/[ #]/,\"\",$2); print $2}' docs/outstanding-issues.md | sort -n | awk 'BEGIN{prev=0; ok=1} $1>prev+1{print \"gap before\", $1; ok=0} {prev=$1} END{if(ok) print \"no gaps\"}'\ngit diff --check\nnpx prettier --check docs/outstanding-issues.md\nnpm run docs:check-links",{"_462":663,"_441":442,"_464":448},{"_503":658,"_42":-5,"_469":664,"_506":665,"_93":508},{"_474":448},"Chunk ID: 6612c2\nWall time: 1.7577 seconds\nProcess exited with code 0\nOriginal token count: 165\nOutput:\nnext-id=037\nno gaps\nnpm warn Unknown env config \"http-proxy\". This will stop working in the next major version of npm.\nnpm warn Unknown project config \"allow-scripts\". This will stop working in the next major version of npm.\nChecking formatting...\nAll matched files use Prettier code style!\nnpm warn Unknown env config \"http-proxy\". This will stop working in the next major version of npm.\nnpm warn Unknown project config \"allow-scripts\". This will stop working in the next major version of npm.\n\n> prompt-for-codex-medical-knowledge-base@0.1.0 docs:check-links\n> node scripts/check-docs-links.mjs\n\ndocs link check passed: 1115 repo path references resolve.\n",{"_462":667,"_441":442,"_464":448},{"_531":668,"_503":658,"_42":669,"_469":670,"_202":535,"_536":-5,"_93":537},"{\"cmd\":\"set -e\\nprintf 'next-id='; sed -n 's/.*issues:next-id=\\\\([0-9]\\\\+\\\\).*/\\\\1/p' docs/outstanding-issues.md\\nawk -F'|' '/^\\\\| #[0-9]+/{gsub(/[ #]/,\\\"\\\",$2); print $2}' docs/outstanding-issues.md | sort -n | awk 'BEGIN{prev=0; ok=1} $1>prev+1{print \\\"gap before\\\", $1; ok=0} {prev=$1} END{if(ok) print \\\"no gaps\\\"}'\\ngit diff --check\\nnpx prettier --check docs/outstanding-issues.md\\nnpm run docs:check-links\",\"workdir\":\"/workspace/Database\",\"yield_time_ms\":30000,\"max_output_tokens\":30000}","fc_0ae0f51be7c974a3016a6087337e488194b239d9f2dbcb9c24",{"_474":448},{"_462":672,"_441":442,"_464":448},{"_465":-5,"_486":673,"_42":674,"_469":675,"_490":676,"_93":492},"gAAAAABqYIcz4Wyk3KtguIVYOksrrHKjsCX5DgptEjdbyM5F-270qOGFNTGAYqPmFk-ifbcGMJNcvYZMXFnZEXnro8ffpG7AUHK7SFvQ-uCcdPIHsg_WL0Z5CcQM3Aws1GNoBe7l6IImkO2OMVj0vQZ2eJtUiSODaCb11RspYUXahgI5-uTVQ1NdzhYeEaSwktPaarAb1yNN5FfItUFVkE4oqGd6rp4F__RdxebSs_q7TGFmGGU6ocRS1g4aVFBb_PtRj-vOJZqzrZCfRGFHMR7NiJo75m5Rt1x8Vq3PbM_uUtgdfUjAoyNHLqpDJytyhHHA7dQZZ7uPV-gmF_EHNEDnSze_P0bOfYyPnMnn7YgbKDT42miaZOzqGQuuGtvlsROJiRNe107r0o7uWlIjN7iqLsAVBfhCb1gqRjlSnd7bc9oCEKxDFt9oK21B0KCbiSghoCU_OMVZmifnxX7dvGcmhzxRVDbU9QgqbHeZFdmg8375wo8tjAP0I0SFEllZ8SKchh3__-DNwYWvieHEQYnXik5AoukZ5kunw-B2zZHhC-JizJ9uDtoqBJB5_e3sc1tiX0r6hFAzO1kybDm0svFEBNXBfpBMbOKfMBvpdOd9Fa9pgUTjLwkVAELH3dJgPNRTC3nooQ2u9CVcDpvRntwE07xPALCKSXAbgty68Oz4w1SjE_f-8rcDsA0MqGLlArnJkHERceKUGOhdUBVI4j3AA8LEl8lXg-QB9Re065JOyBI0ho5J_WoX_kESXeV_k_12G7eMoyrFAyblxOzWx1UMlD1kfkqPnfv5VXCzpvsVXTBwIUWUsLXuwFF44SCZiad_37yTNuA-w9baK1qRGtZAMuTm52COt0zYQ_UuTqCw_4E0HrYmNGGjSXN6t1pHm-O1UgsOcqUCvEd4BU7I4_g1pGJCzvFlMVd_A5S3OTNmDf_7jyP5aUvAJ1zU9CoRISKbBW1u7jjkSPzYFQ8cpG8uGGV7XTthyzovTAm47e3lBM7nVggWN6w=","rs_0ae0f51be7c974a3016a608732c5d08194b528fd9726efa586",{"_474":448},[677],{"_46":678,"_93":495},"**Planning tests and ID sequence verification**",{"_480":680,"_462":681,"_441":442,"_464":448},1784710963510,{"_465":682,"_42":674,"_490":683,"_93":492},[],[678],{"_480":685,"_462":686,"_441":442,"_464":448},1784710961159,{"_512":687,"_514":688,"_516":689,"_518":519,"_446":690,"_520":32,"_42":691,"_521":692,"_523":524,"_455":114,"_93":525},"npm warn Unknown env config \"http-proxy\". This will stop working in the next major version of npm.\nnpm warn Unknown project config \"allow-scripts\". This will stop working in the next major version of npm.\ndocs/outstanding-issues.md 339ms\ndiff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md\nindex 3d07e64..b1d13d8 100644\n--- a/docs/outstanding-issues.md\n+++ b/docs/outstanding-issues.md\n@@ -27,7 +27,7 @@ Durable, cross-session memory of everything still outstanding for this repo: ope\n - Resolving an item moves its row to **Resolved / archive** with the date and a one-line outcome —\n rows are archived, not deleted, so the history stays auditable.\n \n-\n+\n \n ## Open items\n \n@@ -58,12 +58,12 @@ Durable, cross-session memory of everything still outstanding for this repo: ope\n | #028 | P3 | rec | Runtime error tracking (Sentry or similar) | No error tracking in the repo — production exceptions on `psychiatry.tools`, including how often `RAG_PROVIDER_MODE=auto` silently degrades to source-only, are invisible. Weigh adding `@sentry/nextjs` (dependency + DSN secret + instrumentation) vs cost; alert → chat/issue. Provider-backed; needs explicit sign-off before adding the dependency. | session 2026-07-22 webhook review | 2026-07-22 |\n | #029 | P2 | issue | 12 of 30 answer-quality cases return the fallback stub | run #61 --dump-answers: 12/30 quality cases emit the source_backed_review_fallback boilerplate with answer_sections: [], all grounded with 4-6 citations. Some still PASS targeting because the stub echoes query keywords (the contraindication/document_lookup matchers need only a keyword), so the targeting metric MASKS the problem for those intents. Superset of #018 — fix in the extractive composer, validate with the provider-backed answer eval. | run #61 dump artifact; session 2026-07-22 | 2026-07-22 |\n | #030 | P3 | issue | Wide-tier alias lets one doc satisfy both comparison slots | In src/lib/eval-document-matching.ts, \"Admission to Discharge for Mental Health Inpatients\" appears in BOTH the AdmissionCommunityPts and Discharge alias lists, so a single document can satisfy both expectedFiles slots and make allHit true — a latent false-pass on admission-discharge cases. Not firing today (that doc is not in the failing top-5) but it would mask a real miss. Tighten the tables so one doc cannot fill both sides. | src/lib/eval-document-matching.ts:32-65; session 2026-07-22 | 2026-07-22 |\n-| #032 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so \"unknown\" ≠ \"bad\" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 |\n-| #033 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same \"unknown ≠ bad\" hazard as #025 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |\n-| #034 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 |\n-| #035 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |\n-| #036 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |\n-| #037 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 |\n+| #031 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so \"unknown\" ≠ \"bad\" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 |\n+| #032 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same \"unknown ≠ bad\" hazard as #031 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |\n+| #033 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 |\n+| #034 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |\n+| #035 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |\n+| #036 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 |\n \n ## Resolved / archive\n \n","/bin/bash -lc \"python3 - <<'PY'\nfrom pathlib import Path\np=Path('docs/outstanding-issues.md')\ns=p.read_text()\n# Ensure only governance deferral rows are renumbered downward one.\nrepls={\n'<\"'!-- issues:next-id=038 -->'\"':'<\"'!-- issues:next-id=037 -->'\"',\n'| #032 | P3 | rec | Governance ranking weighting: REFUTED, not debt':'| #031 | P3 | rec | Governance ranking weighting: REFUTED, not debt',\n'| #033 | P3 | rec | Source governance metadata absent from the LLM prompt':'| #032 | P3 | rec | Source governance metadata absent from the LLM prompt',\n'| #034 | P3 | issue | Answer cache can serve stale governance metadata':'| #033 | P3 | issue | Answer cache can serve stale governance metadata',\n'| #035 | P3 | rec | Threshold-conflict detection covers only 3 params':'| #034 | P3 | rec | Threshold-conflict detection covers only 3 params',\n'| #036 | P3 | rec | No explicit \"'`is_public` visibility flag on documents'\"':'| #035 | P3 | rec | No explicit \"'`is_public` visibility flag on documents'\"',\n'| #037 | P3 | rec | D5 trust-cap-all-claims flag parked OFF':'| #036 | P3 | rec | D5 trust-cap-all-claims flag parked OFF',\n'as #025 — on a partially-enriched corpus':'as #031 — on a partially-enriched corpus',\n}\nfor a,b in repls.items():\n if a not in s:\n raise SystemExit(f'missing: {a}')\n s=s.replace(a,b,1)\np.write_text(s)\nPY\nnpx prettier --write docs/outstanding-issues.md\ngit diff -- docs/outstanding-issues.md | sed -n '1,220p'\"",[693],2196,"call_4scqrCHDbHhVX1mPTC7efnlp","78506",{"_514":694,"_93":528},"python3 - <<'PY'\nfrom pathlib import Path\np=Path('docs/outstanding-issues.md')\ns=p.read_text()\n# Ensure only governance deferral rows are renumbered downward one.\nrepls={\n'':'',\n'| #032 | P3 | rec | Governance ranking weighting: REFUTED, not debt':'| #031 | P3 | rec | Governance ranking weighting: REFUTED, not debt',\n'| #033 | P3 | rec | Source governance metadata absent from the LLM prompt':'| #032 | P3 | rec | Source governance metadata absent from the LLM prompt',\n'| #034 | P3 | issue | Answer cache can serve stale governance metadata':'| #033 | P3 | issue | Answer cache can serve stale governance metadata',\n'| #035 | P3 | rec | Threshold-conflict detection covers only 3 params':'| #034 | P3 | rec | Threshold-conflict detection covers only 3 params',\n'| #036 | P3 | rec | No explicit `is_public` visibility flag on documents':'| #035 | P3 | rec | No explicit `is_public` visibility flag on documents',\n'| #037 | P3 | rec | D5 trust-cap-all-claims flag parked OFF':'| #036 | P3 | rec | D5 trust-cap-all-claims flag parked OFF',\n'as #025 — on a partially-enriched corpus':'as #031 — on a partially-enriched corpus',\n}\nfor a,b in repls.items():\n if a not in s:\n raise SystemExit(f'missing: {a}')\n s=s.replace(a,b,1)\np.write_text(s)\nPY\nnpx prettier --write docs/outstanding-issues.md\ngit diff -- docs/outstanding-issues.md | sed -n '1,220p'",{"_462":696,"_441":442,"_464":448},{"_503":691,"_42":-5,"_469":697,"_506":698,"_93":508},{"_474":448},"Chunk ID: 951805\nWall time: 2.0965 seconds\nProcess exited with code 0\nOriginal token count: 7114\nOutput:\nnpm warn Unknown env config \"http-proxy\". This will stop working in the next major version of npm.\nnpm warn Unknown project config \"allow-scripts\". This will stop working in the next major version of npm.\ndocs/outstanding-issues.md 339ms\ndiff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md\nindex 3d07e64..b1d13d8 100644\n--- a/docs/outstanding-issues.md\n+++ b/docs/outstanding-issues.md\n@@ -27,7 +27,7 @@ Durable, cross-session memory of everything still outstanding for this repo: ope\n - Resolving an item moves its row to **Resolved / archive** with the date and a one-line outcome —\n rows are archived, not deleted, so the history stays auditable.\n \n-\n+\n \n ## Open items\n \n@@ -58,12 +58,12 @@ Durable, cross-session memory of everything still outstanding for this repo: ope\n | #028 | P3 | rec | Runtime error tracking (Sentry or similar) | No error tracking in the repo — production exceptions on `psychiatry.tools`, including how often `RAG_PROVIDER_MODE=auto` silently degrades to source-only, are invisible. Weigh adding `@sentry/nextjs` (dependency + DSN secret + instrumentation) vs cost; alert → chat/issue. Provider-backed; needs explicit sign-off before adding the dependency. | session 2026-07-22 webhook review | 2026-07-22 |\n | #029 | P2 | issue | 12 of 30 answer-quality cases return the fallback stub | run #61 --dump-answers: 12/30 quality cases emit the source_backed_review_fallback boilerplate with answer_sections: [], all grounded with 4-6 citations. Some still PASS targeting because the stub echoes query keywords (the contraindication/document_lookup matchers need only a keyword), so the targeting metric MASKS the problem for those intents. Superset of #018 — fix in the extractive composer, validate with the provider-backed answer eval. | run #61 dump artifact; session 2026-07-22 | 2026-07-22 |\n | #030 | P3 | issue | Wide-tier alias lets one doc satisfy both comparison slots | In src/lib/eval-document-matching.ts, \"Admission to Discharge for Mental Health Inpatients\" appears in BOTH the AdmissionCommunityPts and Discharge alias lists, so a single document can satisfy both expectedFiles slots and make allHit true — a latent false-pass on admission-discharge cases. Not firing today (that doc is not in the failing top-5) but it would mask a real miss. Tighten the tables so one doc cannot fill both sides. | src/lib/eval-document-matching.ts:32-65; session 2026-07-22 | 2026-07-22 |\n-| #032 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so \"unknown\" ≠ \"bad\" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 |\n-| #033 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same \"unknown ≠ bad\" hazard as #025 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |\n-| #034 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 |\n-| #035 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |\n-| #036 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |\n-| #037 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 |\n+| #031 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so \"unknown\" ≠ \"bad\" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 |\n+| #032 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same \"unknown ≠ bad\" hazard as #031 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |\n+| #033 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 |\n+| #034 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |\n+| #035 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |\n+| #036 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 |\n \n ## Resolved / archive\n \n",{"_462":700,"_441":442,"_464":448},{"_531":701,"_503":691,"_42":702,"_469":703,"_202":535,"_536":-5,"_93":537},"{\"cmd\":\"python3 - <<'PY'\\nfrom pathlib import Path\\np=Path('docs/outstanding-issues.md')\\ns=p.read_text()\\n# Ensure only governance deferral rows are renumbered downward one.