diff --git a/data/outstanding-issues-snapshot.json b/data/outstanding-issues-snapshot.json
index f59de2d743..9db655ca7b 100644
--- a/data/outstanding-issues-snapshot.json
+++ b/data/outstanding-issues-snapshot.json
@@ -4,13 +4,13 @@
     "committed_at": "2026-10-09"
   },
   "counts": {
-    "open": 141,
-    "p1": 14,
-    "p2": 74,
-    "p3": 53,
+    "open": 109,
+    "p1": 17,
+    "p2": 55,
+    "p3": 37,
     "queued": 6,
     "pending": 0,
-    "resolved": 717
+    "resolved": 787
   },
   "queue": [
     {
@@ -243,39 +243,12 @@
       "source": "Owner phone report 2026-09-04 during PR #2590 follow-up; screenshot of Answer mode, query 'lithium level timing'; session 2026-09-13 live QA; retract duplicate inbox add 9b595f7f",
       "added": "2026-09-04"
     },
-    {
-      "id": "#3944SV",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "clearlyNonClinicalConsumerPattern refuses in-corpus psychiatric queries on bare consumer tokens, the same defect as the topic denylist",
-      "detail": "REVIEW 2026-09-25 (offline audit of current main; no provider access): Offline probe on current main: 'phone contact after discharge' (confidence 0.432, above the 0.42 cutoff), 'car accident trauma assessment', 'tv watching and negative symptoms', 'holiday leave from the ward' and 'flight of ideas in mania' still short-circuit. 'restaurant avoidance in social anxiety' now reaches retrieval via the psychiatricOrClinicalContextPattern override (3f2bb4771); 'mania' and 'discharge' are not in that override. Partial mitigation only. PRIOR DETAIL: Found while fixing #000GN4 (2026-09-02, probed against the real analyzeClinicalQuery on main at 45a3dcacb54a). src/lib/rag/rag-query-guard.ts:3-4 short-circuits any soft-tail-eligible query matching bare tokens including phone, car, tv, television, restaurant, holiday, hotel, flight, kitchen and laptop. Measured, with shouldShortCircuitUnsupportedSearch on the real analyzer: 'phone contact after discharge' short-circuits to zero retrieval while 'telephone follow up after discharge' reaches retrieval, and the word 'phone' is the only difference. Post-discharge phone contact is a topic this repo actively builds for - see the Caring Contacts work. Also confirmed refused by the pattern alone, with confidence and expandedTerms both above the soft-tail thresholds so the pattern is the sole cause: 'restaurant avoidance in social anxiety', 'car accident trauma assessment', 'tv watching and negative symptoms', 'holiday leave from the ward'. Separately, the token 'flight' matches 'flight of ideas', a core sign of mania, though that query would short-circuit through the soft tail anyway. This is milder than #000GN4 because these tokens sit behind unsupportedSoftTailEligible rather than firing unconditionally, but the mechanism is identical: a bare token standing in for a topic judgement. FIX: the same shape as #000GN4 - replace bare tokens with phrases that cannot occur in a clinical question, or route the decision through classifyCorpusGrounding where the query is soft-tail eligible anyway. Protected RAG surface: needs the RAG impact declaration, the clinical governance preflight, and an eval:quality --rag-only run, since the consumer controls in rag-eval-cases.ts (coffee machine, air fryer, overnight oats) are what this pattern pins. Note unavailableDocumentNoisePattern was checked in the same pass and is clean - every entry there is a multi-word phrase.",
-      "source": "src/lib/rag/rag-query-guard.ts:3-4; probed with shouldShortCircuitUnsupportedSearch against analyzeClinicalQuery on main 45a3dcacb54a; RAG retrieval review of PR branch claude/rag-query-guard, 2026-09-02",
-      "added": "2026-09-02"
-    },
-    {
-      "id": "#RP00FZ",
-      "priority": "P2",
-      "type": "task",
-      "summary": "Reindex reaper: the storage-object half of the abandoned-generation cleanup is still missing",
-      "detail": "PARTIAL PROGRESS, recorded here so it is not tracked only in code comments. The DETECTION half landed on branch claude/reindex-reaper: scripts/cleanup-abandoned-reindex-generations.ts gained a read-only --alert-on-abandoned flag whose pure decision function (abandonedReindexGenerationAlertExitCode in src/lib/reindex-pipeline.ts) exits 2 when a dry run finds abandoned staged rows, and .github/workflows/reindex-reaper.yml runs it as a weekly read-only probe that opens or updates an alert issue. That workflow ships INERT (repo variable REINDEX_REAPER_ENABLED is unset) and its destructive apply path is triple-gated and statically guarded by scripts/check-github-action-pins.mjs. WHAT REMAINS, and what this row exists for: the storage-object half. cleanup_abandoned_document_index_generations deletes generation-bearing rows across seven artifact tables, but nothing enqueues storage_cleanup_jobs rows for the objects those generations left behind, so a crash mid-reindex still leaks Storage objects that no schedule revisits. The recorded fix is for the commit RPC to enqueue storage_cleanup_jobs rows for superseded generations at commit time. That is a migration, it deploys to the live clinical database on merge, and it was deliberately excluded from the detection batch. THREE PREREQUISITES the same review recorded, all of which should land before the repo variable REINDEX_REAPER_APPLY is ever set: (1) the RPC has no owner scoping and no row ceiling -- seven deletes in one transaction under a 180s statement timeout -- so a migration adding a row ceiling and a keep-most-recent-generation guard should come first; (2) the RPC's predicate makes every generation-bearing row eligible on any document whose metadata.index_generation_id is absent, so documents predating generation stamping will register as abandoned forever and the weekly probe will very likely be permanently red until either a backfill migration lands or the probe alerts on a delta rather than an absolute count; (3) arming the apply path safely needs a GitHub Environment with required reviewers on a separate apply job, because two of the three gates are standing repository variables and only client_payload.apply is per-run. Full reasoning is in the header of .github/workflows/reindex-reaper.yml.",
-      "source": "review of branch claude/reindex-reaper, 2026-09-02",
-      "added": "2026-09-02"
-    },
-    {
-      "id": "#XSZ4XV",
-      "priority": "P2",
-      "type": "task",
-      "summary": "Audit remediation leftovers: calculator governance link, stale Docling pin references, unrecorded Docling model treeDigest",
-      "detail": "PARTLY FIXED 2026-09-25: (1) the calculator governance reference now renders as plain text, not a link, per the owner decision (8465d2e97, search-detail.tsx; pinned by tests/calculators-clinical-safety.dom.test.tsx). The url in data/calculators/evidence.json is unchanged. (2) eval/docling/README.md and docs/worker-deploy-runbook.md now name the version pinned in eval/docling/requirements.txt instead of the stale docling==2.120.2 (7bd62e845; pinned by tests/docling-model-artifacts.test.ts); the Gate B decision record was left alone as history. STILL OPEN: (3) eval/docling/model-artifacts.json has treeDigest null, so the model pin only warns; one operator Docker build records it. Earlier history: PR #2920 (2026-09-19) landed vendored brand fonts, the Docling artifact-digest check and the real offline BrandMark; CACHE_VERSION was already done.",
-      "source": "Codex review PR #2701 discussion_r3946596430; corrects #4BE39H",
-      "added": "2026-09-07"
-    },
     {
       "id": "#9Z197J",
       "priority": "P2",
       "type": "issue",
-      "summary": "release-browser-matrix Firefox/WebKit failures: four of six Firefox ones fixed (three sub-pixel artefacts merged, dark-mode test ordering merged), two Firefox and all eight WebKit still open, and the job is not in PR required so it never blocks a merge",
