Phone design audit: crisis card, MHA time limits, offline numbers first, one-list Renewals, Work consistency, header fixes

bundle-budget.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "Client JS bundle-size budgets captured from a known-good production build. `production` guards aggregate user-facing chunks, `routes` guards the Lighthouse journeys and the main work-mode pages (added by the work-mode speed review, 7 Oct 2026) against route-local growth (route baselines lowered about 100 KB on 7 Oct 2026 (scaled from a local build by the ratio to the baselineSource build, so they stay comparable with it) when the sign-in library moved out of the first load, so that saving cannot quietly regrow), and `mockups` is a looser design-scratch hygiene ceiling. The `production` baseline alone was raised on 9 Oct 2026 to a local build of the hospital roles change merged with main (5472.8 KiB), after its 145 KiB duplicated-chunk regression was removed: main had already reached +9.8% from the combined work-mode growth. Route baselines and baselineSource were left as they were. Refresh intentionally with `npm run check:bundle-budget -- --update`.",
+  "$comment": "Client JS bundle-size budgets captured from a known-good production build. `production` guards aggregate user-facing chunks, `routes` guards the Lighthouse journeys and the main work-mode pages (added by the work-mode speed review, 7 Oct 2026) against route-local growth (route baselines lowered about 100 KB on 7 Oct 2026 (scaled from a local build by the ratio to the baselineSource build, so they stay comparable with it) when the sign-in library moved out of the first load, so that saving cannot quietly regrow), and `mockups` is a looser design-scratch hygiene ceiling. The `production` baseline alone was raised on 9 Oct 2026 to a local build of the hospital roles change merged with main (5472.8 KiB), after its 145 KiB duplicated-chunk regression was removed: main had already reached +9.8% from the combined work-mode growth. Route baselines and baselineSource were left as they were. Refresh intentionally with `npm run check:bundle-budget -- --update`. On 13 Oct 2026 the owner approved resetting two route baselines, /roster/shifts (390.9 KiB) and /teaching/assessments (459.3 KiB), to a local production build of main at f4bcb55a4 (which matched CI's own measurement of that commit), because main had already reached +9.7% and +8.9% there. All other baselines were left as they were.",
   "enforce": true,
   "production": {
     "gzipBytes": 5604147,
@@ -42,7 +42,7 @@
       "tolerancePct": 10
     },
     "/roster/shifts": {
-      "gzipBytes": 365000,
+      "gzipBytes": 400282,
       "tolerancePct": 10
     },
     "/open-shifts": {
@@ -62,7 +62,7 @@
       "tolerancePct": 10
     },
     "/teaching/assessments": {
-      "gzipBytes": 432014,
+      "gzipBytes": 470323,
       "tolerancePct": 10
     },
     "/cme": {