\\nrepls={\\n'':'',\\n'| #032 | P3 | rec | Governance ranking weighting: REFUTED, not debt':'| #031 | P3 | rec | Governance ranking weighting: REFUTED, not debt',\\n'| #033 | P3 | rec | Source governance metadata absent from the LLM prompt':'| #032 | P3 | rec | Source governance metadata absent from the LLM prompt',\\n'| #034 | P3 | issue | Answer cache can serve stale governance metadata':'| #033 | P3 | issue | Answer cache can serve stale governance metadata',\\n'| #035 | P3 | rec | Threshold-conflict detection covers only 3 params':'| #034 | P3 | rec | Threshold-conflict detection covers only 3 params',\\n'| #036 | P3 | rec | No explicit `is_public` visibility flag on documents':'| #035 | P3 | rec | No explicit `is_public` visibility flag on documents',\\n'| #037 | P3 | rec | D5 trust-cap-all-claims flag parked OFF':'| #036 | P3 | rec | D5 trust-cap-all-claims flag parked OFF',\\n'as #025 — on a partially-enriched corpus':'as #031 — on a partially-enriched corpus',\\n}\\nfor a,b in repls.items():\\n if a not in s:\\n raise SystemExit(f'missing: {a}')\\n s=s.replace(a,b,1)\\np.write_text(s)\\nPY\\nnpx prettier --write docs/outstanding-issues.md\\ngit diff -- docs/outstanding-issues.md | sed -n '1,220p'\",\"workdir\":\"/workspace/Database\",\"yield_time_ms\":30000,\"max_output_tokens\":30000}","fc_0ae0f51be7c974a3016a60872442a08194bda9cbe6930ceb57",{"_474":448},{"_462":705,"_441":442,"_464":448},{"_465":-5,"_486":706,"_42":707,"_469":708,"_490":709,"_93":492},"gAAAAABqYIckzWUeaXsedohOEKQajIWxO670ciTmWTBXVnCrhNWd4E8ibTYa-sjieiav0qjwRbkh2hGVvyd1WvKTYrLd80zpoy8qSCeC-K22ErC3fPwpgSGndWaij_RBP1xqsQK5-IKG2VfJ3D6YXab2eqxBUZOjQQJyI6aTX_LDdmSKSSEQC_iCR9htPC4MqtbGuwnlQ15gUmK9ifUvBxNwbcQoP6F7-FvlaW8J_CAr_rhO0zHgQXJMtrbnRQj4tqibnoTiG-7fyhCYgOcEfMIpt-pfxt2IUMcu0-Q2Y58X9eB9MYIQsSuJbT09FEl7VJlLSXhwXWGOhUF4EqHlGRkEFa7NgOWZq4d3Yzdq-UksgvBwr_h88jqWfx71n1CXPAOQu1RBgJ7o0_Czp4BxuiOtnio34VBTzH4hAMVY6Gji4Prh6KXGLkKmyy-G8ij2nbxpA1vtqvjgsBYeSqyyxtb9MY6MO1hfYQS02-d4np04mgVvasw6e7txENf82k1K4oVI992RuKvrURE4FmbqnIx-GPST-rtIk8pzTPKGVxIE2pNoe5Hcn5ud-CE7qu0_M5TcAqbM9JcsSDCO29t_P2D-gwWu47qOVAiYt0437UyFJW2uDXZIbsc3dRxD4YKinrwVplZnyckKVyBizs9q_vI8PUiiKBlmzo9LFs7awT1Ru_0Z1C2YTEAZuhvKFSTKQDZlWh4rWwZBqgmTRW5-F1dhh0-6UKcIoi5lOuTaNY7_wiNgL0Qi9mvpgy-B-DUBUrpTiyurXc3u1B7rzgfAu6id5b7OwjW9_2iirPgFxIZ4zwjnqgWw_sozIHhcby7YmKauxKPDcKYYnegArcF_WC3NYhYAWQouAvvgmUokcEuuKkiU--pr_1Kd_DX4NDLeLPgIflwZRl37FJ-gbIJVzpqurgdsPY9aT1UN0uaHhs4qPREpCnXihYgoIGYHh-lfwnAQ26kzU2_Swti4J_4ulGuLRb4kF3CVlyJ8pT1MehBARO6osIBwogaqpDXXDW5zpVDgQoP98E7lbs8Y4kLBoq2uu-Fdjj_gurS0896YKASRsqNwBtkM3KLvoiRh-Zg5UsHbLuscdPRaWzV0mDJ0Ua0O_y60bLw1qgEPzd8fDoqfQXrgCkZ4v8fuhkZn5-c_G-86-842ZSAC5gyExBvCEFw9LuNHvbrxYfeYovuG-gkyY6xtN5rAtaC9AWWTsKTjzfrg6UfMSPCuZjj8wfxeyJdWlATdbL4bmHahPSjzIxa3TWtDU_OKT8513L23o-IO79EG0zpdo77L-g1-vaW54CpKduf9rjGAy4LJcQgCYy1V6iUJXboga6r8lTG_gzljWKcu9TqkTRTFIhdUY_ZSwdbTgfESKipMGUo10tUdFYrYXfsYHGUlkdaDp0qJZE6HTBwHIcZ9w3-zQW_nAzxAN4m2VHNmZUzUgZitwFd137iggXwBK88NpZ2AJmllSB-sPiU0uAIUGGGePAigInzekvfc7rr0YsRr7W6dLE9mKuj4UNPmguNtKfpfCjvJPH7hbL09iXQ7TggXVDsOuLdvva4ofVyAVHPjRCoqyWR_T6fT7SvJF30Q-1f2G9nmeTY2Z8XtGQeRSLXB_v3KtftL3b9iMj5Cd-vIePfXXGqUDh13t9X83ZP1zf7B8XpgdtHgBB18V6NyXF69MSCHYlVlcez-Yz1oqyl9qt7xBY0ND2Ist5_7MBPNZZWe0HQH9O1nu-1_j5MpCRzwsWFgJCVG0n6IyczuLzte_armpIQTSrqhKTeSl511LtfcwIIAHVyoFE6p-Wg-HfHnWzw36IMwbEhCbEiPqiu6Mcey5WBUuwpA8YksAqj1GTTk-YaDT031eg0MMflxahXPpr6IRxmV4yzK0eLxQmJ2OtlGwQYyk7rzSpLFvXmTyEaH2-z-fkDc-56AxTlrk_t579e2pHxo1M8hMGNoJCZdXCUr9aPnTG9iROnOyjMuQaYATrAQL73c5r8xpMqwY9nEpT078VBbduPc1lVYJPF7qWI8B04wGTjc9G1biLtlPHeDoprCt6umwPjSMF9p7qodwC1gsMY0PCDJI458faVea7sjguocYf8ZT8SbB4hZPAfYuNtqj0HB5eX0ssyz7M_NylkHGN8Wj53x2CAVz3K2nJZsQTTk9dk4TjWW6VJgL_4y9SBdSmuJcqyOJyQ4nmCZBStIE4iclpLCYcKSa-Xy9iSWMbZSw_iQhvp39ar0T8NocM8WQMasK5DsvvtK5zvad7NfDrK0EDGCgBuzzjhOxAyjq7G0djlIYN-_26aRGFrCtB301kA5PsI1UL5oPZv8Nt6G6tl6-pTrL4xj3dU8nYF7H9bGrJH8oWgbHvlJsITdRXZfinxP1eNFafkM6Ncr78WBp7bB1x6YPcpVVHU1XtwYWjb_UgMo-R5I-oMDQcuiGN8lzi22Gvom4nYrEYKOkrQS9M7Uygdm5yPnUsdVa-rqbza6B98PRo-VQYKJN2FA9eyWj7uj1TKSxdpgMTvRhofwtTw0ubMy9PjU1J8fup15qk5RO6mlIz4xD9xh5j5CkcnqE3YtN2VqzUp8BO3STezwlKxmkL_S62qml1YUTuZUpb0hEajJdIeJ50wpit1rv3g5w6dY-9ShZDxVWmsE7KGCBeXpwhzH5G5XessIoYN_e7I3-3YqaxKjH3GpPRlsEB7P54dnWhvDuMq4JTEc6j4q7tqxFvG2x6G0z6maTrHRrQC5k_x1qMCWQxyycmyUshK8aAxN9L7BmjsftJvBzo2kJ88LX17sGrhYvhKKlXq06O9BkW9QswO2pHOJTY9rUmAwDCcQTl8m6hByz4SyX3jfKu-s3XW3g1MpE9jEUSVtqwoy42-eK95-RT9Oc1cbBTXLTN4-lu5Of5XZIo5qqgB49HhzT3djzQE-v6CTF3yOu1E20XuH2kOfITrwQX_U80mzJxmT7PSgHD3cBQFb","rs_0ae0f51be7c974a3016a60871b77d48194ac4ec1c157fb27a0",{"_474":448},[710,711],{"_46":713,"_93":495},{"_46":712,"_93":495},"**Renumbering and fixing ledger references**","**Planning conflict resolution commit**",{"_480":715,"_462":716,"_441":442,"_464":448},1784710948278,{"_465":717,"_42":707,"_490":718,"_93":492},[],[713,712],{"_462":720,"_441":442,"_464":448},{"_503":721,"_42":-5,"_469":722,"_506":723,"_93":508},"call_QJlTKzx84aOE87yfDPMpwuQg",{"_474":448},"Chunk ID: dfa71e\nWall time: 0.0026 seconds\nProcess exited with code 0\nOriginal token count: 25028\nOutput:\nWarning: truncated output (original token count: 25028)\nTotal output lines: 88\n\n rows are archived, not deleted, so the history stays auditable.\n\n\n\n## Open items\n\n| ID | Pri | Type | Summary | Detail / next action | Source | Added |\n| ---- | --- | ----- | ------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n| #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 |\n| #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 |\n| #006 | P2 | issue | Globe \"Language & region\" button had no handler | Fixed in this PR to the disabled \"Coming soon\" placeholder convention (`aria-disabled` + sr-only note). Wire to a real language/region settings screen when one exists, then drop the placeholder state. | `src/components/clinical-dashboard/master-search-header.tsx:1829`; session 2026-07-21 | 2026-07-21 |\n| #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 |\n| #009 | P3 | rec | Confirm `/api/jobs` is intentionally server/ops-only | No client `fetch()` reaches `/api/jobs` (only tests import it). Confirm it is a deliberate ops/manual surface; if abandoned, remove it. | `src/app/api/jobs/route.ts` | 2026-07-21 |\n| #010 | P3 | task | Un-built \"Coming soon\" controls across forms/favourites | ~10 disabled placeholders (forms refine/reset, favourites sort/add/new-set, move-to-set, remove-favourite). Correctly flagged (`aria-disabled` + \"Coming soon\"), not defects — wire when the underlying features land. | `forms-search-results-page.tsx`; `favourites-hub.tsx`; `favourites-command-library-page.tsx` | 2026-07-21 |\n| #011 | P3 | task | Auth DB-connection allocation is operator-only | Supabase Auth (GoTrue) is capped at ~10 absolute DB connections (Supabase perf advisor). Switch to **percentage-based** allocation in the Supabase **dashboard** before the first compute scale-up — **not settable via SQL/MCP** (operator-owned). Verify via a staging soak + an approval-gated read-only advisor re-check. | `docs/auth-connection-cap-runbook.md`; `docs/process-hardening.md` (Known follow-up debts) | 2026-07-21 |\n| #012 | P3 | rec | Slim the lazy cross-mode differentials chunk | `cross-mode-differentials.ts` is dynamically imported (correctly code-split **out** of the initial/dashboard bundle — verified), but it pulls the full ~860 KB different…15028 tokens truncated… | session 2026-07-21 (measurement pass) | 2026-07-21 |\n| #018 | P2 | task | Monitoring retrieval-depth trio misses schedules | quality-lithium-monitoring-range, quality-antipsychotic-metabolic-monitoring, quality-adhd-medication-monitoring still fail targeting (\"no schedule/interval\") after the #1040 gate parity — their live chunk sets apparently surface no admissible schedule sentence. Diagnose via read-only chunk queries + run #61 dump artifact (30d retention) to split corpus-content vs retrieval-depth vs fact-extraction; fix shape TBD after diagnosis. A retrieval-side fix is a protected surface (canary pair, fresh ~$2-4 authorization). | run #61 targeting misses; branch-review-ledger 2026-07-21 | 2026-07-21 |\n| #019 | P2 | task | Comparison-class coverage: admission doc never in top-5 | admission-discharge-comparison misses its expected admission-side doc on every canary (#57-#61) — top-5 carries discharge-planning + unrelated docs only. Same \"why doesn't retrieval surface X\" species as #018; diagnose jointly. Ground-truth already widened (#1020); the residual is genuine comparison-class retrieval coverage. | runs #57-#61; PR #1020 replay verdict | 2026-07-21 |\n| #020 | P3 | task | Validate eval:quality cost readout post-fix | The estimator fix landed in PR #1050 (zero-usage cases count $0 with rates configured; provider-attempted cases with missing usage stay n/a). Remaining action: confirm the next canary run prints a real dollar figure in Answer Metrics, then archive this row. | PR #1050; run #60/#61 Answer Metrics tables | 2026-07-21 |\n| #021 | P3 | rec | E-3d H2 residual: strong/comparison generation discards | approx. 6 generation attempts per full 44-case run still fail the final quality gate and fall to extractive on strong-route comparison/complex shapes (the designed-conservative outcome). PARKED: weakest cost/benefit on the queue — a wave (approx. $2-4 pair + reviewer cycle) to shave seconds off a few hard cases. Revisit only if latency/waste complaints or a cheaper lever appears. | E-3c design record; runs #59-#61 diagnostics | 2026-07-21 |\n| #022 | P2 | task | Source-governance metadata refresh (operator) | Governance warning rate ~0.84 across canaries: stale/review-required/unknown source metadata on most top results. Operator work (document review-status attestation in the app), not a code defect. Next action: generate the prioritized refresh worklist ($0 read-only) and schedule a metadata pass. | runs #57-#61 Source Governance tables; docs/observability-slos.md | 2026-07-21 |\n| #023 | P3 | task | Read Sunday 2026-07-26 scheduled-run artifacts | The 18:00 UTC scheduled runs deliver three free datapoints at once: first full-44 weekly canary (validates the #1044 ANSWER_CASE_LIMIT raise), browser-matrix flake second datapoint (webkit ui-route-coverage now reproduced + root-caused 2026-07-22 → see #024; firefox ui-formulation:91 still awaits a datapoint), and the irrelevant@10 labeling-audit artifact (§3.1 human-decision class). Read all three, then disposition. | sessions 2026-07-20/21; branch-review-ledger convergence notes | 2026-07-21 |\n| #024 | P3 | issue | WebKit e2e `_rsc`-prefetch access-control-checks errors | verify:release:offline on `main` ce32fe170 (2026-07-22) reproduced #023's webkit clause: **6/6 deterministic** failures in `tests/ui-route-coverage.spec.ts` (Therapy Compass; DSM home/comparison; Specifier comparison/map; Differential stream), each a `pageerror … ?_rsc=… due to access control checks` on Next.js RSC prefetch — Chromium + Firefox clean. Not merge-blocking (required gate `test:e2e:pr` is chromium-only; the full webkit matrix is advisory/release-time). Most likely a Playwright route-interception × WebKit interaction, not a Safari user defect. Next: decide (a) allow/mock the `_rsc` routes for the `webkit` e2e project, or (b) confirm real Safari impact — before trusting the full-matrix webkit gate at release. NB the 2 other webkit fails (`ui-stress:412`, `ui-universal-search:210`) passed on isolated re-run = true flake. | session 2026-07-22 (verify:release:offline, `main` ce32fe170); refines #023 | 2026-07-22 |\n| #025 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so \"unknown\" ≠ \"bad\" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 |\n| #026 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same \"unknown ≠ bad\" hazard as #025 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |\n| #027 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 |\n| #028 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |\n| #029 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |\n| #030 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 |\n\n## Resolved / archive\n\nMove resolved rows here with the resolution date and a one-line outcome. Keep them — do not delete.\n\n| ID | Type | Summary | Outcome | Resolved |\n| ---- | ---- | ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n| #003 | task | Staging tenancy release evidence outstanding | Ran GitHub Action and validated isolation | 2026-07-21 |\n| #002 | task | Process-ownership fix not yet isolated on `main` | Fixed process isolation using child.pid termination | 2026-07-21 |\n| #008 | rec | Dead href builders in `document-flow-routes.ts` | Not dead code (false positive): `documentReaderHref`/`documentEvidenceHref` are live via the mock wrappers in `src/components/document-search-mockups.tsx` + `src/components/master-document-flow-mockups.tsx` (rendered under `src/app/mockups/document-search/`) and covered by `tests/document-flow-routes.test.ts`; removing breaks the build. Only the production non-mock hrefs are unlinked from prod UI — a wiring gap, not dead code. | 2026-07-22 |\n",{"_480":725,"_462":726,"_441":442,"_464":448},1784710938109,{"_512":727,"_514":728,"_516":729,"_518":519,"_446":349,"_520":32,"_42":721,"_521":730,"_523":524,"_455":114,"_93":525}," rows are archived, not deleted, so the history stays auditable.