-      "detail": "Failure count substantially reduced by layout tolerance and settled-click repairs; main-failure-routing active. PRIOR DETAIL (restored 2026-10-09, an earlier update replaced it wholesale): UPDATE 2026-09-25 from the owner-supplied Ultimate Audit Master Report (audit F10), not reproduced offline: the WebKit phone-chrome failures include header overlay, composer visibility, scroll animation and narrow settings geometry, with one settings position measured at -140 px. Audit recommendation: audit the shared scroll controller, safe-area geometry and scroll-container ownership rather than per-test fixes. The audit duplicate-<main> finding (F08) is already resolved as the hidden streaming clone (#TWS2GD); the Specifiers mobile Axe failure and the Differentials ChunkLoadError are separate rows queued the same day. PRIOR DETAIL: UPDATE 2026-09-20 (six Firefox failures read from the job log of main run 35503893104; four now addressed, two open; no Firefox was run - see the egress row). THE COUNT AND THE CLASSIFICATION IN THIS ROW WERE BOTH WRONG. Firefox failed SIX, not five, and only THREE were tolerance, not five. FIXED AND MERGED (PR #2932): three sub-pixel artefacts - a 16px card gap measured 15.999969482421875, a 12px column gap measured 11.999954223632812, and a 48px tap target measured 47.98333740234375 against its existing 2px allowance. The first two are float error from subtracting two client rects; the third is Firefox storing layout in app units of 1/60 CSS px, so 47.98333740234375 is exactly 2879/60 - one app unit short, the smallest miss the engine can express. tests/helpers/layout-tolerance.ts holds one 0.05px tolerance, mutation-tested from both sides. No floor lowered, nothing skipped or quarantined. FIXED, MERGED as PR #2933 at 0cfdd250e on 2026-09-20, verified as an ancestor of this reconciliation - originally recorded as AWAITING MERGE because the request was queued before it landed: the fourth, ui-on-call-boards dark mode, was TEST ORDERING and not an app bug. It set the colour-scheme override while the page was still on about:blank, and Playwright Firefox does not carry that into the first navigation; the theme is resolved once pre-paint by the bootstrap in src/lib/theme.ts, so a late preference is already missed. PROOF IT IS NOT THE APP: the twelve dark assertions in ui-caring-contacts-workspace.spec.ts PASS on Firefox in this same run (tests 48, 53, 59, 65, 72, 79, 85, 100, 138, 152, 159, 169) and every one navigates first and switches scheme after. An earlier reading blamed color-scheme: light on :root and concluded dark mode was broken for every Firefox and Safari user; those twelve passes refute it. Do not reopen the design-system dark contract on this evidence. STILL OPEN: the remaining two Firefox failures are tracked separately - see the row for the document-viewer hit counter and the tools Forms panel. The eight WebKit failures are UNCHANGED and still unexamined; the six phone-chrome ones remain the likely-real-iPhone-bug reading recorded above. UPDATE 2026-09-20 (read from the GitHub job logs of the latest main release-browser-matrix run; still no local browser run, provisioning fails here as described below). THE COUNT IS 13, NOT 15: Chromium green in ~8 min; Firefox 700 passed / 5 failed in ~28 min; WebKit 696 passed / 8 failed in ~40 min. THE 2026-09-06 CONCLUSION IS HALF WRONG AND THE CORRECTION IS THE POINT OF THIS UPDATE. The Firefox half is tolerance work as recorded — one failure is provably a measurement artefact, Expected >= 12 / Received 11.999954223632812, a sub-pixel rounding difference and nothing more. THE WEBKIT HALF IS NOT. Six of the eight WebKit failures are phone scroll, header, footer and composer behaviour. WebKit is Safari engine, so on an iPhone those are candidate real user-visible bugs, not engine-geometry tolerance, and must be read as a bug report rather than assertion-loosening work. ORDER: fix the five Firefox tolerances first because they are cheap and provably artefacts, then treat the six WebKit phone-chrome failures as a defect investigation, and do that before the tablet row #6GR6B8 because the two are plausibly the same root cause. QUARANTINING IS STILL THE WRONG ANSWER, and more so now: quarantining a phone-chrome failure on Safari engine would hide a defect, not a flake. tests/flake-ledger.json is for REPRODUCED flakes, requires @quarantine in the test title, and expires every entry within 31 days — and it is currently empty by design. NOT FIXED 2026-09-18. WHY IT WAS NOT DONE: the failures are only visible by running Firefox and WebKit, and browser provisioning fails in this environment — scripts/setup-claude-cloud.sh browsers returns 403, no allowlist entry for cdn.playwright.dev. A substitute Chromium exists at /opt/pw-browsers and playwright.config.ts honours PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH, so Chromium work is possible here; the other two engines are not. Sizing this needs a machine that can run all three. Note also that this is the one thing keeping main red, so it will be the first failure the new red-main reporting (#T82ND3) raises. Historical note only: an earlier 2026-09-06 write-up used a 15-failure count and treated the whole set as deterministic geometry differences to loosen; that count and that blanket remedy are superseded by this update and must not be reapplied.",
+      "summary": "release-browser-matrix Firefox/WebKit failures: WebKit now runs in CI and its ~26 failures are down to intermittent timing races (2026-10-12); confirm the next main run, and the job is not in PR required so it never blocks a merge",
+      "detail": "UPDATE 2026-10-12 (read from main CI job logs via the GitHub MCP; WebKit cannot run in the cloud container): WebKit/Safari now launches in CI (PR #3487) and the ~26 genuine Safari failures it exposed were fixed test-side in small PRs #3492-#3494 and #3501-#3504, with no test skipped, quarantined or loosened. Main run 38300091965 (after #3503) had every Firefox, WebKit desktop, phone and tablet shard green except ONE installed-app (mobile-pwa-standalone) failure, the DSM category facet keyboard test, fixed in #3504. PATTERN: the last three failures were the same race, a keypress or fill straight after navigation before React attached the handler, which slower WebKit runners expose intermittently. Use expectHydrated (tests/playwright-settlement.ts) or the handler poll in tests/ui-clinical-ask.spec.ts before the first interaction after load. NEXT: read the release-browser-matrix jobs of the first main run after #3504; if all green, close this row. A new single failure of the same shape is the same race in another test, not an app bug. The two Firefox items in #33346A did not fail in runs 38291430591 or 38300091965 (Firefox 3/3 green both times); re-check before working that row. PRIOR DETAIL: Failure count substantially reduced by layout tolerance and settled-click repairs; main-failure-routing active. PRIOR DETAIL (restored 2026-10-09, an earlier update replaced it wholesale): UPDATE 2026-09-25 from the owner-supplied Ultimate Audit Master Report (audit F10), not reproduced offline: the WebKit phone-chrome failures include header overlay, composer visibility, scroll animation and narrow settings geometry, with one settings position measured at -140 px. Audit recommendation: audit the shared scroll controller, safe-area geometry and scroll-container ownership rather than per-test fixes. The audit duplicate-<main> finding (F08) is already resolved as the hidden streaming clone (#TWS2GD); the Specifiers mobile Axe failure and the Differentials ChunkLoadError are separate rows queued the same day. PRIOR DETAIL: UPDATE 2026-09-20 (six Firefox failures read from the job log of main run 35503893104; four now addressed, two open; no Firefox was run - see the egress row). THE COUNT AND THE CLASSIFICATION IN THIS ROW WERE BOTH WRONG. Firefox failed SIX, not five, and only THREE were tolerance, not five. FIXED AND MERGED (PR #2932): three sub-pixel artefacts - a 16px card gap measured 15.999969482421875, a 12px column gap measured 11.999954223632812, and a 48px tap target measured 47.98333740234375 against its existing 2px allowance. The first two are float error from subtracting two client rects; the third is Firefox storing layout in app units of 1/60 CSS px, so 47.98333740234375 is exactly 2879/60 - one app unit short, the smallest miss the engine can express. tests/helpers/layout-tolerance.ts holds one 0.05px tolerance, mutation-tested from both sides. No floor lowered, nothing skipped or quarantined. FIXED, MERGED as PR #2933 at 0cfdd250e on 2026-09-20, verified as an ancestor of this reconciliation - originally recorded as AWAITING MERGE because the request was queued before it landed: the fourth, ui-on-call-boards dark mode, was TEST ORDERING and not an app bug. It set the colour-scheme override while the page was still on about:blank, and Playwright Firefox does not carry that into the first navigation; the theme is resolved once pre-paint by the bootstrap in src/lib/theme.ts, so a late preference is already missed. PROOF IT IS NOT THE APP: the twelve dark assertions in ui-caring-contacts-workspace.spec.ts