docs/design-system/COMPONENTS.md

@@ -1058,14 +1058,14 @@ This generated snapshot is a local source-derived inventory. It does not assert
 | `AnswerFooter`           | answer   | yes   | yes                | inherited-global-root | yes            | no                 |               1 |
 | `AsyncButton`            | controls | yes   | yes                | inherited-global-root | yes            | no                 |               5 |
 | `Breadcrumb`             | layout   | yes   | yes                | inherited-global-root | yes            | no                 |               1 |
-| `Button`                 | controls | yes   | yes                | inherited-global-root | yes            | no                 |             129 |
+| `Button`                 | controls | yes   | yes                | inherited-global-root | yes            | no                 |             128 |
 | `Checkbox`               | controls | yes   | yes                | inherited-global-root | yes            | no                 |              14 |
 | `Chip`                   | controls | yes   | yes                | inherited-global-root | yes            | no                 |               8 |
 | `ChoiceChip`             | controls | yes   | yes                | inherited-global-root | yes            | no                 |               7 |
 | `Citation`               | source   | yes   | yes                | inherited-global-root | yes            | no                 |               1 |
 | `CitationList`           | source   | yes   | yes                | inherited-global-root | yes            | no                 |               1 |
 | `ConfirmDialog`          | layout   | yes   | yes                | inherited-global-root | yes            | no                 |              13 |
-| `DateDisplay`            | source   | yes   | yes                | inherited-global-root | yes            | no                 |               4 |
+| `DateDisplay`            | source   | yes   | yes                | inherited-global-root | yes            | no                 |               3 |
 | `Disclosure`             | layout   | yes   | yes                | inherited-global-root | yes            | no                 |               3 |
 | `DisclosureGroup`        | layout   | yes   | yes                | inherited-global-root | yes            | no                 |               1 |
 | `DoseLine`               | answer   | yes   | yes                | no                    | yes            | no                 |               0 |
@@ -1078,7 +1078,7 @@ This generated snapshot is a local source-derived inventory. It does not assert
 | `FieldHint`              | feedback | yes   | yes                | inherited-global-root | yes            | no                 |               2 |
 | `FormField`              | controls | yes   | yes                | inherited-global-root | yes            | no                 |              18 |
 | `IconButton`             | controls | yes   | yes                | inherited-global-root | yes            | no                 |               3 |
-| `InlineNotice`           | feedback | yes   | yes                | inherited-global-root | yes            | no                 |              33 |
+| `InlineNotice`           | feedback | yes   | yes                | inherited-global-root | yes            | no                 |              32 |
 | `LinkAction`             | controls | yes   | yes                | no                    | yes            | no                 |               0 |
 | `LoadingPanel`           | feedback | yes   | yes                | inherited-global-root | yes            | no                 |              10 |
 | `MissingValue`           | feedback | yes   | yes                | inherited-global-root | yes            | no                 |              11 |

docs/design-system/adoption-manifest.json

@@ -375,7 +375,6 @@
         "src/components/roster/manage/roster-approve-tab.tsx",
         "src/components/roster/manage/roster-cover-tab.tsx",
         "src/components/roster/manage/roster-decision-sheet.tsx",
-        "src/components/roster/manage/roster-manage-page.tsx",
         "src/components/roster/manage/roster-people-list.tsx",
         "src/components/roster/manage/roster-team-settings.tsx",
         "src/components/roster/requests/roster-dates-sheet.tsx",
@@ -509,7 +508,6 @@
         "src/components/roster/manage/roster-approve-tab.tsx",
         "src/components/roster/manage/roster-cover-tab.tsx",
         "src/components/roster/manage/roster-decision-sheet.tsx",
-        "src/components/roster/manage/roster-manage-page.tsx",
         "src/components/roster/manage/roster-people-list.tsx",
         "src/components/roster/manage/roster-team-settings.tsx",
         "src/components/roster/requests/roster-dates-sheet.tsx",
@@ -897,13 +895,11 @@
       "entryExported": true,
       "directImportFiles": [
         "src/components/answer/AnswerFooter.tsx",
-        "src/components/privacy-quiet-signal-page.tsx",
         "src/components/ui/retrieval-state-banner.tsx",
         "src/components/ui/verification-notice.tsx"
       ],
       "productImportFiles": [
         "src/components/answer/AnswerFooter.tsx",
-        "src/components/privacy-quiet-signal-page.tsx",
         "src/components/ui/retrieval-state-banner.tsx",
         "src/components/ui/verification-notice.tsx"
       ],
@@ -1437,7 +1433,6 @@
         "src/components/DocumentViewer.tsx",
         "src/components/calendar/calendar-subscribe.tsx",
         "src/components/clinical-dashboard/account-setup-dialog.tsx",
-        "src/components/clinical-dashboard/answer-crisis-banner.tsx",
         "src/components/clinical-dashboard/auth-panel.tsx",
         "src/components/clinical-dashboard/email-auth-form.tsx",
         "src/components/clinical-dashboard/medication-considerations.tsx",
@@ -1473,7 +1468,6 @@
         "src/components/DocumentViewer.tsx",
         "src/components/calendar/calendar-subscribe.tsx",
         "src/components/clinical-dashboard/account-setup-dialog.tsx",
-        "src/components/clinical-dashboard/answer-crisis-banner.tsx",
         "src/components/clinical-dashboard/auth-panel.tsx",
         "src/components/clinical-dashboard/email-auth-form.tsx",
         "src/components/clinical-dashboard/medication-considerations.tsx",

