Fix confirmed documentation drift from the audit review, reset First Nations letter on region change, queue ledger requests

.agents/skills/audit/SKILL.md

@@ -5,7 +5,7 @@ description: Perform a deep evidence-backed PsychSift repository audit and produ
 
 # Audit
 
-1. Define scope, read `docs/codex-review-protocol.md`, and inspect the review ledger.
+1. Define scope, read `docs/codex-review-protocol.md`, and check prior reviews with `npm run ledger:lookup -- <ref> --scope "<scope>"` rather than reading the ledger table directly.
 2. Inventory architecture, trust boundaries, changed areas, tests, and documented controls.
 3. Trace realistic correctness, security, privacy, clinical, data-loss, and reliability failures.
 4. Prove findings with exact files, lines, triggers, impact, and focused checks.

.cursor/agents/design-review.md

@@ -8,8 +8,8 @@ You are a senior design and UX reviewer for this clinical knowledge-base app (de
 ## Repository protocol
 
 1. Follow `docs/codex-review-protocol.md` and `AGENTS.md` review throttling.
-2. Check `docs/branch-review-ledger.md` before repeating an unchanged HEAD/scope review.
-3. Pure review is read-only except appending a ledger row when the review completes.
+2. Before every branch review, run `npm run ledger:lookup -- <ref> --scope "<scope>"`, and use its result to skip a repeat of an unchanged HEAD/scope review; never scan `docs/branch-review-ledger.md` by eye.
+3. Pure review is read-only except recording the review with `npm run ledger:append` when it completes; never hand-edit the ledger table.
 4. Read `docs/search-chrome-behaviour.md` and `docs/wiring-conventions.md` before judging search chrome or controls.
 5. Do not call OpenAI, Supabase, GitHub/hosted CI, or provider-backed gates without explicit approval.
 
@@ -72,4 +72,4 @@ Always report:
 - Routes and viewports exercised
 - Checks run / not run (and provider skips)
 - Residual visual or interaction risk
-- Ledger row fields for `docs/branch-review-ledger.md`
+- Fields for the immutable `npm run ledger:append` record (see `docs/branch-review-ledger.md`)

.design-sync/conventions.md

@@ -38,8 +38,9 @@ arbitrary-value form — never hardcoded colours:
   Outline only — never add a companion `focus:ring-*` / `box-shadow`. The shared base rule is one
   focus owner by design; a second ring both stacks a halo and wipes the control's resting elevation.
 
-Radius rules: `rounded-md` chips/pills, `rounded-lg` controls/cards/panels,
-`rounded-xl` sheets/dialogs. Tap targets: `min-h-tap` / `h-tap w-tap` (44px) —
+Radius rules: `rounded-sm` chips/pills, `rounded-md` controls/inputs/buttons,
+`rounded-lg` cards/table cards/popovers, `rounded-xl` panels/answer card, `rounded-2xl`
+sheets/dialogs. Tap targets: `min-h-tap` / `h-tap w-tap` (48px) —
 interactive controls only. A static chip is 28px text, not a touch target;
 putting `min-h-tap` on one is why dense tables scrolled so much.
 Dark mode is automatic via the `.dark` class — the variables flip; never write
@@ -65,8 +66,8 @@ glyphs). Label and caption **text** uses `--text-muted`.
 
 ## Opt-in v2 token layer
 
-`.ckb-v2` is an opt-in class that swaps in the v2 shell: white surfaces, a blue
-`--command`, a crisper `--e1`…`--e4` ladder, a 7-step type scale (size steps with
+`.ckb-v2` is an opt-in class that swaps in the v2 shell: white surfaces, a dark slate
+`--command` (`#111827`), a crisper `--e1`…`--e4` ladder, a 7-step type scale (size steps with
 shared `--leading-prose`; hero companions `--text-hero--line-height` /
 `--text-hero-tr` only — no per-step leading or tracking), semantic spacing
 (`--gap-*`, `--pad-*`), density (`--tap-min`, `--chip-height`, `--row-*`), icon

README.md

@@ -302,8 +302,9 @@ production Chromium gate, the repo-owned Supabase `db-reset-verify` migration
 replay, and both Docker image builds run only when their file scopes apply; a
 failed applicable container build therefore fails `pr-required`. UI PRs also
 get one non-blocking advisory Chromium invocation. The full Playwright browser matrix
-(`release-browser-matrix`) runs on `main`, `release/*`, manual dispatch, and a
-weekly schedule. Live drift and live eval canary checks remain provider-gated;
+(`release-browser-matrix`) runs on `release/*`, manual dispatch, and a weekly
+schedule, and on `main` when the diff is in UI, performance or lockfile scope. It is
+not part of `pr-required`, so it is a post-merge signal rather than a merge gate. Live drift and live eval canary checks remain provider-gated;
 Docker image builds also run independently on main/release pushes, schedule,
 and manual dispatch. They are not required for source-only PRs outside the
 container scope.
@@ -321,7 +322,7 @@ npm run samples:check
 npm run lint
 npm run typecheck
 npm run test
-npm run test:focused -- --files src/lib/example.ts
+npm run test:focused -- --files tests/a.test.ts,tests/b.test.ts  # replace with real paths
 npm run test:live # requires ALLOW_PROVIDER_TESTS=true
 npm run test:coverage
 npm run test:e2e

docs/branch-review-archival-policy.md

@@ -258,7 +258,7 @@ ref:
 