PASS on Firefox in this same run (tests 48, 53, 59, 65, 72, 79, 85, 100, 138, 152, 159, 169) and every one navigates first and switches scheme after. An earlier reading blamed color-scheme: light on :root and concluded dark mode was broken for every Firefox and Safari user; those twelve passes refute it. Do not reopen the design-system dark contract on this evidence. STILL OPEN: the remaining two Firefox failures are tracked separately - see the row for the document-viewer hit counter and the tools Forms panel. The eight WebKit failures are UNCHANGED and still unexamined; the six phone-chrome ones remain the likely-real-iPhone-bug reading recorded above. UPDATE 2026-09-20 (read from the GitHub job logs of the latest main release-browser-matrix run; still no local browser run, provisioning fails here as described below). THE COUNT IS 13, NOT 15: Chromium green in ~8 min; Firefox 700 passed / 5 failed in ~28 min; WebKit 696 passed / 8 failed in ~40 min. THE 2026-09-06 CONCLUSION IS HALF WRONG AND THE CORRECTION IS THE POINT OF THIS UPDATE. The Firefox half is tolerance work as recorded — one failure is provably a measurement artefact, Expected >= 12 / Received 11.999954223632812, a sub-pixel rounding difference and nothing more. THE WEBKIT HALF IS NOT. Six of the eight WebKit failures are phone scroll, header, footer and composer behaviour. WebKit is Safari engine, so on an iPhone those are candidate real user-visible bugs, not engine-geometry tolerance, and must be read as a bug report rather than assertion-loosening work. ORDER: fix the five Firefox tolerances first because they are cheap and provably artefacts, then treat the six WebKit phone-chrome failures as a defect investigation, and do that before the tablet row #6GR6B8 because the two are plausibly the same root cause. QUARANTINING IS STILL THE WRONG ANSWER, and more so now: quarantining a phone-chrome failure on Safari engine would hide a defect, not a flake. tests/flake-ledger.json is for REPRODUCED flakes, requires @quarantine in the test title, and expires every entry within 31 days — and it is currently empty by design. NOT FIXED 2026-09-18. WHY IT WAS NOT DONE: the failures are only visible by running Firefox and WebKit, and browser provisioning fails in this environment — scripts/setup-claude-cloud.sh browsers returns 403, no allowlist entry for cdn.playwright.dev. A substitute Chromium exists at /opt/pw-browsers and playwright.config.ts honours PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH, so Chromium work is possible here; the other two engines are not. Sizing this needs a machine that can run all three. Note also that this is the one thing keeping main red, so it will be the first failure the new red-main reporting (#T82ND3) raises. Historical note only: an earlier 2026-09-06 write-up used a 15-failure count and treated the whole set as deterministic geometry differences to loosen; that count and that blanket remedy are superseded by this update and must not be reapplied.",
       "source": "Release matrix review",
       "added": "2026-09-07"
     },
@@ -283,7 +256,7 @@
       "id": "#Z3GZ5P",
       "priority": "P2",
       "type": "task",
-      "summary": "DSM-5-TR specifier catalogue has no clinician sign-off: 585 items, 71 signed off in PR #3143, 514 still pending review",
+      "summary": "DSM-5-TR specifier catalogue: 514 of 585 items still pending clinician review, and the 71 marked reviewed in PR #3143 name no clinician reviewer",
       "detail": "71 specifiers signed off in PR #3143; pending review dropped from 585 to 514. PRIOR DETAIL (restored 2026-10-09, an earlier update replaced it wholesale): UPDATE 2026-09-25 (offline traversal of data/specifiers-content.json; no provider access). Two corrections to this row's own headline, both reproducible from the committed file. FIRST: '71 source-verified' overstates the work. 57 of the 71 restate their own label, matching 'For <disorder>, \"<label>\" uses the stated threshold: <the label's own parenthesis>' — the Adjustment Disorders entry for 'Acute (less than 6 months)' resolves to 'uses the stated threshold: less than 6 months'. Only 14 carry content beyond the label, all in the ICD-11 trauma, dissociative, ARFID and personality material. Real coverage is 14 of 585, not 71. SECOND: neurodevelopmental, schizophrenia spectrum, bipolar, depressive and anxiety disorders hold 192 items and no definitions between them, so the commonest presentations are the least covered. SETTLED 2026-09-18 (owner instruction): the sign-off value is clinician-reviewed-approved, set only by a named clinician; the unit of work is one definition per specifier plus per-disorder exception notes; severity and remission for sexual dysfunctions and paraphilic disorders (41 of 164 undefined severity items) are out of scope. PR #3028 made the audit recognise clinician-reviewed-approved — under the previous exact-match test the first signed specifier would have gone unexamined. WORKLIST AND FIRST ENTRY, both on main from PR #2879: docs/specifier-definition-worklist-2026-09-18.md (A/B/C triage; Group A is 63 management-changing rows carrying only 17 distinct labels) and docs/specifier-entry-worksheet-with-catatonia.md (all nine disorders enumerated, every clinical statement blank). NEXT ACTION is clinician-only: write the four blanks in section 1 of the worksheet. No agent writes the clinical text.",
       "source": "PR #3143 review",
       "added": "2026-09-07"
@@ -306,15 +279,6 @@
       "source": "Claude Code session 2026-09-06 (session_01GMHX5TDG34BBn2yDdi81s5), measured across data/differentials-snapshot.json while building PR #2665",
       "added": "2026-09-07"
     },
-    {
-      "id": "#CHPC5C",
-      "priority": "P3",
-      "type": "issue",
-      "summary": "ui-tools differentials compare queue navigation is intermittently slow enough to time out inside the full Production UI shard 3",
-      "detail": "UPDATE 2026-09-27: FIX BUILT on branch claude/repo-review-design-fixes-ao0dqw (PR #3145), NOT YET MERGED — close this row only after it lands. The 'way out' below was built: claimPhoneOverlayAddonReserve (use-phone-overlay-chrome-reserve.ts) is called by both portals and writes --phone-overlay-chrome-h inline as calc(<value in force> + <row>px) before settle, re-measures after settle, and subtracts the row on release. A production-build trace found a second cause: under reduced motion every element gets a 0.01ms transition and transition-property defaults to all, so the pad painted the stale padding-top for one frame; globals.css now sets transition-property: none on mobile-composer-reserve-pad at phone width. The required Playwright settle assertion was added (#CHPC5C test in tests/ui-phone-scroll.spec.ts): 10/10 pass on a production build, fails on the pre-fix portals. verify:full green (20027 tests); the full verify:phone-chrome run was stopped by the owner at ~342/687 and is left to CI. PREVIOUS: CAUSE FOUND AND PROVEN 2026-09-20; NO LONGER PARKED. This is not a flaky test — it catches a real phone defect that also hits clinicians. The Differentials mode-nav row (49px) paints IN page flow, then ModeNavHeaderPortal moves it into the fixed phone header at ~315ms; content loses that height and every element rises 49px. usePhoneOverlayChromeReserve only republishes the measured 121px at ~423ms, so for ~110ms the whole page sits 49px too high. A press that straddles that correction lands on one control and releases on another: recorded trace shows pointerdown on the compare-open link at y 492-540, pointerup at the identical y hitting \"Edit selection\" because the link had moved to 443-491, and the browser retargeting the click to their common ancestor. The link never activates — no error, no navigation. scrollY is 0 throughout, so this is layout, not scrolling, and Playwright hit-target checks cannot see it because press and release were each individually on a real element. EVIDENCE: 0/41 reproductions through the repo runner (10x alone, 10x under 4 busy loops, 20x under 12, plus a full shard) — shard load is not the right kind of slowness. Under Chrome DevTools renderer throttling: 0/10 at 4x, 10/10 at 10x, 9/10 at 20x, and 0/10 at 10x when the phone chrome is allowed to settle first. That last row is the control. TWO CORRECTIONS TO THIS ROW. (1) It is the PHONE click that fails, not the desktop one. tests/ui-tools.spec.ts:2928 is the test declaration; the test contains two compare-open clicks, and the URL CI recorded has no q=Pain, which matches the 