feat(audit): comprehensive repository audit remediation across phases 1, 2, and 3

docs/codebase-index.md

@@ -173,6 +173,7 @@ Local task coordination lives in `.superpowers/`: ignored task briefs, review pa
 | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
 | `/`                                                                                                                                                                                                     | `src/app/(search-app)/page.tsx`                                                                                                 |
 | Shared mode-home route group (`/(search-app)`)                                                                                                                                                          | `src/app/(search-app)/`                                                                                                         |
+| Admin route group (`/(admin)`)                                                                                                                                                                          | `src/app/(admin)/`                                                                                                              |
 | Mode homes (`/?mode=<id>`; bare `/services`, `/dsm`, `/documents`, … redirect there)                                                                                                                    | `src/app/(search-app)/page.tsx` + `home-page-client.tsx`                                                                        |
 | `/applications` (307 to `/tools`)                                                                                                                                                                       | `src/app/applications/route.ts`                                                                                                 |
 | `/differentials/search`, `/differentials/diagnoses`, `/differentials/diagnoses/[slug]`, `/differentials/presentations`, `/differentials/presentations/[slug]`, `/differentials/compare`                 | `src/app/(search-app)/differentials/`                                                                                           |
@@ -266,6 +267,7 @@ Legacy On Call bookmarks `/on-call/shifts` and `/on-call/calendar` now redirect
 | Eval / jobs      | `/api/eval-cases`; `/api/jobs` (admin/ops listing — see `docs/api-jobs-ops-surface.md`; UI uses `/api/ingestion/jobs`)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `eval-cases/`, `jobs/`                                          |
 | Webhooks         | `/api/webhooks/railway`, `/api/webhooks/supabase/document-change` (inbound; secret-gated — see docs/webhooks.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `webhooks/`                                                     |
 | Site content     | `/api/site-content/publications` (administrator POST only)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `site-content/publications/`                                    |
+| Proxy            | `/api/proxy` (inbound; constant-time `PROXY_AUTH` secret-gated proxy endpoints)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `proxy/route.ts`                                                |
 
 ---
 
@@ -294,6 +296,7 @@ domain-extracted directory; imported as `@/lib/rag/rag*`). Other modules below r
 | `answer-ranking.ts`, `answer-verification.ts`, `answer-follow-up.ts`, `answer-render-policy.ts`, `answer-response.ts`, `answer-stream-contract.ts`     | Answer quality, rendering and the client/stream contract (`answer-formatting.ts` is used only by the ward note output, `ward-output.ts`)                        |
 | `citations.ts`, `cross-document-synthesis.ts`, `evidence-relevance.ts`                                                                                 | Evidence and synthesis                                                                                                                                          |
 | `ranking-config.ts`, `search-scope.ts`, `rag/rag-eval-cases.ts`                                                                                        | Ranking tuning and eval fixtures                                                                                                                                |
+| `search/` (`my-work-grammar.ts`)                                                                                                                       | Search My Work question grammar and query parsing (EPAs, WBAs, assessments, reviews, alerts)                                                                    |
 | `clinical-ask/`                                                                                                                                        | Mode-aware Clinical Ask contracts, profiles, evidence, and orchestration                                                                                        |
 | `security-headers.ts`, `privacy-page-content.tsx`                                                                                                      | Clinical Ask microphone policy, ephemeral-data disclosure, and provider-boundary privacy copy                                                                   |
 
@@ -339,6 +342,7 @@ domain-extracted directory; imported as `@/lib/rag/rag*`). Other modules below r
 | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | `differentials.ts`, `forms.ts`, `services.ts`, `registry-records.ts` | Shared catalogue content with optional owner overrides                                                                                                                                                                                                                                                                                                                                                                               |
 | `differentials/`                                                     | Presentation workflow mappings and disambiguation helpers (`presentation-workflows.ts`)                                                                                                                                                                                                                                                                                                                                              |
+| `medications/`                                                       | Australian ACSQHC and ISMP Tall Man lettering mappings for look-alike/sound-alike psychiatric medicines (`tall-man.ts`)                                                                                                                                                                                                                                                                                                              |
 | `differential-curated.ts`                                            | Locally authored overlay on the generated differentials snapshot — per-slug at-a-glance facts, first moves, "tell them apart" discriminators, and a content note for records whose export mixes in another diagnosis. Not seeded means derived-only; nothing here invents an attribute a record lacks. Assessment and escalation only, never dosing (`docs/clinical-governance.md`, "Clinical Use Rules")                            |
 | `services-canonical-data/`                                           | Generated, partitioned canonical WA Services source records, carrying safety, provenance, availability, and review metadata for the governed overlay                                                                                                                                                                                                                                                                                 |
 | `mha-act-sections.ts`                                                | Mental Health Act 2014 (WA) section summaries shared across forms; `actSectionsForCue` resolves a form's `sourceFacts.sectionCue` and withholds the whole list until every cited section has a summary; `drafted` entries render with an awaiting-clinical-review note, `reviewed` ones name their reviewer (`docs/wiring-conventions.md`)                                                                                           |