 **New with the generated index — the first partial enforcement.** `docs/branch-review-index.md`
 links every record it lists with a relative Markdown link, and `npm run docs:check-links`
-(which runs in `verify:cheap` and in CI) resolves relative link targets and fails when one does
+(which runs in `verify:full` and in CI) resolves relative link targets and fails when one does
 not exist. Deleting a record that the index lists therefore now breaks a required check. Be
 honest about the limit: this catches only deletions of records the index **already lists**, so
 a record appended and deleted before the index is next regenerated remains completely

docs/branch-review-ledger.md

@@ -37,7 +37,7 @@ The six columns are fixed: **Date · Branch or ref · Reviewed HEAD · Scope ·
 
 Record the **Reviewed HEAD** as the full 40-character SHA. `see PR head`, `pending final head`, and 8-character abbreviations are what made the throttle unreliable: no lookup can match them, so the review runs again. When the head genuinely does not exist yet, write `n/a - <reason>` and append a real record once it does.
 
-`npm run check:branch-review-ledger` (in `verify:cheap` and CI) enforces the `ledger` merge attribute, six cells per record, clean UTF-8 (no mojibake from a non-UTF-8 append), table-row records only, real dates, and no duplicates. Records dated 2026-07-29 or later must additionally carry a resolvable HEAD. The merge driver is installed by `npm install` / `hooks:install` (`merge.ledger.driver`). Archives under `docs/archive/branch-review-ledger-*.md` are checked for the same structural rules.
+`npm run check:branch-review-ledger` (in `verify:full` and CI) enforces the `ledger` merge attribute, six cells per record, clean UTF-8 (no mojibake from a non-UTF-8 append), table-row records only, real dates, and no duplicates. Records dated 2026-07-29 or later must additionally carry a resolvable HEAD. The merge driver is installed by `npm install` / `hooks:install` (`merge.ledger.driver`). Archives under `docs/archive/branch-review-ledger-*.md` are checked for the same structural rules.
 
 ### Rotation
 

docs/clinical-governance.md

@@ -64,7 +64,7 @@ and the ten locally authored differential records still carry no clinician sign-
 
 Use the `.github/pull_request_template.md` clinical governance section for any change that touches ingestion, answer generation, search/ranking, source rendering, document access, privacy, production environment behavior, or clinical output.
 
-- Confirm the Supabase target remains `Clinical KB Database` (`sjrfecxgysukkwxsowpy`).
+- Confirm the Supabase target remains `PsychSift Production` (`sjrfecxgysukkwxsowpy`).
 - Confirm service-role credentials and private document access remain server-only.
 - Confirm unknown or outdated source metadata is treated conservatively.
 - Confirm demo/synthetic content remains separated from real clinical sources.

docs/db-maintenance.md

@@ -75,12 +75,12 @@ A schema restore is not operationally complete until all five environment-owned
 
 ### 1. `pg_cron` schedules & retention jobs
 
-- **Procedure:** Re-create scheduled jobs for ingestion workers and telemetry retention (`purge-expired-rag-queries`, `purge-rag-retrieval-logs`, `purge-rag-query-misses`, `purge-rag-response-cache`).
+- **Procedure:** Re-create the `invoke_indexing_v3_agent` schedule and the telemetry retention jobs (`purge-expired-rag-queries`, `purge-rag-retrieval-logs`, `purge-rag-query-misses`, `purge-rag-response-cache`). Do **not** re-create `invoke_ingestion_worker`: it was retired by `20260926041000` and the container worker owns ingestion. The step-by-step cron re-creation (copy the definition from the source project, keep it inactive on non-production until the endpoint check passes) is in `docs/disaster-recovery-runbook.md` step 1.
 - **Sanity check:** Verify with a read-only query:
   ```sql
   SELECT jobid, jobname, schedule, active FROM cron.job ORDER BY jobid;
   ```
-  Confirm all four retention jobs and any active ingestion cron rows report `active = true`.
+  Confirm all four retention jobs report `active = true`, that `invoke_indexing_v3_agent` exists (active on production; inactive on a non-production target until the GUC check below passes), and that no `invoke_ingestion_worker` job exists.
 