390x844 phone block. Above the phone breakpoint the reserve publishes 0px and no addon row mounts, so desktop is not exposed. (2) The TO-UNBLOCK suggestion in this row does not work and is refuted: the destination \"Loading presentation\" role=status skeleton cannot be the settle signal, because it lives inside the destination route and only renders AFTER the URL commits. Proven by holding the destination response 20s — urlChangedAfterMs 20130, loadingSkeletonSeenAfterMs null. The \"racing an unhydrated link\" hypothesis is the right family but the wrong mechanism: the link is a plain next/link anchor from a Server Component, so a pre-hydration click would still navigate natively. The race is hydration-driven LAYOUT, not handlers. STILL OPEN AFTER PR #2929 — READ THIS BEFORE CLOSING THE ROW. PR #2929 (publishPhoneOverlayChromeReserveNow, called from both portals) closes this only for IN-SESSION navigation, and NOT for the cold page.goto the trace above was taken on, which is the path CI fails on. The publisher refuses to act until the reserve hook has settled a value at least once — it must, because before that responsive layout can still report the wide 200px stack (#147) and publishing that would move content twice. React runs layout effects children-first and the hook belongs to the shell, so on a cold load a portal effect ALWAYS runs before the hook has settled and the immediate publish is suppressed, every time. Established by adversarial review of #2929 and independently reproduced; pinned as failing-when-fixed cases in tests/phone-overlay-reserve-portal-wiring.dom.test.tsx, which is also the only coverage of the portals wiring at all — every case in tests/phone-overlay-chrome-reserve.dom.test.ts calls the publisher directly and would pass with both useLayoutEffect blocks deleted. A second gap: unmounting a portal does not shrink the reserve, so content sits 49px too LOW instead; a cleanup cannot simply publish, because React runs layout-effect destroys before it detaches portal children. THE WAY OUT, not yet built or verified: have the portal publish its OWN height as a delta to the reserve currently in force instead of re-measuring the whole stack. That removes the #147 exposure, and with it the settle precondition, and it gives the shrink direction naturally via the effect cleanup. It is a real change to shared phone chrome on every route and needs its own browser evidence — verify:phone-chrome plus the Playwright settle assertion docs/search-chrome-behaviour.md mandates, which was not added and is still required. OWNER DECISION PENDING on whether to do that work. MERGE VERIFICATION, carried over from the refuted request a13b357d so it is not lost: #2929 merged 2026-09-20 as commit 80cf3df6c69a, and publishPhoneOverlayChromeReserveNow is present on origin/main in globals.css, phone-header-collapse-portal.tsx and use-phone-overlay-chrome-reserve.ts. That request read presence as proof the defect was fixed and told future sessions it MUST NOT BE REDONE; presence is not execution, and the scope limit above is why. It was cancelled with that reasoning recorded.",
-      "source": "Claude Code session 2026-09-20 (session_01VE1C4eJidBwMdfHV4nUJgL); reissued against the current row after fbc169da applied; scope limit reproduced in tests/phone-overlay-reserve-portal-wiring.dom.test.tsx (PR #2938)",
-      "added": "2026-09-07"
-    },
     {
       "id": "#2G06NM",
       "priority": "P2",
@@ -324,15 +288,6 @@
       "source": "#ZK460W fix, offline adversarial harness run on branch claude/rag-review-fallback-grounded-flip",
       "added": "2026-09-07"
     },
-    {
-      "id": "#458SAC",
-      "priority": "P3",
-      "type": "issue",
-      "summary": "read_site_content_health() still computes the release digest twice (about 3%)",
-      "detail": "REVIEW 2026-09-25 (offline audit of current main; no provider access): The ~7 s title is out of date: a2f0770bc records a 47% cut and a mean of about 410 ms, and the RPC is deliberately off the readiness path (health-response.ts), so it cannot trip the deploy gate and did not cause the 2026-09-21 deploy stall. Absorbs the residual of closed #08W0F7. PRIOR DETAIL: PARTLY FIXED, measured. Migration 20260918120000_evaluate_bootstrap_digest_once_per_health_read (PR #2886, merged; live-drift green 2026-09-19) removed the larger half. read_site_content_health() compared two stored columns to the SAME freshly computed site_content_bootstrap_digest, evaluating it twice. Counted with track_functions=all in the pinned image: one bootstrap digest costs 164,820 site_content_canonical_json invocations, one release digest 10,969, one dynamic-state digest 3, and ONE health read cost 351,594 before and 186,774 after - a 47 percent reduction, with output byte-identical across all 23 fields and the state-machine fixture passing on both. Live pg_stat_statements over 3d05h also shows the catalogue reader's mean falling from 8,656 ms to roughly 410 ms for post-fix calls. STILL OPEN, and small: site_content_release_digest is evaluated once in the private base and again in the public wrapper - 10,969 invocations, about 3 percent. Folding those two is a subtler equivalence argument than the first and is worth doing only if the probe is still gating deploys after this.",
-      "source": "docs/deployment-architecture.md (Readiness section); src/lib/health-response.ts; supabase/migrations/20260913072413_materialize_site_content_health_operational_base.sql",
-      "added": "2026-09-14"
-    },
     {
       "id": "#9V1TJ5",
       "priority": "P3",
@@ -356,8 +311,8 @@
       "priority": "P2",
       "type": "task",
       "summary": "15 of 16 candidate clinical sources reviewed in PR #3143, none adopted yet, so 47 Therapy records still cite nothing",
-      "detail": "15 candidate sources reviewed to locally_reviewed in PR #3143; 47 therapies still need citations adopted. PRIOR DETAIL (restored 2026-10-09, an earlier update replaced it wholesale): Commit 88dd7aaea registered 23 reconciled Therapy sources in src/data/source-acquisitions.json, taking the ledger from 8 to 31. Sixteen are disposition candidate with validationStatus unverified: 14 NICE guidelines at rung 5, one RANZCP president's update at rung 3, and therapy-wa-aboriginal-impact-policy (WA Aboriginal Health Impact Statement and Declaration Policy). Publication dates and current status were re-read from each publisher's own page on 2026-09-16 and all matched the handover; nine NICE guidelines are filed review_due because the publisher's most recent date for them is over five years old. Nothing is adopted, so no Therapy record may cite any of them yet. This is the gate on the 47 records that currently have null references and null evidenceNotes. Distinct from #SBKXZ7, which tracks clinician sign-off of the 205 therapy records themselves rather than source adoption. Seven further sources were recorded as rejections with the reason each would need resolved before re-capture; five are blocked because the publisher prints an update date but no publication date. Next action: owner reviews the 16 candidates and decides adoption. npm run check:source-acquisitions lists them under 'Awaiting clinical sign-off'.",
-      "source": "PR #3143 review",
+      "detail": "UPDATE 2026-10-10: eight of the candidates (NICE CG178, CG185, NG222, CG113, CG115, CG78, NG225, NG87) are now cited in free text by 22 Therapy records (PR #3398), each citation followed by a note that the source is not yet adopted. Their register entries still read as uncited; that text is hash-attested, so refresh it in the same change that adopts them rather than editing it alone. NEXT (owner): adopt the reviewed NICE records you stand behind. PRIOR DETAIL: 15 candidate sources reviewed to locally_reviewed in PR #3143; 47 therapies still need citations adopted. PRIOR DETAIL (restored 2026-10-09, an earlier update replaced it wholesale): Commit 88dd7aaea registered 23 reconciled Therapy sources in src/data/source-acquisitions.json, taking the ledger from 8 to 31. Sixteen are disposition candidate with validationStatus unverified: 14 NICE guidelines at rung 5, one RANZCP president's update at rung 3, and therapy-wa-aboriginal-impact-policy (WA Aboriginal Health Impact Statement and Declaration Policy). Publication dates and current status were re-read from each publisher's own page on 2026-09-16 and all matched the handover; nine NICE guidelines are filed review_due because the publisher's most recent date for them is over five years old. Nothing is adopted, so no Therapy record may cite any of them yet. This is the gate on the 47 records that currently have null references and null evidenceNotes. Distinct from #SBKXZ7, which tracks clinician sign-off of the 205 therapy records themselves rather than source adoption. Seven further sources were recorded as rejections with the reason each would need resolved before re-capture; five are blocked because the publisher prints an update date but no publication date. Next action: owner reviews the 16 candidates and decides adoption. npm run check:source-acquisitions lists them under 'Awaiting clinical sign-off'.",
