fix: resolve 16 open non-RAG issues across roster, on-call, reindex, UI virtualization, browser matrix, and monoliths

.github/workflows/live-domain-monitor.yml

@@ -119,6 +119,7 @@ jobs:
           sparse-checkout: |
             scripts/check-live-deployment-freshness.mjs
             scripts/check-live-search-results.mjs
+            scripts/lib/is-entrypoint.mjs
           sparse-checkout-cone-mode: false
 
       - name: Live deployment has not been stranded behind main

.github/workflows/sast.yml

@@ -41,10 +41,14 @@ jobs:
 
       - name: Semgrep scan
         continue-on-error: true
-        # --error fails the job on any ERROR-severity finding; --oss-only keeps
-        # it token-free; --metrics off sends no telemetry. Named registry rules
-        # remain advisory because they can change independently of this repository.
-        # Secrets are covered by Gitleaks in secret-scan.yml, so no p/secrets here.
+        # --error fails the step on any ERROR-severity finding; --oss-only keeps
+        # it token-free; --metrics off sends no telemetry. Named upstream registry
+        # rules (p/typescript, p/javascript, p/react, p/nodejs) remain advisory at
+        # the workflow boundary (#237JN5) because upstream rule definitions can
+        # change independently of this repository, while the blocking Ingestion
+        # SAST gate in ci.yml enforces deterministic merge-blocking checks on the
+        # untrusted document-upload surface. Secrets are covered by Gitleaks in
+        # secret-scan.yml, so no p/secrets here.
         run: >
           semgrep scan
           --error
@@ -55,4 +59,4 @@ jobs:
           --config p/javascript
           --config p/react
           --config p/nodejs
-          src worker scripts supabase/functions
+          src worker scripts eslint-rules supabase/functions

bundle-budget.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "Client JS bundle-size budgets captured from a known-good production build. `production` guards aggregate user-facing chunks, `routes` guards the Lighthouse journeys and the main work-mode pages (added by the work-mode speed review, 7 Oct 2026) against route-local growth (route baselines lowered about 100 KB on 7 Oct 2026 (scaled from a local build by the ratio to the baselineSource build, so they stay comparable with it) when the sign-in library moved out of the first load, so that saving cannot quietly regrow), and `mockups` is a looser design-scratch hygiene ceiling. The `production` baseline alone was raised on 9 Oct 2026 to a local build of the hospital roles change merged with main (5472.8 KiB), after its 145 KiB duplicated-chunk regression was removed: main had already reached +9.8% from the combined work-mode growth. Route baselines and baselineSource were left as they were. Refresh intentionally with `npm run check:bundle-budget -- --update`. On 13 Oct 2026 the owner approved resetting two route baselines, /roster/shifts (390.9 KiB) and /teaching/assessments (459.3 KiB), to a local production build of main at f4bcb55a4 (which matched CI's own measurement of that commit), because main had already reached +9.7% and +8.9% there. All other baselines were left as they were.",
+  "$comment": "Client JS bundle-size budgets captured from a known-good production build. `production` guards aggregate user-facing chunks, `routes` guards the Lighthouse journeys and the main work-mode pages (added by the work-mode speed review, 7 Oct 2026) against route-local growth (route baselines lowered about 100 KB on 7 Oct 2026 (scaled from a local build by the ratio to the baselineSource build, so they stay comparable with it) when the sign-in library moved out of the first load, so that saving cannot quietly regrow), and `mockups` is a looser design-scratch hygiene ceiling. The `production` baseline alone was raised on 9 Oct 2026 to a local build of the hospital roles change merged with main (5472.8 KiB), after its 145 KiB duplicated-chunk regression was removed: main had already reached +9.8% from the combined work-mode growth. On 13 Oct 2026 the owner approved resetting two route baselines, /roster/shifts (390.9 KiB) and /teaching/assessments (459.3 KiB), to a local production build of main at f4bcb55a4. On 14 Oct 2026 PR #3538 (8f2a188ea4) refreshed baselines from main at f8f664425d4c (production 6,062,493 B, tightened mockups 670,993 B, totalGzipBytes 6,733,486 B, and the 13 monitored routes) after landing clinical math calculators, work search grammar, attendance roster, QR check-in helper, safe-number editor, and WA MHA print forms. Refresh intentionally with `npm run check:bundle-budget -- --update` and update this comment to cite the new baselineSource.",
   "enforce": true,
   "production": {
     "gzipBytes": 6062493,

data/repo-awareness-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": "repo-awareness-snapshot-v3",
   "captured_revision": {
-    "committed_at": "2026-10-15"
+    "committed_at": "2026-10-16"
   },
   "routes": {
     "modes": [