docs/design-system/GATES.md

@@ -31,33 +31,33 @@ than CI, two of them by the second reader; review does not scale past two carefu
 | `arbitraryTracking`               | **0** (hard floor) | 0            |
 | `colourOnlyStatusIndicators`      | **0** (hard floor) | 0            |
 | `darkColorOverrides`              | **0** (hard floor) | 0            |
-| `disabledOpacityUses`             | 31                 | 21           |
+| `disabledOpacityUses`             | 30                 | 21           |
 | `edgeOwnershipConflicts`          | 5                  | 2            |
 | `elevationInversions`             | 5                  | 4            |
 | `errorStateCountProps`            | **0** (hard floor) | 0            |
 | `failedStateResultCounts`         | **0** (hard floor) | 0            |
 | `handRolledCommandButtons`        | 8                  | 7            |
-| `hardcodedCssMotionDurations`     | 25                 | 1            |
+| `hardcodedCssMotionDurations`     | 21                 | 1            |
 | `interactiveTapFloorDeclarations` | 4                  | 3            |
 | `layoutTransitionExceptions`      | 10                 | 4            |
 | `legacyPaletteUtilities`          | **0** (hard floor) | 0            |
-| `legacyShadowAliases`             | 32                 | 26           |
-| `legacyTapClasses`                | 3                  | 3            |
+| `legacyShadowAliases`             | 30                 | 24           |
+| `legacyTapClasses`                | **0** (hard floor) | 0            |
 | `literalShadowClasses`            | **0** (hard floor) | 0            |
 | `onePixelShadowSpreads`           | **0** (hard floor) | 0            |
 | `rawColorLiterals`                | **0** (hard floor) | 0            |
 | `rawCssZIndices`                  | 4                  | 1            |
-| `rawGapLiterals`                  | 11                 | 1            |
+| `rawGapLiterals`                  | 10                 | 1            |
 | `rawLineHeightLiterals`           | **0** (hard floor) | 0            |
-| `rawMarginLiterals`               | 8                  | 2            |
-| `rawPaddingLiterals`              | 22                 | 4            |
-| `rawRadiusLiterals`               | 15                 | 3            |
+| `rawMarginLiterals`               | 6                  | 2            |
+| `rawPaddingLiterals`              | 21                 | 4            |
+| `rawRadiusLiterals`               | 14                 | 3            |
 | `sameFileTextSmMinusMix`          | 32                 | 32           |
 | `statusColouredNumerals`          | **0** (hard floor) | 0            |
 | `textSoftConsumers`               | **0** (hard floor) | 0            |
-| `visibleLiveRegions`              | 20                 | 19           |
+| `visibleLiveRegions`              | 17                 | 17           |
 
-28 metrics, 12 of them pinned at zero. A metric at zero is a hard floor:
+28 metrics, 13 of them pinned at zero. A metric at zero is a hard floor:
 the check asserts `value <= baseline`, so any reintroduction fails. A non-zero pin is
 recorded debt with per-path pins, so a new occurrence fails even while the total stands.
 