\n\n\n\n## Open items\n\n| ID | Pri | Type | Summary | Detail / next action | Source | Added |\n| ---- | --- | ----- | ------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n| #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 |\n| #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 |\n| #006 | P2 | issue | Globe \"Language & region\" button had no handler | Fixed in this PR to the disabled \"Coming soon\" placeholder convention (`aria-disabled` + sr-only note). Wire to a real language/region settings screen when one exists, then drop the placeholder state. | `src/components/clinical-dashboard/master-search-header.tsx:1829`; session 2026-07-21 | 2026-07-21 |\n| #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 |\n| #009 | P3 | rec | Confirm `/api/jobs` is intentionally server/ops-only | No client `fetch()` reaches `/api/jobs` (only tests import it). Confirm it is a deliberate ops/manual surface; if abandoned, remove it. | `src/app/api/jobs/route.ts` | 2026-07-21 |\n| #010 | P3 | task | Un-built \"Coming soon\" controls across forms/favourites | ~10 disabled placeholders (forms refine/reset, favourites sort/add/new-set, move-to-set, remove-favourite). Correctly flagged (`aria-disabled` + \"Coming soon\"), not defects — wire when the underlying features land. | `forms-search-results-page.tsx`; `favourites-hub.tsx`; `favourites-command-library-page.tsx` | 2026-07-21 |\n| #011 | P3 | task | Auth DB-connection allocation is operator-only | Supabase Auth (GoTrue) is capped at ~10 absolute DB connections (Supabase perf advisor). Switch to **percentage-based** allocation in the Supabase **dashboard** before the first compute scale-up — **not settable via SQL/MCP** (operator-owned). Verify via a staging soak + an approval-gated read-only advisor re-check. | `docs/auth-connection-cap-runbook.md`; `docs/process-hardening.md` (Known follow-up debts) | 2026-07-21 |\n| #012 | P3 | rec | Slim the lazy cross-mode differentials chunk | `cross-mode-differentials.ts` is dynamically imported (correctly code-split **out** of the initial/dashboard bundle — verified), but it pulls the full ~860 KB differentials snapshot (~125 KB gzip lazy chunk) just to build a tiny `{slug,title,clinicalHinge}` + presentations + aliases catalog. A precomputed lightweight index (generator + drift check, like the `specifiers-content` split / medications `fields=index`) would cut that lazy chunk ~5–10×. Not a bundle leak — an M-effort slim. | `src/lib/cross-mode-differentials.ts`; `src/components/clinical-dashboard/cross-mode-links.tsx:150`; session 2026-07-21 (build:analyze) | 2026-07-21 |\n| #013 | P3 | rec | Route-chunk + mockup catalogue JSON weight | `build:analyze`: `/specifiers` ships `specifiers-search-index.json` (~180 KB parsed), `/forms` ships `forms-catalog.json` (~132 KB), `/formulation` ships `formulation-content.json` (~52 KB, client-side local search — needs index/full split or a search endpoint, architectural). All route-scoped (not initial bundle). Also `*-mockups.tsx` (~100 KB across chunks) build though `/mockups` 404s in prod — exclude from the prod artifact. | session 2026-07-21 (build:analyze) | 2026-07-21 |\n| #014 | P3 | rec | Realize the `next/image` win on signed previews | `next.config` `images` (AVIF + `*.supabase.co` `remotePatterns` pinned to the project host, from #1024) is currently inert — signed document/image previews still render as raw ``. Route them through `next/image` to actually get AVIF + lazy optimization. | #1024; `src/components/clinical-dashboard/signed-image.tsx`; session 2026-07-21 | 2026-07-21 |\n| #016 | P3 | rec | \"Big but not easy\" structural + motion perf | Deferred larger levers: (a) nonce-CSP forces every product route to `ƒ Dynamic` (zero static generation) — evaluate Partial Prerendering / static shells for the static clinical catalogues (DSM/differentials/therapy/specifiers/formulation); (b) sidebar expand/collapse animates `grid-template-columns` (biggest smoothness cost, motion-gated — needs a transform-overlay rethink); (c) Therapy Compass fetches 692 KB / 2.5 MB JSON client-side (defer until interaction + confirm brotli); (d) settings/setup/admin dialogs static-imported into the home chunk (`next/dynamic` them). | session 2026-07-21 (build route table + design audit) | 2026-07-21 |\n| #017 | P3 | task | Field Web-Vitals baseline via live Lighthouse | In-sandbox runtime vitals were blocked (prod server hard-requires Supabase secrets; dev-mode CLS measured excellent at 0.00–0.04, content-first pages 0.000). Run Lighthouse against `psychiatry.tools` for real LCP/INP/CLS to prioritize #012–#016 by measured impact rather than reasoning. | session 2026-07-21 (measurement pass) | 2026-07-21 |\n| #018 | P2 | task | Targeting misses are answer-composition, NOT retrieval-depth | DIAGNOSED 2026-07-22 from the run #61 --dump-answers artifact: retrieval is healthy (grounded=true, 4-6 citations, high_confidence_extractive_retrieval). lithium + adhd return the source_backed_review_fallback boilerplate stub (\"a full written answer could not be completed just now\") with answer_sections: []; metabolic returns a mangled 73-char fragment (\"The guidance for metabolic is that compliance, monitoring and evaluation.\"). NOT corpus-content, NOT retrieval-depth. Root cause is the extractive composer (src/lib/rag/rag-extractive-answer.ts). Do NOT widen the eval matcher (rag-eval-cases.ts:192) — the stub contains monitoring/maintenance/level/range, so widening would make stubs falsely PASS. Fix is a protected-surface answer-behaviour change (provider-backed answer-quality eval + approval). | run #61 dump artifact; session 2026-07-22 | 2026-07-21 |\n| #019 | P2 | task | Admission doc dropped by answer-stage re-rank, not retrieval | DIAGNOSED 2026-07-22 from run #61 artifacts: retrieval coverage is PERFECT — golden documentRecallAt5=1, reciprocalRankAt10=1, missingDocumentSubstrings=[], with \"Admission of Community Patients (AKG).pdf\" at raw rank 4-5 (matches the strict alias AdmissionCommunityPts). The answer stage then DROPS it from answer.sources top-5 and promotes \"Falls Prevention and Management (AKG).pdf\" (raw rank 8, off-topic) in its place. So the defect is post-retrieval evidence balancing (cross-document-synthesis.ts balanceCrossDocumentResults / rankAnswerEvidence), NOT comparison-class retrieval coverage. Separately: nothing guarantees BOTH sides of a comparison are represented — comparison_multi_document_gate (rag.ts:2043) is satisfied by any 2 distinct docs. Fix = protected surface (canary pair + ~$2-4 approval). | run #61 artifacts; session 2026-07-22 | 2026-07-21 |\n| #020 | P3 | task | Validate eval:quality cost readout post-fix | The estimator fix landed in PR #1050 (zero-usage cases count $0 with rates configured; provider-attempted cases with missing usage stay n/a). Remaining action: confirm the next canary run prints a real dollar figure in Answer Metrics, then archive this row. | PR #1050; run #60/#61 Answer Metrics tables | 2026-07-21 |\n| #021 | P3 | rec | E-3d H2 residual: strong/comparison generation discards | approx. 6 generation attempts per full 44-case run still fail the final quality gate and fall to extractive on strong-route comparison/complex shapes (the designed-conservative outcome). PARKED: weakest cost/benefit on the queue — a wave (approx. $2-4 pair + reviewer cycle) to shave seconds off a few hard cases. Revisit only if latency/waste complaints or a cheaper lever appears. | E-3c design record; runs #59-#61 diagnostics | 2026-07-21 |\n| #022 | P2 | task | Source-governance metadata refresh (operator) | Governance warning rate ~0.84 across canaries: stale/review-required/unknown source metadata on most top results. Operator work (document review-status attestation in the app), not a code defect. Next action: generate the prioritized refresh worklist ($0 read-only) and schedule a metadata pass. | runs #57-#61 Source Governance tables; docs/observability-slos.md | 2026-07-21 |\n| #023 | P3 | task | Read Sunday 2026-07-26 scheduled-run artifacts | The 18:00 UTC scheduled runs deliver three free datapoints at once: first full-44 weekly canary (validates the #1044 ANSWER_CASE_LIMIT raise), browser-matrix flake second datapoint (webkit ui-route-coverage now reproduced + root-caused 2026-07-22 → see #024; firefox ui-formulation:91 still awaits a datapoint), and the irrelevant@10 labeling-audit artifact (§3.1 human-decision class). Read all three, then disposition. | sessions 2026-07-20/21; branch-review-ledger convergence notes | 2026-07-21 |\n| #024 | P3 | issue | WebKit e2e `_rsc`-prefetch access-control-checks errors | verify:release:offline on `main` ce32fe170 (2026-07-22) reproduced #023's webkit clause: **6/6 deterministic** failures in `tests/ui-route-coverage.spec.ts` (Therapy Compass; DSM home/comparison; Specifier comparison/map; Differential stream), each a `pageerror … ?_rsc=… due to access control checks` on Next.js RSC prefetch — Chromium + Firefox clean. Not merge-blocking (required gate `test:e2e:pr` is chromium-only; the full webkit matrix is advisory/release-time). Most likely a Playwright route-interception × WebKit interaction, not a Safari user defect. Next: decide (a) allow/mock the `_rsc` routes for the `webkit` e2e project, or (b) confirm real Safari impact — before trusting the full-matrix webkit gate at release. NB the 2 other webkit fails (`ui-stress:412`, `ui-universal-search:210`) passed on isolated re-run = true flake. | session 2026-07-22 (verify:release:offline, `main` ce32fe170); refines #023 | 2026-07-22 |\n| #025 | P2 | task | Activate the three webhooks (operator secrets) | Merged (#968) + deployed but inert — verified live: `POST /api/webhooks/railway` returns `503 webhook_not_configured`. To turn on: (1) Railway → set `RAILWAY_WEBHOOK_SECRET` + add the `?token=…` webhook URL; (2) the chat URLs `SLACK_WEBHOOK_URL`/`DISCORD_WEBHOOK_URL` must be set in BOTH places — the Railway **app/server env** (the receiver forwards deploy alerts via `postChatNotification`, which reads server env, so repo-secret-only leaves the Railway webhook authenticated but returning `delivered:false`) AND as **GitHub repo secrets** (the CI-failure workflow reads `secrets.*`); (3) `SUPABASE_INGESTION_WEBHOOK_SECRET`. Each fails closed until set, so this is pure ops. See docs/webhooks.md. | session 2026-07-22; PR #968; docs/webhooks.md | 2026-07-22 |\n| #026 | P2 | task | Wire the Supabase document-change trigger | The `/api/webhooks/supabase/document-change` receiver is live but nothing calls it. The trigger (`notify_document_change_ingestion_webhook()` + `documents_ingestion_webhook`, SQL in docs/webhooks.md §3) must land as a **committed migration** — drift covers functions/triggers, so applying raw SQL to live would fail `check:drift`: add the migration, reconcile `supabase/schema.sql`, run `npm run drift:manifest` (needs a local Supabase container), then deploy. Operator-applied live state is the Vault secret (`select vault.create_secret('','ingestion_webhook_secret')`) + the base-URL GUC `app.ingestion_webhook_base_url`, which is MANDATORY per environment (the trigger no-ops when it is unset, so `reindex_requested` flips never enqueue — there is no production default). Trigger is `AFTER UPDATE` on `reindex_requested` only — NOT `INSERT` (an INSERT-fired webhook can beat the upload route's own job insert, which then deletes its just-created doc → intermittent upload failures); external inserts set `reindex_requested=true` to be picked up. Note delivery is at-most-once (pg_net has no retry) and there is NO built-in recovery (automatic or manual) for a dropped insert — neither the autopilot nor `scripts/reindex.ts` sweeps `queued` docs with no job (`hasIncompleteDocumentsWithoutOpenJobs` requires `queuedDocuments === 0`). External imports must insert then issue a SEPARATE UPDATE flipping `reindex_requested=true` (an insert with the flag pre-set won't fire the AFTER UPDATE trigger). The app upload path is NOT a guarantee either: it inserts the `documents` row then the `ingestion_jobs` row as two separate non-atomic calls (rollback only on a job-insert error), so a crash/timeout between them strands the same queued-without-job row nothing sweeps. The only true guarantees are an atomic enqueue (document + job in one transaction/RPC) or a scheduled queued-without-job sweep. Until applied, webhook #5 never fires. | session 2026-07-22; docs/webhooks.md §3 | 2026-07-22 |\n| #027 | P3 | rec | External uptime monitor independent of GitHub/Railway | `live-domain-monitor.yml` runs on GitHub's cron, so it won't run in exactly the outage it should catch (Actions or the deploy itself down). Add an off-platform synthetic monitor (UptimeRobot / Better Stack / Checkly) hitting `/api/health` with a webhook alert. Provider setup, not code. | session 2026-07-22 webhook review | 2026-07-22 |\n| #028 | P3 | rec | Runtime error tracking (Sentry or similar) | No error tracking in the repo — production exceptions on `psychiatry.tools`, including how often `RAG_PROVIDER_MODE=auto` silently degrades to source-only, are invisible. Weigh adding `@sentry/nextjs` (dependency + DSN secret + instrumentation) vs cost; alert → chat/issue. Provider-backed; needs explicit sign-off before adding the dependency. | session 2026-07-22 webhook review | 2026-07-22 |\n| #029 | P2 | issue | 12 of 30 answer-quality cases return the fallback stub | run #61 --dump-answers: 12/30 quality cases emit the source_backed_review_fallback boilerplate with answer_sections: [], all grounded with 4-6 citations. Some still PASS targeting because the stub echoes query keywords (the contraindication/document_lookup matchers need only a keyword), so the targeting metric MASKS the problem for those intents. Superset of #018 — fix in the extractive composer, validate with the provider-backed answer eval. | run #61 dump artifact; session 2026-07-22 | 2026-07-22 |\n| #030 | P3 | issue | Wide-tier alias lets one doc satisfy both comparison slots | In src/lib/eval-document-matching.ts, \"Admission to Discharge for Mental Health Inpatients\" appears in BOTH the AdmissionCommunityPts and Discharge alias lists, so a single document can satisfy both expectedFiles slots and make allHit true — a latent false-pass on admission-discharge cases. Not firing today (that doc is not in the failing top-5) but it would mask a real miss. Tighten the tables so one doc cannot fill both sides. | src/lib/eval-document-matching.ts:32-65; session 2026-07-22 | 2026-07-22 |\n\n## Resolved / archive\n\nMove resolved rows here with the resolution date and a one-line outcome. Keep them — do not delete.\n\n| ID | Type | Summary | Outcome | Resolved |\n| ---- | ---- | ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n| #003 | task | Staging tenancy release evidence outstanding | Ran GitHub Action and validated isolation | 2026-07-21 |\n| #002 | task | Process-ownership fix not yet isolated on `main` | Fixed process isolation using child.pid termination | 2026-07-21 |\n| #008 | rec | Dead href builders in `document-flow-routes.ts` | Not dead code (false positive): `documentReaderHref`/`documentEvidenceHref` are live via the mock wrappers in `src/components/document-search-mockups.tsx` + `src/components/master-document-flow-mockups.tsx` (rendered under `src/app/mockups/document-search/`) and covered by `tests/document-flow-routes.test.ts`; removing breaks the build. Only the production non-mock hrefs are unlinked from prod UI — a wiring gap, not dead code. | 2026-07-22 |\n\nPR original eb2...\n rows are archived, not deleted, so the history stays auditable.