+      "source": "session 2026-10-10 /ledger sweep, PR #3398 (merged 2026-10-09 as 6f9203d55)",
       "added": "2026-09-16"
     },
     {
@@ -373,8 +328,8 @@
       "id": "#6X06YS",
       "priority": "P2",
       "type": "task",
-      "summary": "Three curated WA services remain unwritten: MHAS, Zonta House and SARC counselling",
-      "detail": "2 written in PR #3067; only 3 remain unwritten (MHAS, Zonta House, SARC counselling). PRIOR DETAIL (restored 2026-10-09, an earlier update replaced it wholesale): UPDATE 2026-09-26 (owner decisions relayed via the coordinator, 'yes to all five'; offline, no provider access; PR #3067): Owner approved registering Ruah and the Mental Health Advocacy Service. Ruah Engagement Hub written as SVC-HOU-003 and the Mental Health Law Centre as SVC-LEG-003, matching the legacy 'Ruah specialist legal services' entry so it is replaced rather than duplicated. Both pending the owner's clinical sign-off. PRIOR DETAIL: UPDATE 2026-09-26 (owner-approved page reads from the cloud session, no provider access): Links Court Program written (SVC-LEG-002, new part-09.ts) from the North Metropolitan Health Service forensic services page ('Page Last Updated: 04/08/2026'): Perth Children's Court, ages 10 to 18, (08) 9218 4819; hours not stated. Legal Yarn already exists (SVC-LEG-001, PR #3019). Ruah MHLC adjudication: Ruah's own page says the Mental Health Law Centre 'merged with Ruah in 2019' and is Ruah's mental health legal service, so it is the same organisation as the legacy 'Ruah specialist legal services' entry: update and rename that entry, do not add a second record. Ruah Engagement Hub page read (247 James Street Northbridge, 13 7824, 8.30am-2pm Mon-Fri, over-20s, drop-in, last modified 2025-05-07) but NOT written: Ruah is not in the source authority register, and the #3019 convention registers each service issuer first (owner decision, retrieval-ranking surface). NEXT: owner decision to register Ruah (catalogue identity only), then write the Engagement Hub and rename the legal-services entry. PRIOR DETAIL: RECHECKED 2026-09-25 on main 2c787a506: Ruah Engagement Hub, Links Court Program and Legal Yarn are still absent (Passages and Youth Focus tracked in #YDENFM), and the Ruah Mental Health Law Centre adjudication is still open. The cloud session's network egress refuses every publisher host (wa.gov.au, mhc.wa.gov.au, aihw.gov.au, ruah.org.au, youthfocus.com.au, passages.org.au, healthdirect.gov.au and others all returned connect_rejected on 2026-09-25), and the sources skill forbids taking a publisher, date or contact detail from anywhere but the publisher's own page, so this cannot be done from a cloud session. TO UNBLOCK: run it from an unrestricted network, for example a Remote Control session on the owner's PC, or have the owner approve each page fetch. PRIOR DETAIL: REVIEW 2026-09-25 (offline audit of current main; no provider access): Five of the original ten were added in PR #2814 (c68c6ff41, part-05.ts): KEMH Mother Baby Unit, PCH Eating Disorders Service, PCH Gender Diversity Service, MHC My Services directory, Bunbury MHOA (held as planned). Still absent: Ruah Engagement Hub, Links Court Program, Legal Yarn, and Passages Perth, Passages Peel and Youth Focus (see #YDENFM). The Ruah Mental Health Law Centre adjudication is still open. PRIOR DETAIL: The 2026-09-14 Services handover package holds 88 curated records. Reconciled against the repository on 2026-09-16: 15 already existed as canonical records, 22 are genuinely new, and the remaining 50 are updates to records already held. Twelve of the 22 are now written on branch claude/relaxed-lamport-nkowqs. The ten still to write are Ruah Engagement Hub, the Mental Health Commission My Services online directory, Links Court Program, Legal Yarn, PCH Eating Disorders Service, PCH Gender Diversity Service, Bunbury Regional Hospital Mental Health Observation Area, the KEMH Mother Baby Unit (which is a split of the existing conflated S115 record), plus Passages Perth, Passages Peel and Youth Focus, which are blocked on the publisher-registration decision. Two need adjudication before writing: PCH Gender Diversity Service against the existing Gender Pathways Service under NMHS YouthLink, and Ruah Mental Health Law Centre against the existing Ruah specialist legal services entry, which is probably a rename rather than a new record. NEXT: write the unblocked records in one batch so a single bootstrap refresh covers every addition rather than one per batch. The package's own crosswalk file is unusable for this: it never read the repository, so it marks all 88 as do-not-auto-insert, and its first record is corrupted, carrying the entire guide text in its name field.",
+      "summary": "Two curated WA services remain unwritten (MHAS, Zonta House), and SARC counselling may already be covered",
+      "detail": "NOTE 2026-10-09 (PR #3403 review): the canonical SARC record SVC-SV-001 already covers counselling (its best use and hours list crisis counselling and counselling appointments). Check whether a separate SARC counselling record is still needed before writing one, otherwise only MHAS and Zonta House remain. 2 written in PR #3067; only 3 remain unwritten (MHAS, Zonta House, SARC counselling). PRIOR DETAIL (restored 2026-10-09, an earlier update replaced it wholesale): UPDATE 2026-09-26 (owner decisions relayed via the coordinator, 'yes to all five'; offline, no provider access; PR #3067): Owner approved registering Ruah and the Mental Health Advocacy Service. Ruah Engagement Hub written as SVC-HOU-003 and the Mental Health Law Centre as SVC-LEG-003, matching the legacy 'Ruah specialist legal services' entry so it is replaced rather than duplicated. Both pending the owner's clinical sign-off. PRIOR DETAIL: UPDATE 2026-09-26 (owner-approved page reads from the cloud session, no provider access): Links Court Program written (SVC-LEG-002, new part-09.ts) from the North Metropolitan Health Service forensic services page ('Page Last Updated: 04/08/2026'): Perth Children's Court, ages 10 to 18, (08) 9218 4819; hours not stated. Legal Yarn already exists (SVC-LEG-001, PR #3019). Ruah MHLC adjudication: Ruah's own page says the Mental Health Law Centre 'merged with Ruah in 2019' and is Ruah's mental health legal service, so it is the same organisation as the legacy 'Ruah specialist legal services' entry: update and rename that entry, do not add a second record. Ruah Engagement Hub page read (247 James Street Northbridge, 13 7824, 8.30am-2pm Mon-Fri, over-20s, drop-in, last modified 2025-05-07) but NOT written: Ruah is not in the source authority register, and the #3019 convention registers each service issuer first (owner decision, retrieval-ranking surface). NEXT: owner decision to register Ruah (catalogue identity only), then write the Engagement Hub and rename the legal-services entry. PRIOR DETAIL: RECHECKED 2026-09-25 on main 2c787a506: Ruah Engagement Hub, Links Court Program and Legal Yarn are still absent (Passages and Youth Focus tracked in #YDENFM), and the Ruah Mental Health Law Centre adjudication is still open. The cloud session's network egress refuses every publisher host (wa.gov.au, mhc.wa.gov.au, aihw.gov.au, ruah.org.au, youthfocus.com.au, passages.org.au, healthdirect.gov.au and others all returned connect_rejected on 2026-09-25), and the sources skill forbids taking a publisher, date or contact detail from anywhere but the publisher's own page, so this cannot be done from a cloud session. TO UNBLOCK: run it from an unrestricted network, for example a Remote Control session on the owner's PC, or have the owner approve each page fetch. PRIOR DETAIL: REVIEW 2026-09-25 (offline audit of current main; no provider access): Five of the original ten were added in PR #2814 (c68c6ff41, part-05.ts): KEMH Mother Baby Unit, PCH Eating Disorders Service, PCH Gender Diversity Service, MHC My