knip.json

@@ -10,7 +10,13 @@
     "*.config.{ts,mts,mjs,cjs}"
   ],
   "project": ["src/**/*.{ts,tsx}", "scripts/**/*.{ts,mjs,cjs}", "worker/**/*.ts", "eslint-rules/**/*.mjs"],
-  "ignore": ["src/lib/supabase/database.types.ts", "**/*mockup*", "supabase/functions/**", "docs/**"],
+  "ignore": [
+    "src/lib/supabase/database.types.ts",
+    "**/*mockup*",
+    "supabase/functions/**",
+    "docs/**",
+    "src/components/work-setup/work-setup-row.tsx"
+  ],
   "ignoreDependencies": [
     "mammoth",
     "qrcode",

public/offline.html

@@ -162,7 +162,7 @@
       .crisis-tel {
         display: inline-flex;
         align-items: center;
-        min-height: 2.75rem;
+        min-height: 3rem;
         margin-top: 0.35rem;
         color: var(--page-accent);
         font-size: 1.15rem;
@@ -370,25 +370,12 @@
       <!-- brand-mark:end -->
       <h1 id="offline-title">PsychSift is offline</h1>
       <p>
-        Reconnect to search, generate answers, or open private clinical documents and account data. This offline page
-        can still show the public crisis numbers and any Mental Health Act deadlines your clinician has signed off, as
-        quotes below.
-      </p>
-      <section class="on-call" id="on-call-offline" aria-labelledby="on-call-offline-title" hidden>
-        <h2 id="on-call-offline-title">On Call, saved on this phone</h2>
-        <p class="warning" id="on-call-offline-saved"></p>
-        <div id="on-call-offline-lists"></div>
-      </section>
-      <p class="privacy-note">
-        For privacy, the PWA cache stores only this offline screen and public application assets. It does not store or
-        replay clinical queries, answers, documents, uploads, signed URLs, or API responses. The numbers and quotes
-        below are public, non-patient information, not stored or replayed patient data, and each shows its source and
-        the date it was checked. If you use On Call, this screen can also show the shared On Call numbers your browser
-        already saved in the last seven days, never your personal entries; they are cleared when you sign out.
+        Reconnect to search, get answers, or open private clinical documents and account data. The numbers below work
+        without a connection.
       </p>
       <!-- offline-pack:start (generated by scripts/build-offline-pack.ts) -->
       <section aria-labelledby="offline-crisis-heading" class="offline-pack-section">
-        <h2 id="offline-crisis-heading">Crisis support numbers</h2>
+        <h2 id="offline-crisis-heading">Urgent numbers</h2>
         <ul class="crisis-list">
           <li class="crisis-item">
             <p class="crisis-name">Emergency services</p>
@@ -399,6 +386,23 @@ <h2 id="offline-crisis-heading">Crisis support numbers</h2>
               <a href="https://www.triplezero.gov.au/" target="_blank" rel="noopener noreferrer">Source</a>
             </p>
           </li>
+          <li class="crisis-item">
+            <p class="crisis-name">Poisons Information Centre</p>
+            <a class="crisis-tel" href="tel:131126">13 11 26</a>
+            <p class="crisis-availability">24 hours, every day</p>
+            <p class="crisis-caveat">
+              For overdose or poisoning advice. Call 000 if the person has collapsed or is not breathing.
+            </p>
+            <p class="crisis-checked">
+              Checked 13 October 2026 &middot;
+              <a
+                href="https://scgh.health.wa.gov.au/Our-Services/Service-directory/Poisons"
+                target="_blank"
+                rel="noopener noreferrer"
+                >Source</a
+              >
+            </p>
+          </li>
           <li class="crisis-item">
             <p class="crisis-name">Mental Health Emergency Response Line (MHERL) — Perth metropolitan</p>
             <a class="crisis-tel" href="tel:1300555788">1300 555 788</a>
@@ -482,6 +486,11 @@ <h2 id="offline-crisis-heading">Crisis support numbers</h2>
           </li>
         </ul>
       </section>
+      <section class="on-call" id="on-call-offline" aria-labelledby="on-call-offline-title" hidden>
+        <h2 id="on-call-offline-title">On Call, saved on this phone</h2>
+        <p class="warning" id="on-call-offline-saved"></p>
+        <div id="on-call-offline-lists"></div>
+      </section>
       <section aria-labelledby="offline-act-heading" class="offline-pack-section">
         <h2 id="offline-act-heading">Mental Health Act deadlines</h2>
         <p class="pack-caution">Reference only — check against the Act and your service's procedure.</p>
@@ -605,6 +614,13 @@ <h2 id="offline-act-heading">Mental Health Act deadlines</h2>
         </ul>
       </section>
       <!-- offline-pack:end -->
+      <p class="privacy-note">
+        For privacy, this page stores only this offline screen and public application assets. It does not store or
+        replay clinical queries, answers, documents, uploads, signed URLs, or API responses. The numbers and quotes
+        above are public, non-patient information, each with its source and the date it was checked. If you use On Call,
+        this screen can also show the shared On Call numbers saved on this phone in the last seven days, never your
+        personal entries; they are cleared when you sign out.
+      </p>
       <a class="retry" href="/">Try again</a>
     </main>
     <script>