\n\n\n\n## Open items\n\n| ID | Pri | Type | Summary | Detail / next action | Source | Added |\n| ---- | --- | ----- | ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n| #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 |\n| #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 |\n| #006 | P2 | issue | Globe \"Language & region\" button had no handler | Fixed in this PR to the disabled \"Coming soon\" placeholder convention (`aria-disabled` + sr-only note). Wire to a real language/region settings screen when one exists, then drop the placeholder state. | `src/components/clinical-dashboard/master-search-header.tsx:1829`; session 2026-07-21 | 2026-07-21 |\n| #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 |\n| #009 | P3 | rec | Confirm `/api/jobs` is intentionally server/ops-only | No client `fetch()` reaches `/api/jobs` (only tests import it). Confirm it is a deliberate ops/manual surface; if abandoned, remove it. | `src/app/api/jobs/route.ts` | 2026-07-21 |\n| #010 | P3 | task | Un-built \"Coming soon\" controls across forms/favourites | ~10 disabled placeholders (forms refine/reset, favourites sort/add/new-set, move-to-set, remove-favourite). Correctly flagged (`aria-disabled` + \"Coming soon\"), not defects — wire when the underlying features land. | `forms-search-results-page.tsx`; `favourites-hub.tsx`; `favourites-command-library-page.tsx` | 2026-07-21 |\n| #011 | P3 | task | Auth DB-connection allocation is operator-only | Supabase Auth (GoTrue) is capped at ~10 absolute DB connections (Supabase perf advisor). Switch to **percentage-based** allocation in the Supabase **dashboard** before the first compute scale-up — **not settable via SQL/MCP** (operator-owned). Verify via a staging soak + an approval-gated read-only advisor re-check. | `docs/auth-connection-cap-runbook.md`; `docs/process-hardening.md` (Known follow-up debts) | 2026-07-21 |\n| #012 | P3 | rec | Slim the lazy cross-mode differentials chunk | `cross-mode-differentials.ts` is dynamically imported (correctly code-split **out** of the initial/dashboard bundle — verified), but it pulls the full ~860 KB differentials snapshot (~125 KB gzip lazy chunk) just to build a tiny `{slug,title,clinicalHinge}` + presentations + aliases catalog. A precomputed lightweight index (generator + drift check, like the `specifiers-content` split / medications `fields=index`) would cut that lazy chunk ~5–10×. Not a bundle leak — an M-effort slim. | `src/lib/cross-mode-differentials.ts`; `src/components/clinical-dashboard/cross-mode-links.tsx:150`; session 2026-07-21 (build:analyze) | 2026-07-21 |\n| #013 | P3 | rec | Route-chunk + mockup catalogue JSON weight | `build:analyze`: `/specifiers` ships `specifiers-search-index.json` (~180 KB parsed), `/forms` ships `forms-catalog.json` (~132 KB), `/formulation` ships `formulation-content.json` (~52 KB, client-side local search — needs index/full split or a search endpoint, architectural). All route-scoped (not initial bundle). Also `*-mockups.tsx` (~100 KB across chunks) build though `/mockups` 404s in prod — exclude from the prod artifact. | session 2026-07-21 (build:analyze) | 2026-07-21 |\n| #014 | P3 | rec | Realize the `next/image` win on signed previews | `next.config` `images` (AVIF + `*.supabase.co` `remotePatterns` pinned to the project host, from #1024) is currently inert — signed document/image previews still render as raw ``. Route them through `next/image` to actually get AVIF + lazy optimization. | #1024; `src/components/clinical-dashboard/signed-image.tsx`; session 2026-07-21 | 2026-07-21 |\n| #016 | P3 | rec | \"Big but not easy\" structural + motion perf | Deferred larger levers: (a) nonce-CSP forces every product route to `ƒ Dynamic` (zero static generation) — evaluate Partial Prerendering / static shells for the static clinical catalogues (DSM/differentials/therapy/specifiers/formulation); (b) sidebar expand/collapse animates `grid-template-columns` (biggest smoothness cost, motion-gated — needs a transform-overlay rethink); (c) Therapy Compass fetches 692 KB / 2.5 MB JSON client-side (defer until interaction + confirm brotli); (d) settings/setup/admin dialogs static-imported into the home chunk (`next/dynamic` them). | session 2026-07-21 (build route table + design audit) | 2026-07-21 |\n| #017 | P3 | task | Field Web-Vitals baseline via live Lighthouse | In-sandbox runtime vitals were blocked (prod server hard-requires Supabase secrets; dev-mode CLS measured excellent at 0.00–0.04, content-first pages 0.000). Run Lighthouse against `psychiatry.tools` for real LCP/INP/CLS to prioritize #012–#016 by measured impact rather than reasoning. | session 2026-07-21 (measurement pass) | 2026-07-21 |\n| #018 | P2 | task | Monitoring retrieval-depth trio misses schedules | quality-lithium-monitoring-range, quality-antipsychotic-metabolic-monitoring, quality-adhd-medication-monitoring still fail targeting (\"no schedule/interval\") after the #1040 gate parity — their live chunk sets apparently surface no admissible schedule sentence. Diagnose via read-only chunk queries + run #61 dump artifact (30d retention) to split corpus-content vs retrieval-depth vs fact-extraction; fix shape TBD after diagnosis. A retrieval-side fix is a protected surface (canary pair, fresh ~$2-4 authorization). | run #61 targeting misses; branch-review-ledger 2026-07-21 | 2026-07-21 |\n| #019 | P2 | task | Comparison-class coverage: admission doc never in top-5 | admission-discharge-comparison misses its expected admission-side doc on every canary (#57-#61) — top-5 carries discharge-planning + unrelated docs only. Same \"why doesn't retrieval surface X\" species as #018; diagnose jointly. Ground-truth already widened (#1020); the residual is genuine comparison-class retrieval coverage. | runs #57-#61; PR #1020 replay verdict | 2026-07-21 |\n| #020 | P3 | task | Validate eval:quality cost readout post-fix | The estimator fix landed in PR #1050 (zero-usage cases count $0 with rates configured; provider-attempted cases with missing usage stay n/a). Remaining action: confirm the next canary run prints a real dollar figure in Answer Metrics, then archive this row. | PR #1050; run #60/#61 Answer Metrics tables | 2026-07-21 |\n| #021 | P3 | rec | E-3d H2 residual: strong/comparison generation discards | approx. 6 generation attempts per full 44-case run still fail the final quality gate and fall to extractive on strong-route comparison/complex shapes (the designed-conservative outcome). PARKED: weakest cost/benefit on the queue — a wave (approx. $2-4 pair + reviewer cycle) to shave seconds off a few hard cases. Revisit only if latency/waste complaints or a cheaper lever appears. | E-3c design record; runs #59-#61 diagnostics | 2026-07-21 |\n| #022 | P2 | task | Source-governance metadata refresh (operator) | Governance warning rate ~0.84 across canaries: stale/review-required/unknown source metadata on most top results. Operator work (document review-status attestation in the app), not a code defect. Next action: generate the prioritized refresh worklist ($0 read-only) and schedule a metadata pass. | runs #57-#61 Source Governance tables; docs/observability-slos.md | 2026-07-21 |\n| #023 | P3 | task | Read Sunday 2026-07-26 scheduled-run artifacts | The 18:00 UTC scheduled runs deliver three free datapoints at once: first full-44 weekly canary (validates the #1044 ANSWER_CASE_LIMIT raise), browser-matrix flake second datapoint (webkit ui-route-coverage now reproduced + root-caused 2026-07-22 → see #024; firefox ui-formulation:91 still awaits a datapoint), and the irrelevant@10 labeling-audit artifact (§3.1 human-decision class). Read all three, then disposition. | sessions 2026-07-20/21; branch-review-ledger convergence notes | 2026-07-21 |\n| #024 | P3 | issue | WebKit e2e `_rsc`-prefetch access-control-checks errors | verify:release:offline on `main` ce32fe170 (2026-07-22) reproduced #023's webkit clause: **6/6 deterministic** failures in `tests/ui-route-coverage.spec.ts` (Therapy Compass; DSM home/comparison; Specifier comparison/map; Differential stream), each a `pageerror … ?_rsc=… due to access control checks` on Next.js RSC prefetch — Chromium + Firefox clean. Not merge-blocking (required gate `test:e2e:pr` is chromium-only; the full webkit matrix is advisory/release-time). Most likely a Playwright route-interception × WebKit interaction, not a Safari user defect. Next: decide (a) allow/mock the `_rsc` routes for the `webkit` e2e project, or (b) confirm real Safari impact — before trusting the full-matrix webkit gate at release. NB the 2 other webkit fails (`ui-stress:412`, `ui-universal-search:210`) passed on isolated re-run = true flake. | session 2026-07-22 (verify:release:offline, `main` ce32fe170); refines #023 | 2026-07-22 |\n| #025 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so \"unknown\" ≠ \"bad\" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 |\n| #026 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same \"unknown ≠ bad\" hazard as #025 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |\n| #027 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 |\n| #028 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |\n| #029 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |\n| #030 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 |\n\n## Resolved / archive\n\nMove resolved rows here with the resolution date and a one-line outcome. Keep them — do not delete.\n\n| ID | Type | Summary | Outcome | Resolved |\n| ---- | ---- | ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n| #003 | task | Staging tenancy release evidence outstanding | Ran GitHub Action and validated isolation | 2026-07-21 |\n| #002 | task | Process-ownership fix not yet isolated on `main` | Fixed process isolation using child.pid termination | 2026-07-21 |\n| #008 | rec | Dead href builders in `document-flow-routes.ts` | Not dead code (false positive): `documentReaderHref`/`documentEvidenceHref` are live via the mock wrappers in `src/components/document-search-mockups.tsx` + `src/components/master-document-flow-mockups.tsx` (rendered under `src/app/mockups/document-search/`) and covered by `tests/document-flow-routes.test.ts`; removing breaks the build. Only the production non-mock hrefs are unlinked from prod UI — a wiring gap, not dead code. | 2026-07-22 |\n","/bin/bash -lc \"git show origin/main:docs/outstanding-issues.md | sed -n '28,70p'\nprintf '\\\\nPR original eb2...\\\\n'; git show eb2a83c:docs/outstanding-issues.md | sed -n '28,70p'\"",[731],"68544",{"_514":732,"_93":528},"git show origin/main:docs/outstanding-issues.md | sed -n '28,70p'\nprintf '\\nPR original eb2...\\n'; git show eb2a83c:docs/outstanding-issues.md | sed -n '28,70p'",{"_462":734,"_441":442,"_464":448},{"_531":735,"_503":721,"_42":736,"_469":737,"_202":535,"_536":-5,"_93":537},"{\"cmd\":\"git show origin/main:docs/outstanding-issues.md | sed -n '28,70p'\\nprintf '\\\\nPR original eb2...\\\\n'; git show eb2a83c:docs/outstanding-issues.md | sed -n '28,70p'\",\"workdir\":\"/workspace/Database\",\"yield_time_ms\":10000,\"max_output_tokens\":30000}","fc_0ae0f51be7c974a3016a60871901648194bf5c3cb449481183",{"_474":448},{"_462":739,"_441":442,"_464":448},{"_465":-5,"_486":740,"_42":741,"_469":742,"_490":743,"_93":492},"gAAAAABqYIcZwTMVQYuaUcMI0iLLazpWJ75ctMByvrCJE_9TwKFzVJr0i1BCo9rUF3ga9Jxv6mmQiDz2aQd_n3rCZ9pbF3M_AHBUOHiQQ6RfvaWttJ-2t2amT_SnB55uxo_wn0n3BHhJdVwqe6Qb22kr3WE2iQEt3c378GJsqhywTCz0Dd8z_cLgR4g-rJWOGZtGpoerRqHx7rj88UWnVHGtsl0e5JInd77ngx7AKrlVFpR_ZD7uALyi-vKIi5ybb0ehVjt954gVIXTPQup3YyXvhkOIQw4DSw6-kPbqu4u0Rop36NopikacQAVlcp7lk4yJElhfr8zxgdvN47Wtz6gZO0uQ8KLXXdpAEBckrFXwN9HRIaah7qmWl0U28MUlSVy4ihugNpl8fLC4sQiVT-QipqaKaUd3nEBj5QzaDXjJ1zBDIBIyNAvM3BMBE60JrBQl7QyL0AuUYDFs_IjUh2UKXRSAavDt8ulqLJxTk5QHb3mySSR5nmyTM4b1Th_KGJnHn08fP758qVrGG1IrOsBz6LJyLwxbN4PC_gEL_lmKBwjLixYASvV4B4Tcov_LfLi9LbY4x5abUMb4tZqkiB_Qfy-4WBYeNALPWKDLr5MvHKsuYSnQOGS4PYGFVMP-HsBMJhw33z-742KpOLTZhr5AzUKdSVA7NljvAwXvSvc07kmbSXFqBYOGiC57dGeprWvM4OVg84iP7NSBxbJbPr7vjrNeISbyg2Olutj9lVPX6N9HBnEG0z2XNP2y9NcM8XhOPtAdYHWChPzfQS_p6R-2stFGNRblzFzHTK33TKbz3hnClBDtjan8jkHC5AcL_NmLkZ5fEV2r98R-2mmvj4FwFEQZZbXh0okWiu__sUbhAzv5NStbVIwK33e-Bw8YZOId7CjJ63Go_DoYJGP4Jfty-8R5H68EOxxCqq56acnR0OG6CLvSVgJUXyR7_UMxOjeySTZ-kroC4JzBEL5C3jo9whT8h0brciezJeuydKEdYfPdujJ6nyYLy8emDHS1ak6xUlHz6QE9QCP9_UrDA2IX6zByZ3s0fMvDTdFkXt5T4U_CMXpTEYHoOzv5Br5-4RfVDNJnf4JNcxt9UeyA0enFq1kgCAqtekJLjbco7n6YKOrCQ8gv6f1FumsUlALgxrz6mL9kE6q1CzLMW0HFeX97iXjL91vSo4TO-opdXNHIvw9rFGJjPkrBAfON2Hm1yyYhen5K5JlJbl4n3Fgc7arSRN-Y3ppiIsgUHUXBHrz3DhR832pjM84VZGVJno2fVZcR6vyi7in3dt5KhRBEE2SsBlbEZkMvqxfFknSAlAYKuRkaSfMdXtAkpXIcpja5pwoFOIeeSTiJC5h3BjwNJn4kO6WE5HS1t_oy8e7edLF7m6e21KCV03Mfj1HM7Bvwc3k7GkOxgkhuYov1caucdPENqq9YSVrxU5kBtpJEL-OLiyFrNTSGrTP59zn59GsGwW590E-E19zlpIycgMPstarPw494_PcWVMfPfSnFO9CMGizwy1zwPvTgpb5UweWvDycasYn0nZSxOGMaHN3no1XzwEnab9Ipeg==","rs_0ae0f51be7c974a3016a608715f248819481200b23a0973c30",{"_474":448},[744],{"_46":745,"_93":495},"**Inspecting ledger entries for conflicts**",{"_480":747,"_462":748,"_441":442,"_464":448},1784710937020,{"_465":749,"_42":741,"_490":750,"_93":492},[],[745],{"_462":752,"_441":442,"_464":448},{"_503":753,"_42":-5,"_469":754,"_506":755,"_93":508},"call_vJzQU9dc6hblDSPZuVwPhwjM",{"_474":448},"Chunk ID: 3d48c3\nWall time: 0.0022 seconds\nProcess exited with code 0\nOriginal token count: 18866\nOutput:\nWarning: truncated output (original token count: 18866)\nTotal output lines: 117\n\n* 21c1b72 (HEAD -> claude/capture-governance-audit-deferrals, origin/claude/capture-governance-audit-deferrals, work) Merge origin/main; renumber governance deferrals to #032-#037\n|\\ \n| * bf9a508 (origin/main) fix(db): guard hosted migration role usage (#1077)\n| * 1426463 content(therapy): use Therapy mode consistently (#1076)\n| * 6cdfdcc feat(tools): add Safety plan generator as a Tools-page tool (not a mode) (#1068)\n| * 12fe707 docs(issues): correct #018/#019 root causes from run #61 artifact; add #029/#030 (#1074)\n| * 46f143d test(routing): use bound AST navigation evidence (#1075)\n| * 4d5c76c fix(design-system): narrow the theme.ts raw-color exemption to APP_THEME_COLORS (#1070)\n| * 98a1bed docs(webhooks): operator runbook to wire up and activate the webhooks (#1065)\n* | eb2a83c docs(issues): capture source-governance audit deferrals (#025-#030)\n|/ \n* ee0c018 feat(upload): reject over-limit files in the browser before transferring (FV-04) (#1064)\n* 6689529 test(document-viewer): shell-state coverage incl. the private-access gate (TCD-03) (#1063)\n* b2ab6b4 chore(scripts): restore archived operator-probe commands; refresh maturity tracker (L1) (#1053)\n* d84bb90 test(ui): drop duplicate #015 content-first suites superseded by #1057 (#1067)\n* 7dcf514 issues: capture #024 (WebKit _rsc-prefetch e2e errors); annotate #023 repro (#1066)\n* 3e70a22 test(settings): destructive + account flow coverage for SettingsDialog (TCD-05) (#1061)\n* ae950de fix(database): make title-word policy explicitly backend-only (#1062)\n* 658bd4d refactor(design-system): burn down raw-color and legacy-tap contract debt (DSD-02/03) (#1059)\n* 9273fbe test(medication): filter-strip coverage for the prescribing workspace (TCD-01) (#1060)\n* 737c2e8 fix(ui): correct invalid disabled:file variant on the upload file-input (#1056)\n* 50762ad docs(issues): archive #004 as obsolete (rescue target gone; 2/3 already on main) (#1055)\n* cdb3159 test(document-admin): render/gating coverage for DocumentDrawer (TCD-02) (#1058)\n* e788264 test(ui): content-first fallback regression tests (medications + registry) — #015 (#1054)\n* 2f69e2b fix(governance): trace enum typos, surface review-due badge, retain safety-citation provenance (audit #1/#2/#9/#13) (#1051)\n* ac217b1 test(clinical): content-first + governance-badge regression tests (resolve #015) (#1057)\n* ca08128 Auto-surface the /issues ledger via a SessionStart hook (#1052)\n* 9fb9bc7 fix(eval): cost readout counts zero-usage cases as $0 + follow-up ledger capture (#1050)\n* ce32fe1 docs(issues): close #008 as false-positive; fix #014 broken doc path (#1049)\n* b981caa test(clinical-dashboard): assert upload-layout hook wires useSyncExternalStore (#1047)\n* f85c09b test(a11y): lock in reduced-motion scroll + focus-not-obscured regressions (#1048)\n* fdc5c51 fix(medication-safety): fail-safe physiological bounds for patient-profile inputs (FV-03) (#1045)\no ba7a569 refactor(components): extract upload-desktop-layout store into a hook (maturity X3) (#1042)\n\nmerge-base main? bf9a50836a445441f4d224686c54f1c4af257b6a\n\norigin/main bf9a50836a445441f4d224686c54f1c4af257b6a\n\nHEAD 21c1b72e800a25461f8182ce64c89685c8299269\n# Outstanding Issues, Recommendations & Tasks\n\nDurable, cross-session memory of everything still outstanding for this repo: open **tasks**,\n**recommendations** not yet acted on, and **issues** not yet resolved. Chat context is ephemeral\n(sessions summarise and reset); this file is not — it is the single source of truth the\n[`/issues` skill](../.claude/skills/issues/SKILL.md) reads back and updates.