Services directory, Bunbury MHOA (held as planned). Still absent: Ruah Engagement Hub, Links Court Program, Legal Yarn, and Passages Perth, Passages Peel and Youth Focus (see #YDENFM). The Ruah Mental Health Law Centre adjudication is still open. PRIOR DETAIL: The 2026-09-14 Services handover package holds 88 curated records. Reconciled against the repository on 2026-09-16: 15 already existed as canonical records, 22 are genuinely new, and the remaining 50 are updates to records already held. Twelve of the 22 are now written on branch claude/relaxed-lamport-nkowqs. The ten still to write are Ruah Engagement Hub, the Mental Health Commission My Services online directory, Links Court Program, Legal Yarn, PCH Eating Disorders Service, PCH Gender Diversity Service, Bunbury Regional Hospital Mental Health Observation Area, the KEMH Mother Baby Unit (which is a split of the existing conflated S115 record), plus Passages Perth, Passages Peel and Youth Focus, which are blocked on the publisher-registration decision. Two need adjudication before writing: PCH Gender Diversity Service against the existing Gender Pathways Service under NMHS YouthLink, and Ruah Mental Health Law Centre against the existing Ruah specialist legal services entry, which is probably a rename rather than a new record. NEXT: write the unblocked records in one batch so a single bootstrap refresh covers every addition rather than one per batch. The package's own crosswalk file is unusable for this: it never read the repository, so it marks all 88 as do-not-auto-insert, and its first record is corrupted, carrying the entire guide text in its name field.",
       "source": "PR #3067 review",
       "added": "2026-09-16"
     },
@@ -468,15 +423,6 @@
       "source": "Session 2026-09-16 repairing the epoch-zero freeze regression from PR #2814",
       "added": "2026-09-16"
     },
-    {
-      "id": "#KVYHWZ",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "Most of the legacy WA service catalogue carries no source URL or hours yet is marked high confidence",
-      "detail": "UPDATE 2026-09-26 (owner decisions relayed via the coordinator, 'yes to all five'; offline, no provider access; PR #3067): Women's Domestic Violence Helpline written as SVC-FDV-004, and family-violence urgent routing now lists it first with 1800RESPECT straight after (1800RESPECT leads if the helpline is unusable). Crisis Resolution Home Treatment Team written as SVC-URG-006 (Kadadjiny Marr Koodjal Mia, EMHS page 'Last Updated: 26/11/2025'); YouthLink SVC-YTH-020 and Youth-HITH SVC-YTH-021 written. Kununurra Safe Place (S089) is already covered by SVC-URG-005. Deferred: RAPID (S159/S160 are one service and its page gives no contact or referral route; S160's contacts belong to City East CMHS) and YCATT (three separate services run by NMHS, EMHS and SMHS). Catalogue now 251 records. All new records pending the owner's clinical sign-off. PRIOR DETAIL: UPDATE 2026-09-26 (owner-approved page reads from the cloud session, no provider access): First batch, crisis and urgent lines first. The merged live catalogue has 247 records, 93 with no source URL (57 of them High confidence). Child Protection Central Intake is now a canonical record (SVC-CHP-001) sourced from the Department of Communities child-safety page (last updated 19 May 2026; hours not stated). The Women's Domestic Violence Helpline page was read (24 hours, 1800 007 339, last updated 14 January 2025) and captured in source-acquisitions.json but NOT written as a record: a verified record becomes the first usable family-violence match in service-urgent-routing.ts and displaces 1800RESPECT as the pinned route (services-safety-routing test), which is an owner decision. Next highest-risk unsourced records: Crisis Care and Child Protection Central Intake (S034, a duplicate), Crisis Resolution Home Treatment Team (S035), Kununurra Safe Place (S089), RAPID at RPH (S159/S160), YouthLink (S216), Youth-HITH (S212), YCATT (S210), and the metropolitan CMHS clinics. PRIOR DETAIL: RECHECKED 2026-09-25: no verification batch done. The cloud session's network egress refuses every publisher host (wa.gov.au, mhc.wa.gov.au, aihw.gov.au, ruah.org.au, youthfocus.com.au, passages.org.au, healthdirect.gov.au and others all returned connect_rejected on 2026-09-25), and the sources skill forbids taking a publisher, date or contact detail from anywhere but the publisher's own page, so this cannot be done from a cloud session. TO UNBLOCK: run it from an unrestricted network, for example a Remote Control session on the owner's PC, or have the owner approve each page fetch. Telephone confirmation and sign-off stay with the owner regardless. PRIOR DETAIL: Measured on data/services-snapshot.json, 2026-09-16: of 219 legacy service records, 100 carry no public source URL at all, 98 state no opening hours, and 100 were extracted from an earlier research document without ever being checked against a live page. Despite that, 159 are marked confidence High. Examples with no source link and High confidence: Armadale Community Mental Health Service, Bentley Older Adult, Butler CMHS, Child Protection Central Intake, and the Childbirth and Mental Illness Service at KEMH. The read-time ageing fix on this branch makes the deficiency visible rather than hiding it, because a record with no recorded review now reads as unknown instead of current, but it does not supply the missing evidence. A separate data error found while reconciling: the Mother and Baby Unit record (S115) conflates KEMH and Fiona Stanley into one entry, listing the Fiona Stanley number under a provider field naming both. NEXT: verify in risk order rather than alphabetically, per docs/services-mode-governance.md, taking crisis and urgent contacts first, then common referral routes, then descriptive content. Page checking and record drafting can be done per batch; telephone confirmation and sign-off cannot.",
-      "source": "Session work on branch claude/relaxed-lamport-nkowqs, 2026-09-16",
-      "added": "2026-09-16"
-    },
     {
       "id": "#61GQYY",
       "priority": "P2",
@@ -567,15 +513,6 @@
       "source": "2026-09-17 Sentry triage session; PR #2853",
       "added": "2026-09-17"
     },
-    {
-      "id": "#4W704K",
-      "priority": "P3",
-      "type": "issue",
-      "summary": "site_content_release_records_immutable is not 'enable always', so session_replication_role = replica bypasses the freeze's only structural protection",
-      "detail": "REVIEW 2026-09-25 (offline audit of current main; no provider access): Two of three gaps closed by 20260916190000_seal_bootstrap_release_and_drop_per_read_digest.sql (#2855: enable-always insert/truncate triggers, per-read digest removed). Remaining: the one-line enable-always promotion of site_content_release_records_immutable, deliberately left out of that migration. The sequencing advice is moot. PRIOR DETAIL: READ FROM THE SCHEMA ON 2026-09-16, NOT EXPLOITED OR TESTED. supabase/schema.sql:12722-12724 creates site_content_release_records_immutable as an ordinary row trigger (before update or delete ... execute function guard_site_content_immutable_row). PostgreSQL does not fire an ordinary trigger when session_replication_role = 'replica', so a session that sets that GUC can UPDATE or DELETE rows of the frozen epoch-zero release with nothing raising. That is not a theoretical technique in this repository: scripts/check-site-content-control-plane.mjs:889-894 uses exactly it against a sibling table. TWO FURTHER GAPS IN THE SAME SEAL: the trigger covers only UPDATE and DELETE, so nothing prevents a row being INSERTED into a retained bootstrap release (it need only satisfy site_content_release_records_check1), and TRUNCATE is a statement-level event a row trigger never sees. Until the catalogue read-latency migration lands, the per-read bootstrap digest recomputation is the only thing that detects an inserted row, and it detects it after the fact — see docs/audit/2026-09-16-catalogue-read-latency.md. HOW MUCH THIS MATTERS, stated honestly: setting session_replication_role needs the same superuser or postgres privilege an attacker would need to write the rows anyway, and such an attacker could equally replace the digest function. So the value here is against ACCIDENT — a half-applied migration, a bad replay, a partial restore, or a script that sets the GUC for an unrelated reason and then touches this table — not against a determined adversary. THE FIX: 'alter table public.site_content_release_records enable always trigger site_content_release_records_immutable', plus an 'enable always' before-insert trigger restricted to the retained bootstrap release ids and an 'enable always' before-truncate statement trigger. All transactional, no index build. SEQUENCE IT WITH the read-latency migration, which needs the same seal to justify removing the per-read digest; doing it separately means doing the same CREATE TRIGGER lock twice. GATE: SQL, so it ships as a new forward migration and needs an approved merge window. RUN check:site-content-control-plane in Docker FIRST — its own fixtures rely on session_replication_role on a sibling table, and an 'enable always' trigger on this one must be proven not to break them before merging.",