 ### 2. Supabase Vault secrets
 
@@ -93,20 +93,22 @@ A schema restore is not operationally complete until all five environment-owned
 
 ### 3. Custom database GUCs
 
-- **Procedure:** Re-set required custom parameters (e.g. `app.indexing_agent_url`) using `ALTER DATABASE postgres SET ...`.
-- **Sanity check:** Verify settings with a read-only query:
+- **Procedure:** Re-set required custom parameters (e.g. `app.indexing_v3_agent_base_url`) by running `ALTER DATABASE postgres SET ...` as the project owner (`postgres`) in an operator session. The migration/`schema.sql` statement skips with a notice when its role lacks the privilege, so it cannot be relied on. If the value is unset, `invoke_indexing_v3_agent` falls back to the hardcoded production host; on a non-production restore, keep the `invoke_indexing_v3_agent` cron job inactive until the sanity check below shows the right value.
+- **Sanity check:** Verify the stored database-level value with a read-only query (`ALTER DATABASE ... SET` does not change the current session, so `pg_settings` in the same session can be stale; use this or a new connection):
   ```sql
-  SELECT name, setting, source FROM pg_settings WHERE name LIKE 'app.%';
+  SELECT unnest(setconfig) FROM pg_db_role_setting
+  WHERE setdatabase = (SELECT oid FROM pg_database WHERE datname = 'postgres') AND setrole = 0;
   ```
   Confirm configured values match the target environment.
 
 ### 4. Supabase Edge Functions
 
-- **Procedure:** Redeploy required edge functions (`indexing-v3-agent`, ingestion worker) with the Deno v2.x toolchain in an explicitly approved change window:
+- **Procedure:** Redeploy both required edge functions (`indexing-v3-agent` and `site-content-sync`, which consumes the `site_content_sync_events` outbox; the ingestion-worker function is retired and must not be redeployed) with the Deno v2.x toolchain in an explicitly approved change window:
   ```bash
   supabase functions deploy indexing-v3-agent --project-ref <PROJECT_REF>
+  supabase functions deploy site-content-sync --project-ref <PROJECT_REF>
   ```
-- **Sanity check:** Verify function presence and status via `supabase functions list` and run health probes without mutating data.
+- **Sanity check:** Verify both `indexing-v3-agent` and `site-content-sync` are present and active via `supabase functions list`. Run `supabase secrets list --project-ref <PROJECT_REF>` (it prints names and digests only, never values) and confirm `OPENAI_API_KEY` is present; `site-content-sync` needs it to embed new or changed content and otherwise records `provider_failure`. If it is missing, restore it through the approved secret-management procedure without printing its value. `site-content-sync` has no read-only health endpoint: it accepts only `POST`, and a `POST` records an invocation and claims queued outbox events, so invoking it is an operational action that needs separate approval, not a health probe.
 
 ### 5. Dashboard-owned configuration
 

docs/deployment-architecture.md

@@ -581,9 +581,9 @@ using Railway's `ALWAYS` restart policy so repeated bootstrap failures cannot
 exhaust a finite retry allowance and leave the queue undrained.
 The `indexing-v3-agent` Edge Function **stays** in its current role as the
 cron-triggered completion/repair gate — the two are complementary, not
-alternatives. The worker service selects its Dockerfile via the
-`RAILWAY_DOCKERFILE_PATH=Dockerfile.worker` variable (captured in
-`railway.worker.json`).
+alternatives. The worker service selects its Dockerfile through
+`build.dockerfilePath: "Dockerfile.worker"` in `railway.worker.json` (Railway
+config-as-code), not through a service variable.
 
 > **Operator run recipe:** the copy-pasteable build/run/verify steps, the
 > required env + secrets, and the pre-deploy migration gate live in

docs/design-system/ADOPTION.md

@@ -5,8 +5,9 @@ of truth is `adoption-contract.json`; the generated manifest and marked tables i
 must match it exactly.
 
 - **Date:** 12 August 2026
-- **Current state:** 55 visual references are locally registered; all 51 production page routes
-  are owned across 14 surface families, with 59 route/component roots scanned; every declared
+- **Current state:** 55 visual references are locally registered; all 224 production page routes
+  are owned across 14 surface families, with 232 route/component roots scanned (the generated
+  table below is authoritative if these drift); every declared
   root uses the v2 shell and has declared proof with no committed visual baseline.
 - **Phase 1 blockers resolved first, in their own commits:** `#207` ungrounded `AnswerState`,
   `#208` clipboard composition. See [SPEC.md](SPEC.md) §13 PR 6 clinical review, blockers 1–2.