\n\n**Rule of thumb:** if it is worth remembering after this session ends, it belongs here.\n\n## How this is used\n\n- Say `/issues` in Claude Code → the skill reads this file and states the open items back,\n grouped by priority with a one-line summary count. Nothing is mutated on a plain read.\n- `/issues add …`, `/issues done `, `/issues capture`, and friends mutate the tables below.\n The full command surface lives in the skill file.\n- Every mutation keeps this file committed so the memory survives across sessions and worktrees.\n\n## Conventions\n\n- **ID** is a monotonic `#NNN`, never reused. Allocate the next number above the current max\n across _both_ tables (open + resolved).\n- **Pri**: `P1` (do next / blocking), `P2` (should do), `P3` (nice-to-have / revisit-when).\n- **Type**: `task` (a concrete unit of work), `rec` (a recommendation to weigh), or\n `issue` (a defect / risk / gap).\n- **Detail / next action** is the smallest thing that would move the item forward.\n- **Source** points at where it came from: a doc, a PR (`#123`), a file:line, or `session YYYY-MM-DD`.\n- Resolving an item moves its row to **Resolved / archive** with the date and a one-line outcome —\n rows are archived, not deleted, so the history stays auditable.\n\n\n\n## Open items\n\n| ID | Pri | Type | Summary | Detail / next action | Source | Added |\n| ---- | --- | ----- | ------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n| #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 |\n| #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 |\n| #006 | P2 | issue | Globe \"Language & region\" button had no handler | Fixed in this PR to the disabled \"Coming soon\" placeholder convention (`aria-disabled` + sr-only note). Wire to a real language/region settings screen when one exists, then drop the placeholder state. | `src/components/clinical-dashboard/master-search-header.tsx:1829`; session 2026-07-21 | 2026-07-21 |\n| #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 |\n| #009 | P3 | rec | Confirm `/api/jobs` is intentionally server/ops-only | No client `fetch()` reaches `/api/jobs` (only tests import it). Confirm it is a deliberate ops/manual surface; if abandoned, remove it. | `src/a…8866 tokens truncated…setup, not code. | session 2026-07-22 webhook review | 2026-07-22 |\n| #028 | P3 | rec | Runtime error tracking (Sentry or similar) | No error tracking in the repo — production exceptions on `psychiatry.tools`, including how often `RAG_PROVIDER_MODE=auto` silently degrades to source-only, are invisible. Weigh adding `@sentry/nextjs` (dependency + DSN secret + instrumentation) vs cost; alert → chat/issue. Provider-backed; needs explicit sign-off before adding the dependency. | session 2026-07-22 webhook review | 2026-07-22 |\n| #029 | P2 | issue | 12 of 30 answer-quality cases return the fallback stub | run #61 --dump-answers: 12/30 quality cases emit the source_backed_review_fallback boilerplate with answer_sections: [], all grounded with 4-6 citations. Some still PASS targeting because the stub echoes query keywords (the contraindication/document_lookup matchers need only a keyword), so the targeting metric MASKS the problem for those intents. Superset of #018 — fix in the extractive composer, validate with the provider-backed answer eval. | run #61 dump artifact; session 2026-07-22 | 2026-07-22 |\n| #030 | P3 | issue | Wide-tier alias lets one doc satisfy both comparison slots | In src/lib/eval-document-matching.ts, \"Admission to Discharge for Mental Health Inpatients\" appears in BOTH the AdmissionCommunityPts and Discharge alias lists, so a single document can satisfy both expectedFiles slots and make allHit true — a latent false-pass on admission-discharge cases. Not firing today (that doc is not in the failing top-5) but it would mask a real miss. Tighten the tables so one doc cannot fill both sides. | src/lib/eval-document-matching.ts:32-65; session 2026-07-22 | 2026-07-22 |\n| #032 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so \"unknown\" ≠ \"bad\" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 |\n| #033 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same \"unknown ≠ bad\" hazard as #025 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |\n| #034 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 |\n| #035 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |\n| #036 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |\n| #037 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 |\n\n## Resolved / archive\n\nMove resolved rows here with the resolution date and a one-line outcome. Keep them — do not delete.\n\n| ID | Type | Summary | Outcome | Resolved |\n| ---- | ---- | ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n| #003 | task | Staging tenancy release evidence outstanding | Ran GitHub Action and validated isolation | 2026-07-21 |\n| #002 | task | Process-ownership fix not yet isolated on `main` | Fixed process isolation using child.pid termination | 2026-07-21 |\n| #008 | rec | Dead href builders in `document-flow-routes.ts` | Not dead code (false positive): `documentReaderHref`/`documentEvidenceHref` are live via the mock wrappers in `src/components/document-search-mockups.tsx` + `src/components/master-document-flow-mockups.tsx` (rendered under `src/app/mockups/document-search/`) and covered by `tests/document-flow-routes.test.ts`; removing breaks the build. Only the production non-mock hrefs are unlinked from prod UI — a wiring gap, not dead code. | 2026-07-22 |\n| #015 | task | Content-first fallback regression tests | Added `tests/registry-record-loader.dom.test.tsx` (8) + `tests/medication-record-page.dom.test.tsx` (6) covering content-first fallback paint, live swap-in, spinner/skeleton, error + not-found/unauthorized states, and the invariant that no authoritative verification badge shows before live governance reconciles (registry fixture-flag neutralization + medication governance-drop-on-error). | 2026-07-22 |\n| #004 | rec | Rescope provider-gated RAG safety ideas | Closed obsolete — rescue source (754-line RAG-safety worktree) unrecoverable/pruned across all refs; answer-quality thresholds + deep-health already shipped on `main` (#585/#587); only cost-cap preflight was genuinely missing and, per session decision, dropped rather than re-filed. | 2026-07-22 |\n",{"_480":757,"_462":758,"_441":442,"_464":448},1784710932851,{"_512":759,"_514":760,"_516":761,"_518":519,"_446":349,"_520":32,"_42":753,"_521":762,"_523":524,"_455":114,"_93":525},"* 21c1b72 (HEAD -> claude/capture-governance-audit-deferrals, origin/claude/capture-governance-audit-deferrals, work) Merge origin/main; renumber governance deferrals to #032-#037\n|\\ \n| * bf9a508 (origin/main) fix(db): guard hosted migration role usage (#1077)\n| * 1426463 content(therapy): use Therapy mode consistently (#1076)\n| * 6cdfdcc feat(tools): add Safety plan generator as a Tools-page tool (not a mode) (#1068)\n| * 12fe707 docs(issues): correct #018/#019 root causes from run #61 artifact; add #029/#030 (#1074)\n| * 46f143d test(routing): use bound AST navigation evidence (#1075)\n| * 4d5c76c fix(design-system): narrow the theme.ts raw-color exemption to APP_THEME_COLORS (#1070)\n| * 98a1bed docs(webhooks): operator runbook to wire up and activate the webhooks (#1065)\n* | eb2a83c docs(issues): capture source-governance audit deferrals (#025-#030)\n|/ \n* ee0c018 feat(upload): reject over-limit files in the browser before transferring (FV-04) (#1064)\n* 6689529 test(document-viewer): shell-state coverage incl. the private-access gate (TCD-03) (#1063)\n* b2ab6b4 chore(scripts): restore archived operator-probe commands; refresh maturity tracker (L1) (#1053)\n* d84bb90 test(ui): drop duplicate #015 content-first suites superseded by #1057 (#1067)\n* 7dcf514 issues: capture #024 (WebKit _rsc-prefetch e2e errors); annotate #023 repro (#1066)\n* 3e70a22 test(settings): destructive + account flow coverage for SettingsDialog (TCD-05) (#1061)\n* ae950de fix(database): make title-word policy explicitly backend-only (#1062)\n* 658bd4d refactor(design-system): burn down raw-color and legacy-tap contract debt (DSD-02/03) (#1059)\n* 9273fbe test(medication): filter-strip coverage for the prescribing workspace (TCD-01) (#1060)\n* 737c2e8 fix(ui): correct invalid disabled:file variant on the upload file-input (#1056)\n* 50762ad docs(issues): archive #004 as obsolete (rescue target gone; 2/3 already on main) (#1055)\n* cdb3159 test(document-admin): render/gating coverage for DocumentDrawer (TCD-02) (#1058)\n* e788264 test(ui): content-first fallback regression tests (medications + registry) — #015 (#1054)\n* 2f69e2b fix(governance): trace enum typos, surface review-due badge, retain safety-citation provenance (audit #1/#2/#9/#13) (#1051)\n* ac217b1 test(clinical): content-first + governance-badge regression tests (resolve #015) (#1057)\n* ca08128 Auto-surface the /issues ledger via a SessionStart hook (#1052)\n* 9fb9bc7 fix(eval): cost readout counts zero-usage cases as $0 + follow-up ledger capture (#1050)\n* ce32fe1 docs(issues): close #008 as false-positive; fix #014 broken doc path (#1049)\n* b981caa test(clinical-dashboard): assert upload-layout hook wires useSyncExternalStore (#1047)\n* f85c09b test(a11y): lock in reduced-motion scroll + focus-not-obscured regressions (#1048)\n* fdc5c51 fix(medication-safety): fail-safe physiological bounds for patient-profile inputs (FV-03) (#1045)\no ba7a569 refactor(components): extract upload-desktop-layout store into a hook (maturity X3) (#1042)\n\nmerge-base main? bf9a50836a445441f4d224686c54f1c4af257b6a\n\norigin/main bf9a50836a445441f4d224686c54f1c4af257b6a\n\nHEAD 21c1b72e800a25461f8182ce64c89685c8299269\n# Outstanding Issues, Recommendations & Tasks\n\nDurable, cross-session memory of everything still outstanding for this repo: open **tasks**,\n**recommendations** not yet acted on, and **issues** not yet resolved. Chat context is ephemeral\n(sessions summarise and reset); this file is not — it is the single source of truth the\n[`/issues` skill](../.claude/skills/issues/SKILL.md) reads back and updates.\n\n**Rule of thumb:** if it is worth remembering after this session ends, it belongs here.\n\n## How this is used\n\n- Say `/issues` in Claude Code → the skill reads this file and states the open items back,\n grouped by priority with a one-line summary count. Nothing is mutated on a plain read.\n- `/issues add …`, `/issues done `, `/issues capture`, and friends mutate the tables below.\n The full command surface lives in the skill file.\n- Every mutation keeps this file committed so the memory survives across sessions and worktrees.\n\n## Conventions\n\n- **ID** is a monotonic `#NNN`, never reused. Allocate the next number above the current max\n across _both_ tables (open + resolved).\n- **Pri**: `P1` (do next / blocking), `P2` (should do), `P3` (nice-to-have / revisit-when).\n- **Type**: `task` (a concrete unit of work), `rec` (a recommendation to weigh), or\n `issue` (a defect / risk / gap).\n- **Detail / next action** is the smallest thing that would move the item forward.\n- **Source** points at where it came from: a doc, a PR (`#123`), a file:line, or `session YYYY-MM-DD`.\n- Resolving an item moves its row to **Resolved / archive** with the date and a one-line outcome —\n rows are archived, not deleted, so the history stays auditable.