-      "source": "docs/audit/2026-09-16-catalogue-read-latency.md; Claude Code session 2026-09-16 (session_01GJHMbC4s2S2n8aChAxVF1D), catalogue read-latency investigation",
-      "added": "2026-09-16"
-    },
     {
       "id": "#GCB0DV",
       "priority": "P2",
@@ -594,24 +531,6 @@
       "source": "docs/audit/2026-09-16-catalogue-read-latency.md; Claude Code session 2026-09-16 (session_01GJHMbC4s2S2n8aChAxVF1D), catalogue read-latency investigation",
       "added": "2026-09-16"
     },
-    {
-      "id": "#HNJF5X",
-      "priority": "P3",
-      "type": "issue",
-      "summary": "Three differential presentation workflows carry an id identical to a diagnosis slug, so any surface keying both families on one identifier silently drops three records",
-      "detail": "REVIEW 2026-09-25 (offline audit of current main; no provider access): Reproduced (31 presentations + 201 diagnoses, three collisions: substance-intoxication, substance-withdrawal, depression). Guard test in place and the row itself says no surface loses records today, so P3. PRIOR DETAIL: GUARDED 2026-09-19 in PR #2920, naming decision deferred by the owner. tests/differential-identifier-collisions.test.ts lists substance-intoxication, substance-withdrawal and depression as a documented baseline, pins per-family uniqueness, pins the flattened arithmetic (232 total, 229 distinct) so the loss is measured rather than described, and fails on a FOURTH collision with a message saying not to widen the baseline. The real fix stays in scripts/import-differentials-export.ts, which cannot run outside the owner's Windows machine (DEFAULT_ZIP at line 8 is a hardcoded local path). Also established: no surface loses records today -- sign-off-queue.ts is the only consumer that flattens both families and it already namespaces its keys.",
-      "source": "Found and independently reproduced during the 2026-09-18 outstanding-issues session; workaround shipped in PR #2883",
-      "added": "2026-09-18"
-    },
-    {
-      "id": "#CBEVBS",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "No dedicated tablet Playwright project, so full-suite tablet coverage is missing even though some targeted tablet checks already exist",
-      "detail": "Add one tablet Chromium project (e.g. 820x1180) to the main production-journey matrix, or explicitly expand the existing targeted tablet blocks into the journeys that matter. Why: playwright.config.ts has chromium, chromium-mockups, chromium-caring-contacts-seeded, firefox, webkit, mobile-webkit and mobile-pwa-standalone — and no dedicated tablet project between phone and desktop, so there is no automatic full-suite tablet run. This is NOT 'every tablet defect is found only by hand and none can be pinned': tests/ui-overlap.spec.ts already defines an 820×1180 block specifically because there is no tablet project, and tests/ui-smoke.spec.ts plus other production journeys already exercise explicit tablet viewports. The real gap is lack of automatic full-suite tablet coverage, not total absence of tablet regression hooks. Context: structural gap behind #6GR6B8 and #EKB6XR; verified by grep (zero 'tablet' in playwright.config.ts) plus the existing targeted viewport tests above. Owner: assistant. Confidence: high. Depends on: #6GR6B8, #EKB6XR.",
-      "source": "session 2026-09-20 /ledger sweep — nine-agent repo maturity review",
-      "added": "2026-09-20"
-    },
     {
       "id": "#QVVS6W",
       "priority": "P2",
@@ -639,96 +558,6 @@
       "source": "session 2026-09-20 /ledger sweep — nine-agent repo maturity review; note corrected after Codex review on PR #2930",
       "added": "2026-09-20"
     },
-    {
-      "id": "#JQ3KY7",
-      "priority": "P2",
-      "type": "task",
-      "summary": "The #CCZ4HB automated-review decision fired its own re-open trigger on 2026-09-19 and AGENTS.md still records only the old decision",
-      "detail": "The owner decision of 2026-08-22 (#CCZ4HB, AGENTS.md 'Automated review coverage', full text in docs/agents/pull-request-workflow.md) accepted intermittent bot review on a stated condition: 'Re-open only if the Codex connector also stops reviewing, or if the owner revisits the billing decision.' On 2026-09-19 that condition fired - all three reviewers declined on the same day: CodeRabbit on a categorical under-10-stars eligibility gate (not fixable by a cap raise), Codex on 'reached your Codex usage limits for code reviews', Bugbot on 'usage limit reached'. Three PRs merged that day with no automated review: #2901 (a clinical governance record), #2903, #2921. PR #2922 was the re-opened answer and added .github/workflows/claude-review.yml, but deliberately left AGENTS.md alone on the grounds that rewriting a recorded owner decision is the owner's to make, not a side effect of a workflow change; its Notes section promised this ledger request instead. NOTE the coupling: that workflow does not currently work (separate P1 issue, same date), so the re-opened answer is not yet actually providing coverage. Codex's quota reset overnight and it reviewed both #2922 and #2923, finding nothing on the latter - so 2026-09-19 was three outages coinciding rather than a permanent state, which is the argument for redundancy rather than against it.",
-      "source": "PR #2922 Notes; AGENTS.md 'Automated review coverage'; 2026-09-19 reviewer outage",
-      "added": "2026-09-20"
-    },
-    {
-      "id": "#9VQVRT",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "Draft PRs show a green PR-required gate while twelve heavy CI jobs stay skipped, so draft status is easy to misread as merge-ready",
-      "detail": "Improve draft-status visibility (UI/docs/bot messaging) so a green draft is never treated as a full readiness signal. Why: .github/workflows/ci.yml still skips twelve heavy jobs while github.event.pull_request.draft == true (static-heavy, coverage, build, Production UI, Production UI critical, Ward Flow, Lighthouse and more), so draft 'PR required' is weaker than it looks. This is NOT a merge hole: pull_request triggers include ready_for_review, and undrafting re-runs the full workflow before the change can reach main (see .github/workflows/ci.yml ready_for_review trigger and the comment that undrafting re-runs full CI). Do not change standing draft policy or narrow the skip list to 'close' a nonexistent merge path — fix operator/assistant messaging instead. Context: PR #2909 sat as a draft with zero browser coverage; npm run plan:browser already names the draft case. Owner: assistant (messaging) / user (policy if desired). Confidence: high — draft skip verified by grep; ready_for_review re-run path verified in ci.yml. Depends on: nothing.",
-      "source": "session 2026-09-20 /ledger sweep — nine-agent repo maturity review",
-      "added": "2026-09-20"
-    },
-    {
-      "id": "#383YXX",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "Lighthouse budget grades the same commit differently at PR time and post-merge, so a required check can fail on code that already passed it",
-      "detail": "Make the Lighthouse grading deterministic between the PR run and the post-merge run — retry once, or widen the tolerance — so the same SHA cannot get two verdicts. Why: it is a REQUIRED gate, so a non-deterministic answer turns pr-required red on main for changes that were green on the PR, which is part of what trains the team to ignore a red main. Context: two dependency-bump merges (runs 35392321128 and 35384830844) failed pr-required solely on Lighthouse budget post-merge. Owner: assistant. Confidence: medium — the two runs are verified, the determinism mechanism is not yet root-caused. Depends on: #T82ND3.",
-      "source": "session 2026-09-20 /ledger sweep — nine-agent repo maturity review",
-      "added": "2026-09-20"
-    },
-    {