public/sw.js

@@ -7,7 +7,7 @@
  */
 
 const CACHE_PREFIX = "clinical-kb-pwa-";
-const CACHE_VERSION = "2026-10-11-v1";
+const CACHE_VERSION = "2026-10-13-v1";
 const SHELL_CACHE = `${CACHE_PREFIX}shell-${CACHE_VERSION}`;
 const STATIC_CACHE = `${CACHE_PREFIX}static-${CACHE_VERSION}`;
 const STATIC_CACHE_PREFIX = `${CACHE_PREFIX}static-`;

scripts/build-offline-pack.ts

@@ -34,7 +34,7 @@ import { resolve } from "node:path";
 
 import { format, resolveConfig } from "prettier";
 
-import { WA_CRISIS_CONTACTS, type PublicCrisisContact } from "@/lib/crisis-contacts";
+import { POISONS_INFORMATION_CONTACT, WA_CRISIS_CONTACTS, type PublicCrisisContact } from "@/lib/crisis-contacts";
 import { isReviewedTimeframe, type MhaTimeframeEntry } from "@/lib/mha-timeline";
 import { isDirectEntrypoint } from "./lib/is-entrypoint.mjs";
 
@@ -189,7 +189,7 @@ function renderCrisisContact(contact: PublicCrisisContact): string {
 function renderCrisisSection(contacts: readonly PublicCrisisContact[]): string {
   const items = contacts.map(renderCrisisContact).join("\n");
   return `      <section aria-labelledby="offline-crisis-heading" class="offline-pack-section">
-        <h2 id="offline-crisis-heading">Crisis support numbers</h2>
+        <h2 id="offline-crisis-heading">Urgent numbers</h2>
         <ul class="crisis-list">
 ${items}
         </ul>
@@ -241,9 +241,28 @@ ${items}
  */
 export function buildOfflinePackMarkup(timeframesPath: string): string {
   const reviewed = loadReviewedTimeframes(timeframesPath);
-  return `${renderCrisisSection(WA_CRISIS_CONTACTS)}${renderActSection(reviewed)}`;
+  return `${renderCrisisSection(offlineCrisisContacts())}\n${ON_CALL_SAVED_SECTION}${renderActSection(reviewed)}`;
 }
 
+/**
+ * The offline page's numbers, urgent first (design audit D06, 13 Oct 2026): 000, then the
+ * Poisons Information Centre, then the rest of the shared crisis list in its own order.
+ */
+export function offlineCrisisContacts(): PublicCrisisContact[] {
+  const [emergency, ...rest] = WA_CRISIS_CONTACTS;
+  return [emergency, POISONS_INFORMATION_CONTACT, ...rest];
+}
+
+/**
+ * The On Call numbers this phone already saved, filled in by the page's own script. Sits between
+ * the crisis numbers and the Act quotes, so the numbers a doctor rings come before anything to read.
+ */
+const ON_CALL_SAVED_SECTION = `      <section class="on-call" id="on-call-offline" aria-labelledby="on-call-offline-title" hidden>
+        <h2 id="on-call-offline-title">On Call, saved on this phone</h2>
+        <p class="warning" id="on-call-offline-saved"></p>
+        <div id="on-call-offline-lists"></div>
+      </section>`;
+
 /**
  * Replaces the region between the offline-pack sentinels in `currentHtml` with
  * `markup`, leaving the rest of the document untouched. Throws if the