\n\n\n\n## Open items\n\n| ID | Pri | Type | Summary | Detail / next action | Source | Added |\n| ---- | --- | ----- | ------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n| #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 |\n| #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 |\n| #006 | P2 | issue | Globe \"Language & region\" button had no handler | Fixed in this PR to the disabled \"Coming soon\" placeholder convention (`aria-disabled` + sr-only note). Wire to a real language/region settings screen when one exists, then drop the placeholder state. | `src/components/clinical-dashboard/master-search-header.tsx:1829`; session 2026-07-21 | 2026-07-21 |\n| #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 |\n| #009 | P3 | rec | Confirm `/api/jobs` is intentionally server/ops-only | No client `fetch()` reaches `/api/jobs` (only tests import it). Confirm it is a deliberate ops/manual surface; if abandoned, remove it. | `src/app/api/jobs/route.ts` | 2026-07-21 |\n| #010 | P3 | task | Un-built \"Coming soon\" controls across forms/favourites | ~10 disabled placeholders (forms refine/reset, favourites sort/add/new-set, move-to-set, remove-favourite). Correctly flagged (`aria-disabled` + \"Coming soon\"), not defects — wire when the underlying features land. | `forms-search-results-page.tsx`; `favourites-hub.tsx`; `favourites-command-library-page.tsx` | 2026-07-21 |\n| #011 | P3 | task | Auth DB-connection allocation is operator-only | Supabase Auth (GoTrue) is capped at ~10 absolute DB connections (Supabase perf advisor). Switch to **percentage-based** allocation in the Supabase **dashboard** before the first compute scale-up — **not settable via SQL/MCP** (operator-owned). Verify via a staging soak + an approval-gated read-only advisor re-check. | `docs/auth-connection-cap-runbook.md`; `docs/process-hardening.md` (Known follow-up debts) | 2026-07-21 |\n| #012 | P3 | rec | Slim the lazy cross-mode differentials chunk | `cross-mode-differentials.ts` is dynamically imported (correctly code-split **out** of the initial/dashboard bundle — verified), but it pulls the full ~860 KB differentials snapshot (~125 KB gzip lazy chunk) just to build a tiny `{slug,title,clinicalHinge}` + presentations + aliases catalog. A precomputed lightweight index (generator + drift check, like the `specifiers-content` split / medications `fields=index`) would cut that lazy chunk ~5–10×. Not a bundle leak — an M-effort slim. | `src/lib/cross-mode-differentials.ts`; `src/components/clinical-dashboard/cross-mode-links.tsx:150`; session 2026-07-21 (build:analyze) | 2026-07-21 |\n| #013 | P3 | rec | Route-chunk + mockup catalogue JSON weight | `build:analyze`: `/specifiers` ships `specifiers-search-index.json` (~180 KB parsed), `/forms` ships `forms-catalog.json` (~132 KB), `/formulation` ships `formulation-content.json` (~52 KB, client-side local search — needs index/full split or a search endpoint, architectural). All route-scoped (not initial bundle). Also `*-mockups.tsx` (~100 KB across chunks) build though `/mockups` 404s in prod — exclude from the prod artifact. | session 2026-07-21 (build:analyze) | 2026-07-21 |\n| #014 | P3 | rec | Realize the `next/image` win on signed previews | `next.config` `images` (AVIF + `*.supabase.co` `remotePatterns` pinned to the project host, from #1024) is currently inert — signed document/image previews still render as raw ``. Route them through `next/image` to actually get AVIF + lazy optimization. | #1024; `src/components/clinical-dashboard/signed-image.tsx`; session 2026-07-21 | 2026-07-21 |\n| #016 | P3 | rec | \"Big but not easy\" structural + motion perf | Deferred larger levers: (a) nonce-CSP forces every product route to `ƒ Dynamic` (zero static generation) — evaluate Partial Prerendering / static shells for the static clinical catalogues (DSM/differentials/therapy/specifiers/formulation); (b) sidebar expand/collapse animates `grid-template-columns` (biggest smoothness cost, motion-gated — needs a transform-overlay rethink); (c) Therapy Compass fetches 692 KB / 2.5 MB JSON client-side (defer until interaction + confirm brotli); (d) settings/setup/admin dialogs static-imported into the home chunk (`next/dynamic` them). | session 2026-07-21 (build route table + design audit) | 2026-07-21 |\n| #017 | P3 | task | Field Web-Vitals baseline via live Lighthouse | In-sandbox runtime vitals were blocked (prod server hard-requires Supabase secrets; dev-mode CLS measured excellent at 0.00–0.04, content-first pages 0.000). Run Lighthouse against `psychiatry.tools` for real LCP/INP/CLS to prioritize #012–#016 by measured impact rather than reasoning. | session 2026-07-21 (measurement pass) | 2026-07-21 |\n| #018 | P2 | task | Targeting misses are answer-composition, NOT retrieval-depth | DIAGNOSED 2026-07-22 from the run #61 --dump-answers artifact: retrieval is healthy (grounded=true, 4-6 citations, high_confidence_extractive_retrieval). lithium + adhd return the source_backed_review_fallback boilerplate stub (\"a full written answer could not be completed just now\") with answer_sections: []; metabolic returns a mangled 73-char fragment (\"The guidance for metabolic is that compliance, monitoring and evaluation.\"). NOT corpus-content, NOT retrieval-depth. Root cause is the extractive composer (src/lib/rag/rag-extractive-answer.ts). Do NOT widen the eval matcher (rag-eval-cases.ts:192) — the stub contains monitoring/maintenance/level/range, so widening would make stubs falsely PASS. Fix is a protected-surface answer-behaviour change (provider-backed answer-quality eval + approval). | run #61 dump artifact; session 2026-07-22 | 2026-07-21 |\n| #019 | P2 | task | Admission doc dropped by answer-stage re-rank, not retrieval | DIAGNOSED 2026-07-22 from run #61 artifacts: retrieval coverage is PERFECT — golden documentRecallAt5=1, reciprocalRankAt10=1, missingDocumentSubstrings=[], with \"Admission of Community Patients (AKG).pdf\" at raw rank 4-5 (matches the strict alias AdmissionCommunityPts). The answer stage then DROPS it from answer.sources top-5 and promotes \"Falls Prevention and Management (AKG).pdf\" (raw rank 8, off-topic) in its place. So the defect is post-retrieval evidence balancing (cross-document-synthesis.ts balanceCrossDocumentResults / rankAnswerEvidence), NOT comparison-class retrieval coverage. Separately: nothing guarantees BOTH sides of a comparison are represented — comparison_multi_document_gate (rag.ts:2043) is satisfied by any 2 distinct docs. Fix = protected surface (canary pair + ~$2-4 approval). | run #61 artifacts; session 2026-07-22 | 2026-07-21 |\n| #020 | P3 | task | Validate eval:quality cost readout post-fix | The estimator fix landed in PR #1050 (zero-usage cases count $0 with rates configured; provider-attempted cases with missing usage stay n/a). Remaining action: confirm the next canary run prints a real dollar figure in Answer Metrics, then archive this row. | PR #1050; run #60/#61 Answer Metrics tables | 2026-07-21 |\n| #021 | P3 | rec | E-3d H2 residual: strong/comparison generation discards | approx. 6 generation attempts per full 44-case run still fail the final quality gate and fall to extractive on strong-route comparison/complex shapes (the designed-conservative outcome). PARKED: weakest cost/benefit on the queue — a wave (approx. $2-4 pair + reviewer cycle) to shave seconds off a few hard cases. Revisit only if latency/waste complaints or a cheaper lever appears. | E-3c design record; runs #59-#61 diagnostics | 2026-07-21 |\n| #022 | P2 | task | Source-governance metadata refresh (operator) | Governance warning rate ~0.84 across canaries: stale/review-required/unknown source metadata on most top results. Operator work (document review-status attestation in the app), not a code defect. Next action: generate the prioritized refresh worklist ($0 read-only) and schedule a metadata pass. | runs #57-#61 Source Governance tables; docs/observability-slos.md | 2026-07-21 |\n| #023 | P3 | task | Read Sunday 2026-07-26 scheduled-run artifacts | The 18:00 UTC scheduled runs deliver three free datapoints at once: first full-44 weekly canary (validates the #1044 ANSWER_CASE_LIMIT raise), browser-matrix flake second datapoint (webkit ui-route-coverage now reproduced + root-caused 2026-07-22 → see #024; firefox ui-formulation:91 still awaits a datapoint), and the irrelevant@10 labeling-audit artifact (§3.1 human-decision class). Read all three, then disposition. | sessions 2026-07-20/21; branch-review-ledger convergence notes | 2026-07-21 |\n| #024 | P3 | issue | WebKit e2e `_rsc`-prefetch access-control-checks errors | verify:release:offline on `main` ce32fe170 (2026-07-22) reproduced #023's webkit clause: **6/6 deterministic** failures in `tests/ui-route-coverage.spec.ts` (Therapy Compass; DSM home/comparison; Specifier comparison/map; Differential stream), each a `pageerror … ?_rsc=… due to access control checks` on Next.js RSC prefetch — Chromium + Firefox clean. Not merge-blocking (required gate `test:e2e:pr` is chromium-only; the full webkit matrix is advisory/release-time). Most likely a Playwright route-interception × WebKit interaction, not a Safari user defect. Next: decide (a) allow/mock the `_rsc` routes for the `webkit` e2e project, or (b) confirm real Safari impact — before trusting the full-matrix webkit gate at release. NB the 2 other webkit fails (`ui-stress:412`, `ui-universal-search:210`) passed on isolated re-run = true flake. | session 2026-07-22 (verify:release:offline, `main` ce32fe170); refines #023 | 2026-07-22 |\n| #025 | P2 | task | Activate the three webhooks (operator secrets) | Merged (#968) + deployed but inert — verified live: `POST /api/webhooks/railway` returns `503 webhook_not_configured`. To turn on: (1) Railway → set `RAILWAY_WEBHOOK_SECRET` + add the `?token=…` webhook URL; (2) the chat URLs `SLACK_WEBHOOK_URL`/`DISCORD_WEBHOOK_URL` must be set in BOTH places — the Railway **app/server env** (the receiver forwards deploy alerts via `postChatNotification`, which reads server env, so repo-secret-only leaves the Railway webhook authenticated but returning `delivered:false`) AND as **GitHub repo secrets** (the CI-failure workflow reads `secrets.*`); (3) `SUPABASE_INGESTION_WEBHOOK_SECRET`. Each fails closed until set, so this is pure ops. See docs/webhooks.md. | session 2026-07-22; PR #968; docs/webhooks.md | 2026-07-22 |\n| #026 | P2 | task | Wire the Supabase document-change trigger | The `/api/webhooks/supabase/document-change` receiver is live but nothing calls it. The trigger (`notify_document_change_ingestion_webhook()` + `documents_ingestion_webhook`, SQL in docs/webhooks.md §3) must land as a **committed migration** — drift covers functions/triggers, so applying raw SQL to live would fail `check:drift`: add the migration, reconcile `supabase/schema.sql`, run `npm run drift:manifest` (needs a local Supabase container), then deploy. Operator-applied live state is the Vault secret (`select vault.create_secret('','ingestion_webhook_secret')`) + the base-URL GUC `app.ingestion_webhook_base_url`, which is MANDATORY per environment (the trigger no-ops when it is unset, so `reindex_requested` flips never enqueue — there is no production default). Trigger is `AFTER UPDATE` on `reindex_requested` only — NOT `INSERT` (an INSERT-fired webhook can beat the upload route's own job insert, which then deletes its just-created doc → intermittent upload failures); external inserts set `reindex_requested=true` to be picked up. Note delivery is at-most-once (pg_net has no retry) and there is NO built-in recovery (automatic or manual) for a dropped insert — neither the autopilot nor `scripts/reindex.ts` sweeps `queued` docs with no job (`hasIncompleteDocumentsWithoutOpenJobs` requires `queuedDocuments === 0`). External imports must insert then issue a SEPARATE UPDATE flipping `reindex_requested=true` (an insert with the flag pre-set won't fire the AFTER UPDATE trigger). The app upload path is NOT a guarantee either: it inserts the `documents` row then the `ingestion_jobs` row as two separate non-atomic calls (rollback only on a job-insert error), so a crash/timeout between them strands the same queued-without-job row nothing sweeps. The only true guarantees are an atomic enqueue (document + job in one transaction/RPC) or a scheduled queued-without-job sweep. Until applied, webhook #5 never fires. | session 2026-07-22; docs/webhooks.md §3 | 2026-07-22 |\n| #027 | P3 | rec | External uptime monitor independent of GitHub/Railway | `live-domain-monitor.yml` runs on GitHub's cron, so it won't run in exactly the outage it should catch (Actions or the deploy itself down). Add an off-platform synthetic monitor (UptimeRobot / Better Stack / Checkly) hitting `/api/health` with a webhook alert. Provider setup, not code. | session 2026-07-22 webhook review | 2026-07-22 |\n| #028 | P3 | rec | Runtime error tracking (Sentry or similar) | No error tracking in the repo — production exceptions on `psychiatry.tools`, including how often `RAG_PROVIDER_MODE=auto` silently degrades to source-only, are invisible. Weigh adding `@sentry/nextjs` (dependency + DSN secret + instrumentation) vs cost; alert → chat/issue. Provider-backed; needs explicit sign-off before adding the dependency. | session 2026-07-22 webhook review | 2026-07-22 |\n| #029 | P2 | issue | 12 of 30 answer-quality cases return the fallback stub | run #61 --dump-answers: 12/30 quality cases emit the source_backed_review_fallback boilerplate with answer_sections: [], all grounded with 4-6 citations. Some still PASS targeting because the stub echoes query keywords (the contraindication/document_lookup matchers need only a keyword), so the targeting metric MASKS the problem for those intents. Superset of #018 — fix in the extractive composer, validate with the provider-backed answer eval. | run #61 dump artifact; session 2026-07-22 | 2026-07-22 |\n| #030 | P3 | issue | Wide-tier alias lets one doc satisfy both comparison slots | In src/lib/eval-document-matching.ts, \"Admission to Discharge for Mental Health Inpatients\" appears in BOTH the AdmissionCommunityPts and Discharge alias lists, so a single document can satisfy both expectedFiles slots and make allHit true — a latent false-pass on admission-discharge cases. Not firing today (that doc is not in the failing top-5) but it would mask a real miss. Tighten the tables so one doc cannot fill both sides. | src/lib/eval-document-matching.ts:32-65; session 2026-07-22 | 2026-07-22 |\n| #032 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three \"gaps\": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so \"unknown\" ≠ \"bad\" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 |\n| #033 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same \"unknown ≠ bad\" hazard as #025 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |\n| #034 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 |\n| #035 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |\n| #036 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |\n| #037 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 |\n\n## Resolved / archive\n\nMove resolved rows here with the resolution date and a one-line outcome. Keep them — do not delete.