docs/design-system/adoption-manifest.json

@@ -2217,6 +2217,7 @@
         "tests/empirical-challenger-m1.dom.test.tsx",
         "tests/eval-process-safety.test.ts",
         "tests/favourites-page-actions.dom.test.tsx",
+        "tests/note-editor-caret.dom.test.tsx",
         "tests/search-results-header-band.dom.test.tsx",
         "tests/ui-cme-phone.spec.ts",
         "tests/ui-formulation.spec.ts",

docs/outstanding-issues-inbox/0d5cdc6b-7d56-4e37-988b-ead1816d1d21.json

@@ -0,0 +1,10 @@
+{
+  "version": 2,
+  "id": "0d5cdc6b-7d56-4e37-988b-ead1816d1d21",
+  "createdOn": "2026-10-13",
+  "action": "cancel",
+  "payload": {
+    "requestId": "dc536871-2125-416e-be36-4d093641fbf0",
+    "reason": "Resolved 2026-10-13: Added main landmarks in the DSM and First Nations layouts for /dsm/search and /first-nations."
+  }
+}

docs/outstanding-issues-inbox/10129668-cc6a-4910-82fd-7bc8b53a1a9a.json

@@ -0,0 +1,10 @@
+{
+  "version": 2,
+  "id": "10129668-cc6a-4910-82fd-7bc8b53a1a9a",
+  "createdOn": "2026-10-13",
+  "action": "done",
+  "payload": {
+    "id": "#3B4S3Z",
+    "outcome": "Resolved: Added optimistic concurrency lock to safe number editor."
+  }
+}

docs/outstanding-issues-inbox/19dc1828-67ee-4a7f-ac44-ec01a32375dd.json

@@ -0,0 +1,10 @@
+{
+  "version": 2,
+  "id": "19dc1828-67ee-4a7f-ac44-ec01a32375dd",
+  "createdOn": "2026-10-13",
+  "action": "cancel",
+  "payload": {
+    "requestId": "632a2b64-acf5-435d-b5f5-9338e527ea9f",
+    "reason": "Resolved 2026-10-13: Replaced 23 chat-import occurrences across the 6 records in src/data/therapies-source.json with clean clinical descriptions; regenerated index via build-therapies-index.mjs; verified with check:therapy-data-index and 134 therapy tests."
+  }
+}

docs/outstanding-issues-inbox/1aadcb29-1f37-496c-b524-0ff285e22260.json

@@ -0,0 +1,10 @@
+{
+  "version": 2,
+  "id": "1aadcb29-1f37-496c-b524-0ff285e22260",
+  "createdOn": "2026-10-13",
+  "action": "cancel",
+  "payload": {
+    "requestId": "70ce559e-b757-44e5-93a6-ca9772eaac69",
+    "reason": "Resolved: Relocated developer tools from /mockups to /admin/developer-hub and /admin/care-plan with backwards redirects."
+  }
+}

docs/outstanding-issues-inbox/29409bc2-8d63-483d-9a49-445e9a8d30c6.json

@@ -0,0 +1,11 @@
+{
+  "version": 2,
+  "id": "29409bc2-8d63-483d-9a49-445e9a8d30c6",
+  "createdOn": "2026-10-13",
+  "action": "done",
+  "payload": {
+    "id": "#1A1H9N",
+    "outcome": "Resolved: Bumped answer-thread-storage version to 3 and ensured legacy cached answers lacking strongSupportLabelCapped are invalidated.",
+    "baseRowFingerprint": "857ceb7a0543e62a807394fa52c2e2cccb50fc1be47f81cbe4c8dcd6a47b2b5d"
+  }
+}

docs/outstanding-issues-inbox/3e6cf213-53e4-458d-bc74-752a88ecc4fc.json

@@ -0,0 +1,11 @@
+{
+  "version": 2,
+  "id": "3e6cf213-53e4-458d-bc74-752a88ecc4fc",
+  "createdOn": "2026-10-13",
+  "action": "done",
+  "payload": {
+    "id": "#789SD7",
+    "outcome": "Resolved: Added dedicated PROXY_AUTH secret validation in API proxy route.",
+    "baseRowFingerprint": "666d42b5e7c362384fe75ce749c12a49478a8641f2392d50014940d9173cbe18"
+  }
+}

docs/outstanding-issues-inbox/449032d1-e49b-4fe0-ad68-f17ecae8d8be.json

@@ -0,0 +1,11 @@
+{
+  "version": 2,
+  "id": "449032d1-e49b-4fe0-ad68-f17ecae8d8be",
+  "createdOn": "2026-10-13",
+  "action": "done",
+  "payload": {
+    "id": "#P6BSQ3",
+    "outcome": "Resolved: Implemented JWT and secret dual-gate in indexing-v3-agent edge function.",
+    "baseRowFingerprint": "cb02abd7d57f1680a6bb33490be6646bc6f1a103f9a5a200cc8378c5097c5448"
+  }
+}