src/app/(search-app)/forms/clock/page.tsx

@@ -6,7 +6,7 @@ import { consolidatedModeSearchPath } from "@/lib/consolidated-mode-home-redirec
 import { mhaClockForms } from "@/lib/psychiatry-hub/mha-clock-forms";
 
 export const metadata: Metadata = {
-  title: "MHA clock | PsychSift",
+  title: "MHA time limits | PsychSift",
   description: "Every Mental Health Act form you are holding, with how long it has been running and its time limits.",
 };
 

src/app/(search-app)/psychiatry/mha-clock/page.tsx

@@ -4,7 +4,7 @@ import { MhaClockPage } from "@/components/psychiatry/mha-clock-page";
 import { mhaClockForms } from "@/lib/psychiatry-hub/mha-clock-forms";
 
 export const metadata: Metadata = {
-  title: "MHA clock | PsychSift",
+  title: "MHA time limits | PsychSift",
   description: "Every Mental Health Act form you are holding, with how long it has been running and its time limits.",
 };
 

src/app/api/answer/route.ts

@@ -18,6 +18,7 @@ import { queryClassForClinicalMode, queryForClinicalMode } from "@/lib/clinical-
 import { resolveSearchScope } from "@/lib/search-scope";
 import { resolveRetrievalAccessScope } from "@/lib/owner-scope";
 import { parseJsonBody } from "@/lib/validation/body";
+import { rejectPatientDetailQuestion } from "@/lib/clinical-question-patient-check-server";
 import {
   buildGovernedAnswerClientResponse,
   buildGovernedDemoAnswerClientResponse,
@@ -69,6 +70,9 @@ export async function POST(request: Request) {
   let body: AnswerRequestBody | null = null;
   try {
     const answerBody = await parseJsonBody(request, answerRequestSchema, "Invalid answer request.");
+    // Refuse a question that looks like it holds a patient detail before it reaches the
+    // AI service (audit S2, 2026-10-13). The page checks first; this is the backstop.
+    rejectPatientDetailQuestion(answerBody);
     if (answerBody.summaryMode) {
       return jsonError(
         new PublicApiError("Document summaries require the streaming answer endpoint.", 400, {

src/app/api/answer/stream/route.ts

@@ -33,6 +33,7 @@ import { safeErrorLogDetails } from "@/lib/privacy";
 import { buildServerTimingHeader, preambleServerTimingEntries } from "@/lib/server-timing";
 import { startSseHeartbeat } from "@/lib/sse-heartbeat";
 import { parseJsonBody } from "@/lib/validation/body";
+import { rejectPatientDetailQuestion } from "@/lib/clinical-question-patient-check-server";
 import { answerRequestSchema, type AnswerRequestBody } from "@/lib/validation/answer-request";
 import type { AnswerStreamEventMap, AnswerStreamEventName } from "@/lib/answer-stream-contract";
 import { toPublicAnswerProgressEvent } from "@/lib/answer-progress-public";
@@ -309,6 +310,9 @@ function streamAnswer(
 export async function POST(request: Request) {
   try {
     const body = await parseJsonBody(request, answerRequestSchema, "Invalid answer request.");
+    // Refuse a question that looks like it holds a patient detail before it reaches the
+    // AI service (audit S2, 2026-10-13). The page checks first; this is the backstop.
+    rejectPatientDetailQuestion(body);
     const streamAbortController = new AbortController();
     const streamSignal = mergeAbortSignals([request.signal, streamAbortController.signal]);
     if (isDemoMode()) return streamAnswer(body, resolveRetrievalAccessScope(), streamSignal, streamAbortController);