\n\n| ID | Type | Summary | Outcome | Resolved |\n| ---- | ---- | ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |\n| #003 | task | Staging tenancy release evidence outstanding | Ran GitHub Action and validated isolation | 2026-07-21 |\n| #002 | task | Process-ownership fix not yet isolated on `main` | Fixed process isolation using child.pid termination | 2026-07-21 |\n| #008 | rec | Dead href builders in `document-flow-routes.ts` | Not dead code (false positive): `documentReaderHref`/`documentEvidenceHref` are live via the mock wrappers in `src/components/document-search-mockups.tsx` + `src/components/master-document-flow-mockups.tsx` (rendered under `src/app/mockups/document-search/`) and covered by `tests/document-flow-routes.test.ts`; removing breaks the build. Only the production non-mock hrefs are unlinked from prod UI — a wiring gap, not dead code. | 2026-07-22 |\n| #015 | task | Content-first fallback regression tests | Added `tests/registry-record-loader.dom.test.tsx` (8) + `tests/medication-record-page.dom.test.tsx` (6) covering content-first fallback paint, live swap-in, spinner/skeleton, error + not-found/unauthorized states, and the invariant that no authoritative verification badge shows before live governance reconciles (registry fixture-flag neutralization + medication governance-drop-on-error). | 2026-07-22 |\n| #004 | rec | Rescope provider-gated RAG safety ideas | Closed obsolete — rescue source (754-line RAG-safety worktree) unrecoverable/pruned across all refs; answer-quality thresholds + deep-health already shipped on `main` (#585/#587); only cost-cap preflight was genuinely missing and, per session decision, dropped rather than re-filed. | 2026-07-22 |\n","/bin/bash -lc \"git log --oneline --graph --decorate --max-count=30 --all --boundary\nprintf '\\\\nmerge-base main? '; git merge-base HEAD origin/main\nprintf '\\\\norigin/main '; git rev-parse origin/main\nprintf '\\\\nHEAD '; git rev-parse HEAD\nsed -n '1,90p' docs/outstanding-issues.md\"",[763],"13210",{"_514":764,"_93":528},"git log --oneline --graph --decorate --max-count=30 --all --boundary\nprintf '\\nmerge-base main? '; git merge-base HEAD origin/main\nprintf '\\norigin/main '; git rev-parse origin/main\nprintf '\\nHEAD '; git rev-parse HEAD\nsed -n '1,90p' docs/outstanding-issues.md",{"_462":766,"_441":442,"_464":448},{"_531":767,"_503":753,"_42":768,"_469":769,"_202":535,"_536":-5,"_93":537},"{\"cmd\":\"git log --oneline --graph --decorate --max-count=30 --all --boundary\\nprintf '\\\\nmerge-base main? '; git merge-base HEAD origin/main\\nprintf '\\\\norigin/main '; git rev-parse origin/main\\nprintf '\\\\nHEAD '; git rev-parse HEAD\\nsed -n '1,90p' docs/outstanding-issues.md\",\"workdir\":\"/workspace/Database\",\"yield_time_ms\":10000,\"max_output_tokens\":30000}","fc_0ae0f51be7c974a3016a608713c7f88194aee9334565786382",{"_474":448},{"_462":771,"_441":442,"_464":448},{"_465":-5,"_486":772,"_42":773,"_469":774,"_490":775,"_93":492},"gAAAAABqYIcTvgEPHHx9DR_wwODF9FBHP11WQDnmG1veU3-BvlmvCogkIShxFmI2OBpNu0E-Ygysu139XKEPuK1xMk9xkvyZuDMxIF-FAQmPF9fVkp31sr8S-asgePrO4uVRuSGIdUfMYZxigAdIKs6fyDmWJ26FpdrwTYhCB7zygigSLZCyLOwsIYq8A5kJks2pAnQB8h8AG9j5nK9trO1cYCmC_9gGlZqU05jou__Fj4a2h8Ckg-Ajar02TmmLqk3EU4-EOcyVBWD6CHfWRCjQQDqwlJmQVcra5aqmlk7uzQJSOASpKO-FQK5aHo9zJuSnwMmzphuiSCqpmPp-ysxHFUoCxd4G4szV4LZi1tG4hIm7oggbw1_tyVBBavybD0UFexfwQaaZWtpSTqKURI3fREDUBdxduEsHBksmyWlm51zi7I-c8TCFY_lRuGSkNAIEEQ-LDxc_9a74_BDZwOk2O8GS39fYj2s5Qmoe95IizjjVOxXL1auil8p3BYnQdNaW_rgrzpwg7Q53WexOqIoVDtl5O4q9XFfp-inVtyQndUOGE4-6-kxmkMpbOyKEooKEYUs-FxAKY97n_r2rdMPBxhCWKa-yuwDnBIh52FE4NK7HggKewL7KKppSY9nxaQ5cxH5AbUsAQrn0YCxPD6gZzzyMVWkrkLRVycuZbZGLvEev8ZNJLVDyKSvGc30EjIe4TT57JTVIjvLa7DwwUZxOR-37sWxgR2Pi9QWpmM7qYGM2Pbz0fqV0CBMUPm6SIGk712fOXsNr9uH9SvqvcgQLi0kR4jcsQnf62CRzTRnDN55JNvmr2tE-GszGUfLN69gcL4czKQ1IpRNSwqpI3rJ3k4a5TFWbWY5IarItJOsrldliuHVy8QtLLeLiOMS-Z6_o5mfQmmAYFmJaZ1hOgrDX0zvJAoHXTeeLTgD4J1iq5PG843RJSiQiRij0Vi5gZMGXw8-Fv2xeU3TRq2IpU8jGhPPEyGDvYV953dppTDd6X2xINjR4VOFMpgrjz8difab_4DftJGfV4Z6F5Xdq6ZVXXDSlogcxlGY3MdwuQkn8bdlLQAjeFMbKMF2XO4Z7lDs-rUkb2ih5KuxD-7qs0xUHC1O2No_RJURkUqoW1e75NMXTVmZSSo1kqaipQr1vK_R_5mel56cue1_ypZOZl0tfDtEDYV1-z4Ng-jLtNI1Mpm-rVlvTkvIQMYnMkD924Sz1JGXxliu4anjulGtRo0TGKzqbCS9LrgYrl8fjUdXRJYF18f2F00X-SIkkfZAA5AfXTCBEZOnD0tELntgygpUINj94NC9d1pOWJ2m42QvcNvfTOoYAXkq-VU4DjyKJg2amljhxxYOFXu-lgDCiothjCakl8bZKJLnlZ_TZCojksTo4liu2LXn4ngisYQ3P603zPrnSazZAl7p7gM9o7i-Q-EAHNly13hzckEFwA-q7EH5HczgG8qH8qYWSQusXEoAqXHN4ZGkO2niWWUvpgppinOhz6hPCqc1qNKA2MKSB1Dh9xQwUwxq3NDzUbVW22UaPE5EG4PLRUZ6R1h2efDGiO7IHhcErdUJ9PG110JOEeEjAYN6r7hlTl5ELcrKZfuxNjqCi_G3qq9x6jYkSKLBcaYoagqHGFmJbfqhIhOLwgUlLRrPgE4l7JhHjFxAfYPrZTlxsmHoSIhad0VhYZbfcAF3Nfx_mb05CpReRf-Sf9v5Te_EN23GaOpw7izFwp7ZzbMnmeasr","rs_0ae0f51be7c974a3016a60870f64bc81949e8ccb71a2d77220",{"_474":448},[776],{"_46":777,"_93":495},"**Verifying merge conflict status with GitHub**",{"_480":779,"_462":780,"_441":442,"_464":448},1784710931811,{"_465":781,"_42":773,"_490":782,"_93":492},[],[777],{"_462":784,"_441":442,"_464":448},{"_503":785,"_42":-5,"_469":786,"_506":787,"_93":508},"call_mMbTvgD6rTJ53MbqVBKefh3J",{"_474":448},"Chunk ID: 24656b\nWall time: 0.0001 seconds\nProcess exited with code 0\nOriginal token count: 87\nOutput:\nSwitched to a new branch 'claude/capture-governance-audit-deferrals'\nbranch 'claude/capture-governance-audit-deferrals' set up to track 'origin/claude/capture-governance-audit-deferrals'.\n## claude/capture-governance-audit-deferrals...origin/claude/capture-governance-audit-deferrals\n21c1b72e800a25461f8182ce64c89685c8299269\nAlready up to date.\n",{"_480":789,"_462":790,"_441":442,"_464":448},1784710926425,{"_512":791,"_514":792,"_516":793,"_518":519,"_446":32,"_520":32,"_42":785,"_521":794,"_523":524,"_455":114,"_93":525},"Switched to a new branch 'claude/capture-governance-audit-deferrals'\nbranch 'claude/capture-governance-audit-deferrals' set up to track 'origin/claude/capture-governance-audit-deferrals'.\n## claude/capture-governance-audit-deferrals...origin/claude/capture-governance-audit-deferrals\n21c1b72e800a25461f8182ce64c89685c8299269\nAlready up to date.\n","/bin/bash -lc 'git switch -C claude/capture-governance-audit-deferrals origin/claude/capture-governance-audit-deferrals\ngit status --short --branch\ngit rev-parse HEAD\ngit merge --no-ff origin/main'",[795],"10210",{"_514":796,"_93":528},"git switch -C claude/capture-governance-audit-deferrals origin/claude/capture-governance-audit-deferrals\ngit status --short --branch\ngit rev-parse HEAD\ngit merge --no-ff origin/main",{"_462":798,"_441":442,"_464":448},{"_531":799,"_503":785,"_42":800,"_469":801,"_202":535,"_536":-5,"_93":537},"{\"cmd\":\"git switch -C claude/capture-governance-audit-deferrals origin/claude/capture-governance-audit-deferrals\\ngit status --short --branch\\ngit rev-parse HEAD\\ngit merge --no-ff origin/main\",\"workdir\":\"/workspace/Database\",\"yield_time_ms\":30000,\"max_output_tokens\":30000}","fc_0ae0f51be7c974a3016a60870e0af08194aed1bdda4c70244c",{"_474":448},{"_462":803,"_441":442,"_464":448},{"_465":-5,"_486":804,"_42":805,"_469":806,"_490":807,"_93":492},"gAAAAABqYIcOAYm-96bACeAH9GgUikHalx8KwjL3ALN1WR8uUqOTYg_Yt0_uZsizUvaxOfG5JAkEoxgoVVCWoAVGa-ajhWG8wG-vFaY6iniWv5jjTYiygk3PPqsynRwBqdbCAJCNU_MAKP1oQJOj_p5p5OhSWp9mXeeh8wOKfpw_2E6rdh4NBq9sAVCKf6QQlRsLd3WVC7-9VeycDozBupWuINnKUh1nqHoTWSn1AEmdtGQGKWVvLACmCzWIquKvxsvU0E2pbgFdJ2QT766VDl_h0diU2w2sW7abd82AqClg8Nh6msxXGLVBE8Ig8zt9055PnxqNukW_qjjaDeXj2aWh_dvycxD23YBUVAr5q7IErnJwdCQYTQTz5L8jHu4z93hPA5tKV8J434HYP8q-9K8NBafsJYXlYPgtN6leeEi8EPlTBgljaUx_lvC3EFFHBuOtcuYwIYmUvIk5SzzVyqomJ0gwoTBS8D_PC9ZzI-9exxHlgU2AVaxxHBLo23BuRoigObGvHTziCbIRIQle-8elOGNEB4jljULaUGmH76CdtzqCJTgcpFOkAYCS75oOpjTb4Kz0tIYgdvCoaueylKPaVLNrFbJvWk2nKODpGRkyi5WyGE7kIG1yAXkirUOS0xQCYRto_Vlis_e-A1YwvQVsmUm-ZnvsQTrtRusHm1s2cAC_qJckXo7rgElaOuC95uu3luswbx85KqxfIwC6faF7K3B5HRx9RQWq6_TQwm9Pe10p6rwCPkeHtUA-iM4tp74GE4ZL1H3W55cuL3_T6zuMdB-DgpDZmnj7jQ55yYaEfRjeNEe9xLgynsckE_9S0IQ1SGi8BJnfDAuFDKa1HNVqmAh4vrWATkyYDouiA5NAvDreXj_I5qQINKj0awRTX8Hoowc5ndxJJTGt16v0YvbPQL4my4wG0mLrMf1X0GHlSfL4vJFplljR-rboMwZxwZJRZBa3_hKyjUdYPV-jSsHFkWSZpzhLO8W5Y0QjNmiSCnBdcPKwcii-GPwcMwiuDVXvk1Ou9CJd8XcYm-VQZQQP1PjvkZT1ujBQP1UtZAYF4hYAbfDgX49X8_VNhJHK6wZG3LT0Lu1VBdQWsjA8Lxg3TJubkIP1YOZb7TLUdWvnwQuE1NLegZkT_S_prvZSKucIVkUKnsXhxbtMRuWeoTYqmasEu6UFfWoDM2yLwHh4LwYVH_PHjcVlTWxTOJnzaMFzckmfZTZtoCb7z1XOtLr9dIdhhjzzJIkGccWv_ZxMR2JOPZESGR3Y2cxPYEfgUWZHXt4Q9JE8","rs_0ae0f51be7c974a3016a60870b2b248194bf0e9ee955d6b1d8",{"_474":448},[808],{"_46":809,"_93":495},"**Switching to existing PR branch**",{"_480":811,"_462":812,"_441":442,"_464":448},1784710926061,{"_465":813,"_42":805,"_490":814,"_93":492},[],[809],{"_480":816,"_462":817,"_441":442,"_464":448},1784710922302,{"_512":818,"_514":819,"_516":820,"_518":519,"_446":821,"_520":32,"_42":822,"_521":823,"_523":524,"_455":114,"_93":525},"From https://github.com/BigSimmo/Database\n * branch main -> FETCH_HEAD\n * branch claude/capture-governance-audit-deferrals -> FETCH_HEAD\n * [new branch] main -> origin/main\n * [new branch] claude/capture-governance-audit-deferrals -> origin/claude/capture-governance-audit-deferrals\n","/bin/bash -lc 'git remote add origin https://github.com/BigSimmo/Database.git\ngit fetch origin main claude/capture-governance-audit-deferrals'",[824],305,"call_2x8L63Zke1b4NIfZExpf3RbY","53855",{"_514":825,"_93":528},"git remote add origin https://github.com/BigSimmo/Database.git\ngit fetch origin main claude/capture-governance-audit-deferrals",{"_462":827,"_441":442,"_464":448},{"_503":822,"_42":-5,"_469":828,"_506":829,"_93":508},{"_474":448},"Chunk ID: 5e0de9\nWall time: 0.2041 seconds\nProcess exited with code 0\nOriginal token count: 82\nOutput:\nFrom https://github.com/BigSimmo/Database\n * branch main -> FETCH_HEAD\n * branch claude/capture-governance-audit-deferrals -> FETCH_HEAD\n * [new branch] main -> origin/main\n * [new branch] claude/capture-governance-audit-deferrals -> origin/claude/capture-governance-audit-deferrals\n",{"_462":831,"_441":442,"_464":448},{"_531":832,"_503":822,"_42":833,"_469":834,"_202":535,"_536":-5,"_93":537},"{\"cmd\":\"git remote add origin https://github.com/BigSimmo/Database.git\\ngit fetch origin main claude/capture-governance-audit-deferrals\",\"workdir\":\"/workspace/Database\",\"yield_time_ms\":30000,\"max_output_tokens\":20000}","fc_0ae0f51be7c974a3016a6087096fd08194acad0e5b1e48d9e8",{"_474":448},{"_462":836,"_441":442,"_464":448},{"_465":-5,"_486":837,"_42":838,"_469":839,"_490":840,"_93":492},"gAAAAABqYIcJUoEIrY-hEJLDgZ1tGiGkyskHiDdg959PFDA6bkFunPiROJmec4RZczMGPW9uaMZy7SLaSYy0-tJ-C_Ds-gtIAM2ndNZOMpMFgE1mmNyWeGm0Jod5ILAfEG0LwbMVHtV0RD4lxu2YMOOlYKsIPy9VUqkfvujeoUiyQFVf7bSlXgvI3Y0pzd92As3P7MenrEiYrx00xjxKqDE1kSmrOcA52SswpzADkzWrx0ckYfO9ZgLc0ENwaSXMU7_b74F_PUQXcAyZ7VK3jF2Urrvjdc1X5XwZh_15p-sMhlIf0QrqN7YVJIBA2t_IIJ89NiUtmLrep5SkwaCfiZ1BHvCL8w5CsGtJ0ikn8uSAZGvAL1dzcIcyz2ty5sIb1ZYxpy1dgW_UXyiQTpukFPUrk7MRIhhQ9DjnmJ1UV0QJRCRUudZ99Yb35vKSPzesjXimaiEbJEQx8H9Y-RjAG_KWxsj1LLTr78jidIO_p_LAbPU0WRyLnfq8koIt2fKgXWMrXQVcAb191zSiZbniXu97gByiBltbGsWSKYyVrPSb8OUeLQCfoBYFG_T8Aqq-Uxdfoo4hPukw14Pz4Lyrh4UbKpP0U-faE_xOxDI2a3NS32W2Hl1ircHNuuqV2R7auCqIwgz0QyGMJUPMBxJ9eMOY1JGqgESAKToE7r4oDmo8nkDD-WxozwnVc4Cn0koauTUKMSsV9ujWfKGZOLBN4wxDVQ8HMHNpSAJqpESN_G-g5iD2Pvq51N6UyDa5GxFo3ELDJBxQPVw3SUvZEhSERt_uXqfVW-DTjGtQIzNRsGJcX7GJSrX3-8yJ8kZlHM2UCv2ybhNvfh0Vj1j9qFF9fQMLiNAjlZ4iD59AqiBgAEYgOCWzpNDlHnZImaOCCccCTimpAcxapEXYKDmTrdk5BWFIOm5lZGoRk72Z_EQC-U7f90jYLOz1-yiRD00t_9p9OpHIb8ocbklpWGRpDVGXehsElvrzScXyNZWwVxwjqkEMXqO8nGibZz8_ApqkDYf72Z_5ICnytnXf","rs_0ae0f51be7c974a3016a608703bd0c8194b78c4ff71d2375ce",{"_474":448},[841],{"_46":842,"_93":495},"**Preparing GitHub access and fetching branches**",{"_480":844,"_462":845,"_441":442,"_464":448},1784710921452,{"_465":846,"_42":838,"_490":847,"_93":492},[],[842],{"_480":849,"_462":850,"_441":442,"_464":448},1784710914709,{"_512":851,"_514":852,"_516":853,"_518":519,"_446":854,"_520":32,"_42":855,"_521":856,"_523":524,"_455":114,"_93":525},"docs/audit-handover-2026-07-14.md:13:| Plan PR | [#673](https://github.com/BigSimmo/Database/pull/673) (`cursor/audit-remediation-plan-0411`) |\ndocs/audit-handover-2026-07-14.md:14:| Ledger-only PR | [#652](https://github.com/BigSimmo/Database/pull/652) (`cursor/repo-wide-audit-ledger-0411`) |\ndocs/archive/branch-progress-2026-07-05.md:9:- PR: [#261](https://github.com/BigSimmo/Database/pull/261) — _Import WA psychiatric services catalogue and clinical registry snapshots_\ndocs/deployment-architecture.md:44:`BigSimmo/Database` on pushes to `main`.\ndocs/deployment-architecture.md:52: to the `BigSimmo/Database` GitHub repo and auto-deploying on pushes to `main`:\ndocs/deploy-corrector-public-titles.md:167:`BigSimmo/Database` and paste:\n./docs/audit-handover-2026-07-14.md:13:| Plan PR | [#673](https://github.com/BigSimmo/Database/pull/673) (`cursor/audit-remediation-plan-0411`) |\n./docs/audit-handover-2026-07-14.md:14:| Ledger-only PR | [#652](https://github.com/BigSimmo/Database/pull/652) (`cursor/repo-wide-audit-ledger-0411`) |\n./docs/archive/branch-progress-2026-07-05.md:9:- PR: [#261](https://github.com/BigSimmo/Database/pull/261) — _Import WA psychiatric services catalogue and clinical registry snapshots_\n./docs/deployment-architecture.md:44:`BigSimmo/Database` on pushes to `main`.\n./docs/deployment-architecture.md:52: to the `BigSimmo/Database` GitHub repo and auto-deploying on pushes to `main`:\n./docs/deploy-corrector-public-titles.md:167:`BigSimmo/Database` and paste:\n./AGENTS.md:257:- Production services `Database` (Next.js app tier, serves `https://psychiatry.tools`) and `worker` (ingestion) auto-deploy from `BigSimmo/Database` pushes to `main`; the `staging` environment runs the `app` service.\n","/bin/bash -lc \"git config --list --show-origin | sed -n '1,160p'\nrg -n \\\"github.com[:/]BigSimmo/Database|BigSimmo/Database\\\" -S .github docs package.json . 2>/dev/null | sed -n '1,80p'\"",[857],103,"call_pFf0m0K7FqEr3eJ9OPhvvyEX","8384",{"_514":858,"_93":528},"git config --list --show-origin | sed -n '1,160p'\nrg -n \"github.com[:/]BigSimmo/Database|BigSimmo/Database\" -S .github docs package.json . 2>/dev/null | sed -n '1,80p'",{"_462":860,"_441":442,"_464":448},{"_503":855,"_42":-5,"_469":861,"_506":862,"_93":508},{"_474":448},"Chunk ID: 643fcf\nWall time: 0.0007 seconds\nProcess exited with code 0\nOriginal token count: 581\nOutput:\nfile:/etc/gitconfig\tfilter.lfs.clean=git-lfs clean -- %f\nfile:/etc/gitconfig\tfilter.lfs.smudge=git-lfs smudge -- %f\nfile:/etc/gitconfig\tfilter.lfs.process=git-lfs filter-process\nfile:/etc/gitconfig\tfilter.lfs.required=true\nfile:/root/.gitconfig\tcore.pager=cat\nfile:/root/.gitconfig\tuser.name=Codex\nfile:/root/.gitconfig\tuser.email=codex@openai.com\nfile:/root/.gitconfig\tsafe.directory=/workspace/Database\nfile:.git/config\tcore.repositoryformatversion=0\nfile:.git/config\tcore.filemode=true\nfile:.git/config\tcore.bare=false\nfile:.git/config\tcore.logallrefupdates=true\ndocs/audit-handover-2026-07-14.md:13:| Plan PR | [#673](https://github.com/BigSimmo/Database/pull/673) (`cursor/audit-remediation-plan-0411`) |\ndocs/audit-handover-2026-07-14.md:14:| Ledger-only PR | [#652](https://github.com/BigSimmo/Database/pull/652) (`cursor/repo-wide-audit-ledger-0411`) |\ndocs/archive/branch-progress-2026-07-05.md:9:- PR: [#261](https://github.com/BigSimmo/Database/pull/261) — _Import WA psychiatric services catalogue and clinical registry snapshots_\ndocs/deployment-architecture.md:44:`BigSimmo/Database` on pushes to `main`.\ndocs/deployment-architecture.md:52: to the `BigSimmo/Database` GitHub repo and auto-deploying on pushes to `main`:\ndocs/deploy-corrector-public-titles.md:167:`BigSimmo/Database` and paste:\n./docs/audit-handover-2026-07-14.md:13:| Plan PR | [#673](https://github.com/BigSimmo/Database/pull/673) (`cursor/audit-remediation-plan-0411`) |\n./docs/audit-handover-2026-07-14.md:14:| Ledger-only PR | [#652](https://github.com/BigSimmo/Database/pull/652) (`cursor/repo-wide-audit-ledger-0411`) |\n./docs/archive/branch-progress-2026-07-05.md:9:- PR: [#261](https://github.com/BigSimmo/Database/pull/261) — _Import WA psychiatric services catalogue and clinical registry snapshots_\n./docs/deployment-architecture.md:44:`BigSimmo/Database` on pushes to `main`.