docs/outstanding-issues-inbox/47f5ca33-60ed-4a54-a441-d6cb58f47165.json

@@ -0,0 +1,11 @@
+{
+  "version": 2,
+  "id": "47f5ca33-60ed-4a54-a441-d6cb58f47165",
+  "createdOn": "2026-10-13",
+  "action": "done",
+  "payload": {
+    "id": "#AD3F5B",
+    "outcome": "Resolved: Added migration applying FORCE ROW LEVEL SECURITY to the six site_content control-plane tables.",
+    "baseRowFingerprint": "320975e01871569a4b2c3adab2ff713c366001d768f694f39d13d206e71cf852"
+  }
+}

docs/outstanding-issues-inbox/4bec676d-2b81-426d-85bb-801ea07ecb68.json

@@ -0,0 +1,11 @@
+{
+  "version": 2,
+  "id": "4bec676d-2b81-426d-85bb-801ea07ecb68",
+  "createdOn": "2026-10-13",
+  "action": "done",
+  "payload": {
+    "id": "#1RWC0H",
+    "outcome": "Resolved: Added keyed HMAC with salt for IP rate-limit subject keys and 7-day retention purge function.",
+    "baseRowFingerprint": "efe5c2ee39bfc576f6cb0b54fa491991cbae0c18886fe9bfda4fb0b8027413c4"
+  }
+}

docs/outstanding-issues-inbox/563d11b8-515b-402e-a3ae-ef8ba5991105.json

@@ -0,0 +1,11 @@
+{
+  "version": 2,
+  "id": "563d11b8-515b-402e-a3ae-ef8ba5991105",
+  "createdOn": "2026-10-13",
+  "action": "done",
+  "payload": {
+    "id": "#ZTDZ4Z",
+    "outcome": "Teaching: in-app QR scanner check-in helper added in QrCheckInHelper with mobile camera constraints, permissions handling, and typed fallback.",
+    "baseRowFingerprint": "5866e928aba2f47f268b7377b698902fd4b7235d876bd048ae6d1691ea1e8951"
+  }
+}

docs/outstanding-issues-inbox/58973f74-68a2-4041-8ddb-feccc4c3cbb4.json

@@ -0,0 +1,11 @@
+{
+  "version": 2,
+  "id": "58973f74-68a2-4041-8ddb-feccc4c3cbb4",
+  "createdOn": "2026-10-13",
+  "action": "done",
+  "payload": {
+    "id": "#NB4SHF",
+    "outcome": "Resolved: Virtualized on-call view presentation from stored sections.",
+    "baseRowFingerprint": "2f26e21013ffb430854053ba805d47b0dda50569d95fbf20804f78b32b0016f2"
+  }
+}

docs/outstanding-issues-inbox/6c0bd4b5-1cb1-4257-98a6-7249cf546466.json

@@ -0,0 +1,11 @@
+{
+  "version": 2,
+  "id": "6c0bd4b5-1cb1-4257-98a6-7249cf546466",
+  "createdOn": "2026-10-13",
+  "action": "done",
+  "payload": {
+    "id": "#XD5BHM",
+    "outcome": "Resolved: scripts/lib/signoff-kinds/standards-and-cultural-notes.mjs registers standard and cultural-note kinds with content pins and tests (tests/signoff-standards-and-cultural-notes.test.ts 43/43 passing).",
+    "baseRowFingerprint": "37f9098cbd1bd0a0bf7437a78a0c3e2c0674c4c26dac0dc636e5220d7cf2e9b1"
+  }
+}

docs/outstanding-issues-inbox/6f4c0ed7-c8dd-4bf4-aaee-c30de202b357.json

@@ -0,0 +1,11 @@
+{
+  "version": 2,
+  "id": "6f4c0ed7-c8dd-4bf4-aaee-c30de202b357",
+  "createdOn": "2026-10-13",
+  "action": "done",
+  "payload": {
+    "id": "#AD3F5B",
+    "outcome": "Resolved: Added migration 20261013140000_force_rls_control_plane.sql applying FORCE ROW LEVEL SECURITY to the six site_content control-plane tables.",
+    "baseRowFingerprint": "320975e01871569a4b2c3adab2ff713c366001d768f694f39d13d206e71cf852"
+  }
+}