\n./docs/deployment-architecture.md:52: to the `BigSimmo/Database` GitHub repo and auto-deploying on pushes to `main`:\n./docs/deploy-corrector-public-titles.md:167:`BigSimmo/Database` and paste:\n./AGENTS.md:257:- Production services `Database` (Next.js app tier, serves `https://psychiatry.tools`) and `worker` (ingestion) auto-deploy from `BigSimmo/Database` pushes to `main`; the `staging` environment runs the `app` service.\n",{"_462":864,"_441":442,"_464":448},{"_531":865,"_503":855,"_42":866,"_469":867,"_202":535,"_536":-5,"_93":537},"{\"cmd\":\"git config --list --show-origin | sed -n '1,160p'\\nrg -n \\\"github.com[:/]BigSimmo/Database|BigSimmo/Database\\\" -S .github docs package.json . 2>/dev/null | sed -n '1,80p'\",\"workdir\":\"/workspace/Database\",\"yield_time_ms\":10000,\"max_output_tokens\":20000}","fc_0ae0f51be7c974a3016a608701451081948f0d8ed9f4ef7ee0",{"_474":448},{"_462":869,"_441":442,"_464":448},{"_465":-5,"_486":870,"_42":871,"_469":872,"_490":873,"_93":492},"gAAAAABqYIcBqKg9WRHa08F6Dr6sxaqtOaHZ1PGFChF8xSxoGzP-v4HbhdrFqxe1buv9n9CaGiFkRLoF-F3neFi1CpO8mGALiiM5DK5uPTZzmwzZzW_PdAX4p8-zSXel41dJ5O9ATvLLwneZvbqRnaiTtRd_KqMiD45cbTuVQin_lLPuUkgdItNu3cYY0o2rRZzn5VHJQDPn9ZpYFi3fFduUzHGk5OAVQTC-o2n6z1dr-JQRECMIG-kQMNuU46uPDx4oieLN2ds-qV59kPsoM7VyK8y6ZXd0di1jKVrF_il6KJB7wZhN-KaQlorF9QOMl3jRny1NlY-gT8DmwLPnv74-tWaL-9ftS5eD_npD5AvFJz-G9Lp7g-K1vvJKuUwk8tVbFXQw06KxPnRb2ijxMxXkk-152t3D0Sth_y3GGGi8qNJkxsBC87CKVeLwwUz5D7ThQVhUkVA4bNomIR3vYeisbHZb09qMsxn19iA-5_PwI0tavEXUL_c_gZ95aTwxOlUTu5kTtVWIAvRqEny3vSKRrDWUqb_zEkVPhBAWAntl1DOJmTdcfArUsM8VpYBMD-ObGeHbLYIF01jgcNMr1gltMMtOFTMsDgJ2ta6JifdlCMcyrhyY_1OU84WBsZkgklWicuUNCYPWzGpCNOFlYywukIoQ2bEX3DziSHVday7GGy_rGbGxmkadypNSYiG-4kG0Hf6OTJh7CgSBx7deL_YuT5EwwrOkiZXMA0oESoQ0TJjSikahJtjG10Wo080d7sP1GGUXiQLDHJdFd2dkMQ1KA5aBayYLZpzTkUzw-nHrSz-lriAXa_SZe6Q8QfC8CA8_IqZidfzXnLblCU9A3PEabaCuRhMfH6X_YCpeElmljTh7XSl_4BpTzO8-sXe225tNRRfF88cB-B1K7HtAsbepgCpZiXR8Yr12CRVva8vJQdAVe9X6YLXyLaMFEtU_tIFIezjHOpMspU902J3IjkzLOasXaymXPamyOi87rc6Z_Nd1aEeT0nqJ41evltEVD0FhH34UUXXdhNnQWXdZFd8kyA-mJFuPIP3qWzW3eOlrv_HaFD7cTbo=","rs_0ae0f51be7c974a3016a6086fff2c081948b7cf32826a44b78",{"_474":448},[874],{"_46":875,"_93":495},"**Checking Git remote configuration**",{"_480":877,"_462":878,"_441":442,"_464":448},1784710913284,{"_465":879,"_42":871,"_490":880,"_93":492},[],[875],{"_462":882,"_441":442,"_464":448},{"_503":883,"_42":-5,"_469":884,"_506":885,"_93":508},"call_eq8tCxg7MT2HfH6fp8H9mnRf",{"_474":448},"Chunk ID: 91daa7\nWall time: 0.0011 seconds\nProcess exited with code 0\nOriginal token count: 3867\nOutput:\n\n\n# This is NOT the Next.js you know\n\nThis version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` before writing any code. Heed deprecation notices.\n\n\n\n\n\n## Dependency shortcut\n\nWhen the user types exactly `dependency` as the entire task message, after trimming surrounding whitespace, treat it as a shortcut for safe dependency maintenance. This is a Codex chat shortcut, not an app feature, script, automation, or CI workflow.\n\nGoal:\nUpdate direct project dependencies to the newest stable compatible versions, regenerate the existing lockfile, identify source/config/test code that relies on old dependency behavior, make the smallest safe compatibility changes, and verify the result. Do not rewrite the project, switch package managers, discard user work, commit, push, deploy, or run destructive cleanup without explicit confirmation.\n\nStart with read-only inspection:\n\n- Check branch, upstream, worktrees, recent relevant history, and `git status`.\n- If on `main`, `master`, `develop`, `release/*`, or another protected/base branch, create/switch to `codex/dependency-maintenance` before editing, if safe.\n- Inspect manifests, lockfiles, package-manager config, runtime/toolchain files, workspace layout, CI config, scripts, and documented checks.\n- Detect repo-local install/dev/test/build/watch/server processes that could race dependency updates.\n- Preserve all existing staged, unstaged, and untracked user work.\n\nPackage-manager rules:\n\n- Use the package manager already used by the repo: npm, pnpm, yarn, bun, pip, poetry, uv, cargo, go, bundler, gradle, maven, dotnet, or equivalent.\n- Do not switch package managers or create a new lockfile type.\n- Respect engines, runtime versions, lockfiles, workspaces, wrappers, and repo conventions.\n- In monorepos or polyglot repos, update each ecosystem through its native workspace-aware workflow.\n\nDependency update rules:\n\n- Identify outdated direct production and development dependencies.\n- Compare both manifest ranges and locked/installed versions against latest stable compatible releases.\n- Treat “outdated packages found” exit codes as normal where applicable.\n- Avoid prerelease, alpha, beta, canary, rc, next, nightly, and experimental versions unless the stable channel points there and explain why.\n- Do not use force or legacy flags that bypass peer, engine, resolver, or lockfile integrity checks unless explicitly approved.\n- Do not run forced audit fixes or broad destructive codemods.\n- If latest is incompatible, use the newest compatible version and document why.\n- Group risky updates coherently, such as framework plus plugins, test runner plus coverage, lint core plus plugins, or runtime plus adapter packages.\n\nCompatibility audit:\n\n- For every major update and every core framework/runtime/build/test/lint/UI/database update, inspect release notes, migration guides, peer ranges, engines, and changelogs when available.\n- Search source, tests, scripts, config, and CI for imports, APIs, CLI flags, config keys, environment variables, plugin names, generated types, or file paths tied to changed dependencies.\n- If old dependency behavior is used, make the smallest safe migration that preserves behavior.\n- If migration is large, risky, architectural, or product-affecting, stop after discovery and provide a concrete fix plan with affected files, package versions, sequence, and verification commands.\n- Add or adjust focused tests only when needed to prove migrated behavior.\n\nGenerated and sensitive files:\n\n- Do not intentionally keep dependency directories, build outputs, caches, logs, local state, test artifacts, browser artifacts, `.env*`, secrets, keys, tokens, credentials, or machine-local config.\n- Manifest and existing lockfile changes are allowed.\n\nVerification:\n\n- Run a cheap baseline first when useful to distinguish pre-existing failures.\n- After updates, run install/dependency validation, then relevant lint, type check, tests, build, smoke/UI/a11y, codegen, integration checks, or equivalent.\n- For frontend/browser-facing changes, run browser/UI verification when framework, bundler, router, styling, test runner, or browser automation changed.\n- If a check fails, fix dependency-related breakage and rerun the smallest failing check before broader checks.\n- Run non-mutating audit/vulnerability checks when available.\n- Confirm no repo-owned dev server, watcher, or temporary process was left running unless requested.\n\nFinal response for `dependency` must include:\n\n- Branch and worktree state.\n- Package manager, runtime, manifests, and lockfiles detected.\n- Outdated dependencies found.\n- Dependencies updated, old version -> new version.\n- Dependencies not updated and why.\n- Files changed.\n- Compatibility migrations and old APIs found/fixed.\n- Checks run and results.\n- Checks not run and why.\n- Audit/vulnerability summary.\n- Generated/untracked files left behind.\n- Branch movement, external repo changes, or process cleanup observed.\n- Risks or follow-up work.\n- Confirmation that no commit or push was made unless explicitly requested.\n\nAfter setup:\n\n- Verify root `AGENTS.md` contains exactly one `## Dependency shortcut` section.\n- Show the final diff for `AGENTS.md`.\n- Summarize what changed.\n- Confirm no dependency update, install, test, build, audit, commit, or push was performed.\n\n\n\n\n\n## Bug-hunter shortcut\n\nWhen the user types exactly `bug-hunter` as the entire task message, after trimming surrounding whitespace, treat it as a shortcut for targeted defect discovery.\n\nExecution rules:\n\n- Invoke the `bug-hunter` skill first.\n- Prioritize reproducible defects over code style, naming, or formatting feedback.\n- Trace realistic failure paths: invalid input, empty states, retries, race/concurrency issues, stale state/cache, network/auth failures, permissions, and boundary values.\n- For each finding, include trigger, expected behavior, actual risk, and the smallest proof (or targeted test/check) that would catch it.\n- If no high-confidence defect is found, explicitly state that and list the most likely residual risk area.\n\nScope and safety:\n\n- Keep the hunt scoped to code touched by the user request unless the defect clearly crosses module boundaries.\n- Do not make broad refactors while hunting; propose minimal fixes for confirmed issues.\n- Run the smallest focused verification for each confirmed defect, then expand only if needed.\n\n\n\n\n\n## Codex review throttling and routing\n\nDo not review branches opportunistically. Review the current changed diff, PR, or branch only when the user explicitly asks for review/audit/hunter/cleanup/upload work, when CI/check failures are the task, or when the current change touches high-risk areas that require a targeted review before handoff.\n\nUse `docs/codex-review-protocol.md` as the shared review protocol for every repo-local review skill, branch/PR review, audit, bug hunt, release-readiness check, and PR/CI review.\n\nBefore reviewing a branch or PR:\n\n- Check `docs/branch-review-ledger.md` if it exists.\n- Resolve the target with `git rev-parse `.\n- If the same branch/ref and HEAD SHA were already reviewed for the same scope, summarize the prior ledger outcome and skip the repeat review unless the user explicitly requests a fresh pass.\n- If the target HEAD changed, review only the changed scope and update the ledger after the review.\n\nBefore reviewing multiple branches:\n\n- Build a short branch inventory first: branch, upstream, ahead/behind, last commit, and merged status.\n- Skip branches already merged into `main`.\n- Skip unchanged branches already recorded in `docs/branch-review-ledger.md`.\n- Do not re-review every branch after ordinary coding tasks.\n- If a repeated request targets unchanged reviewed branches, summarize the prior result and ask before doing another full pass.\n\nReview routing:\n\n- `diff-review`: Use for explicit review of the current diff, PR, or named branch. Findings first, ordered by severity, with file/line evidence.\n- `bug-hunter`: Use only for the exact `bug-hunter` shortcut or an explicit defect-hunt request. Prioritize reproducible bugs and smallest proof.\n- `repo-auditor`: Use for explicit repo-wide audit/refactor/dead-code/import/dependency-structure requests. Treat outputs as triage, not automatic delete lists.\n- `release-readiness`: Use for explicit release, merge, PR readiness, or handoff confidence requests. Do not run provider-backed gates without confirmation.\n- `branch-cleanup`: Use only when the prompt explicitly asks for branch cleanup/hygiene or branch deletion candidates. Apply `docs/branch-cleanup-guide.md` and the review ledger before inspecting branch diffs.\n- `pr-ci-fix`: Confirmation-required for this repo. GitHub/GitLab API calls, PR comments, CI reruns, commits, and pushes require explicit user approval and must respect the upload/handoff rules. Exception: an explicit `Run PR` sweep carries this approval (see \"## Run PR shortcut\").\n\nWhen a branch or PR review completes, record the reviewed branch/ref, HEAD SHA, date, scope, outcome, and checks in `docs/branch-review-ledger.md`.\n\n\n\n\n\n# Local server safety\n\n- If the user says `run`, execute `npm run ensure` and return the printed URL.\n- If the user asks for UI/frontend changes, browser QA, screenshots, mobile checks, or a local app link, run `npm run ensure` before opening or testing the app, even if the user did not say `run`.\n- Never assume `localhost:3000`, `localhost:3001`, or `localhost:3002`.\n- Never attach to a local server unless `/api/local-project-id` confirms it is this project.\n- Do not kill or modify other projects' local servers. If the stable project port is busy, let `npm run ensure` choose the next safe project URL.\n- Do not run a permanent watcher. Only start or verify the server when the current chat task needs the app or the user asks to run it.\n\n\n\n\n\n# Process hardening phases\n\n- For non-trivial source/config/test changes, prefer `npm run verify:cheap` as the first broad gate and `npm run verify:pr-local` before PR handoff when the change is ready. The PR-local gate runs the full unit suite once, then conditionally adds the production build/client-bundle scan and RAG fixture/manifest validation. Browser, dependency-audit, Docker/Supabase replay, and provider-backed checks remain separate gates. Use `npm run verify:pr-local -- --dry-run --files ` to inspect selection without running commands. The broader `--extended` plan is dry-run only unless explicit approval is reflected by `ALLOW_EXTENDED_PR_LOCAL=true`.\n- Run one heavy Database command at a time across all worktrees. Do not install while a repository test, build, lint, typecheck, or server command is active. Avoid aggressive short-interval polling, and do not repeat an unchanged full gate after it passes.\n- For UI, frontend, browser, routing, styling, reduced-motion, or forced-colors changes, run `npm run ensure` before browser work and use `npm run verify:ui` as the Chromium UI gate.\n- For release or handoff confidence, use `npm run verify:release`; this includes the full Playwright project set.\n- For clinical ingestion, answer generation, source governance, privacy, production-readiness, or environment changes, run the smallest relevant domain check plus `npm run check:production-readiness`.\n- For pull requests that touch ingestion, answer generation, search/ranking, source rendering, document access, privacy, production env, or clinical output, complete the clinical governance preflight in `.github/pull_request_template.md`.\n- Track known verification debts and staged process improvements in `docs/process-hardening.md` instead of relying on chat-only memory.\n\n\n\n\n\n# Page and button wiring\n\nInteractive controls and routes follow conventions the codebase already holds to. Before adding\nor moving a button, link, or route, read `docs/wiring-conventions.md`. A control that advertises an\naction must perform one; a page that ships must be reachable.\n\n- **Buttons.** Every interactive `