-      "id": "#JMX32A",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "A Playwright run whose own web server fails to start silently reuses another server and reports green",
-      "detail": "Observed 2026-09-20 while writing tests/ui-patient-number-field.spec.ts. The agent running scripts/run-playwright.mjs had its own webServer fail to start because a concurrent session already held the port; the runner did not stop. It proceeded against THAT other server and reported a green pass. The run was re-done cleanly afterwards and the reported result is sound, but the hazard is not the individual run — it is that a browser gate can report success without ever exercising the tree it claims to test. This is the same class of failure as a gate piped into tail (exit code masked) and as CLINICAL_HAZARD_CONTROLS_PASS printing while a named proof file had been emptied: a signal that cannot fail is worse than no signal, because it is trusted. It matters more here than in most repos because verification evidence is quoted verbatim into PR bodies and the ledger, so a contaminated run propagates as fact. NEXT: make Playwright webServer startup failure fatal rather than falling back to an already-listening port — either set reuseExistingServer:false for CI/agent runs, or have run-playwright.mjs confirm the server it connects to is the one it started (the repo already has /api/local-project-id for exactly this identity question, used by npm run ensure). Add a contract test that a failed server start exits non-zero. Note npm run ensure already solves the adjacent problem correctly and is the pattern to copy.",
-      "source": "Claude Code session 2026-09-20 (session_01VE1C4eJidBwMdfHV4nUJgL); reported by the agent that wrote the #WFARS3 browser guard",
-      "added": "2026-09-20"
-    },
-    {
-      "id": "#33346A",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "Two Firefox failures survive the 2026-09-20 triage: the document-viewer hit counter and the tools Forms panel, both a click whose state change never lands",
-      "detail": "Read the Playwright trace from the failing run BEFORE proposing any fix; playwright.config.ts sets trace: retain-on-failure so it exists, and its After-DOM snapshot of the click answers this in minutes. THE TWO: (1) ui-smoke.spec.ts \"search regressions avoid fetch errors and open viewer hits @critical\" - after clicking Next document search hit, \"Hit 2 of 2\" never appears (element NOT FOUND, not hidden); (2) ui-tools.spec.ts \"tool links point to the expected in-app modes\" - the Forms complementary panel resolves to zero elements, on the 4th of 6 loop passes, while Services with an identical /?mode=<id> href passes. SAME SHAPE, so probably one shared Firefox cause. RULED OUT by two independent agent reads, do not re-derive: text split across elements (Playwright elementText flattens descendants and JSX/SSR comment separators); a collapsed <details> or any CSS cause (a hidden node still matches, and would report hidden not not-found - no stylesheet removes a node from the DOM); scrollIntoView/smooth scroll (suite-wide reducedMotion: reduce makes resolveScrollBehavior return auto); keyboard/focus; a click intercepted by the fixed composer (Playwright's hit-target interceptor blocks and retries, failing AT the click); Forms-specific data or markup (tools-catalog.ts Forms and Services are the same shape, and DetailActions renders the href link unconditionally). LEADING CANDIDATES: for (1), the handler firing zero times or twice - with exactly 2 hits, (i+d+2)%2 returns to 0 either way - with the exclusive-accordion open-attribute fight at source-panels.tsx:1063 as a plausible Gecko-specific trigger; for (2), the panel's hardcoded aria-labelledby id resolving against a hidden duplicate page root (the #093 failure mode visibleByTestId exists for), or the bare focus() at tools-search-results-page.tsx:470 scrolling late. NEITHER IS PROVEN. Why: Why it matters - if the click genuinely no-ops, a Firefox user cannot page through document search hits at all, which is a clinical reading path; if it double-fires it is a harness artefact and the test should assert the active chunk id rather than a modulo-2 counter. Context: Six Firefox failures in main run 35503893104; four fixed in PRs #2932 and #2933, these two left. Parent row #9Z197J. Owner: unknown - depends on what the trace shows. Confidence: high that the cause is shared and not CSS/text-matching; low on any single mechanism. Depends on: the egress row - the trace could not be downloaded from the cloud container.",
-      "source": "session 2026-09-20 Firefox failure triage; two parallel agent investigations; main run 35503893104",
-      "added": "2026-09-20"
-    },
-    {
-      "id": "#NQH33S",
-      "priority": "P3",
-      "type": "issue",
-      "summary": "Local and http-served builds emit https:// absolute URLs that cannot connect",
-      "detail": "metadata-base.ts:49 defaults the protocol to https when no x-forwarded-proto header is present, so a local build emits https://localhost:<port>/... links failing with ERR_SSL_PROTOCOL_ERROR. This was the ONLY distinct console error across 509 captures of 78 routes. Production behind Railway sets the header and is unaffected; this is a local-development and reverse-proxy-without-the-header concern.",
-      "source": "docs/audit/2026-09-20-visual-ux-audit.md (PR #2939)",
-      "added": "2026-09-20"
-    },
-    {
-      "id": "#Z9NS6H",
-      "priority": "P3",
-      "type": "rec",
-      "summary": "Copy and naming inconsistencies that undercut the product's own safety vocabulary",
-      "detail": "UPDATE 2026-09-28 (PR #3142): DONE - the Differentials subtitle (ui-copy.ts) now describes differential diagnosis, and uncurated 'Do now' teaching observations render as unnumbered bullets. DONE - refusal framing on the source rail: owner approval 2026-09-28 set the most conservative refusal definition, the UNION of grounded === false, an answerState of 'ungrounded' or 'no_answer', and fallbackReasonCode coverage_gap/no_candidates/low_signal (answerIsRefusal in answer-copy-payload.ts). Both the live (answer-result-surface.tsx) and historical (answer-thread-turn.tsx) answer surfaces pass it to NaturalLanguageAnswer, which drops the in-prose source marks and has AnswerSourceRail title the rows 'Documents searched', show every card with the uncited badge and no Direct/Partial grade, and use the same wording on the compact chip. STILL OPEN: (4) 86 of 374 multi-item diagnosis sections (1,200 sections total) have a summary that is a space-join of their items with no punctuation - clinical wording for a human.",
-      "source": "docs/audit/2026-09-20-visual-ux-audit.md (PR #2939)",
-      "added": "2026-09-20"
-    },
-    {
-      "id": "#8RWKA0",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "Fixed-width and fixed-character-count elements truncate clinical text at every viewport",
-      "detail": "PARTLY FIXED 2026-09-25: the On Call ward chip is fixed in 626cb241e (min-w-32 max-w-60 instead of w-32, title wraps instead of truncating; pinned by tests/on-call-home.dom.test.tsx). STILL OPEN: services-navigator-page.tsx applies a 150-character compactText cap identically at 320 and 1920; on the 13YARN crisis line the cut lands on 'Immedia...', removing the availability statement (owned by the services/search PR). /on-call/contacts squeezing the name column to two words at 390 was not re-verified. The acamprosate dose clamp was dropped from this row: it is a deliberate <details> disclosure that expands in place.",
-      "source": "docs/audit/2026-09-20-visual-ux-audit.md (PR #2939)",
-      "added": "2026-09-20"
-    },
-    {
-      "id": "#RHGAYP",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "A compliance row whose stored details fail their schema is filed under On Call Admin, unlabelled",
-      "detail": "rowToOnCallEntry (src/lib/on-call/repository.ts) sets details to null when stored details fail the section schema. isComplianceEntry (src/lib/on-call/compliance.ts) then reads entry.details, answers false, and partitionLogisticsEntries puts the row in the Admin list with nothing to say it is a compliance requirement. THE TWO DANGEROUS CONSEQUENCES ARE ALREADY CLOSED and must not be re-reported: the row is not published, because fetchSharedOnCallEntries filters on the RAW row via rowMayBeComplianceRequirement, which fails closed on unreadable details; and a later save no longer destroys the stored details, because of salvageExistingDetails in src/lib/on-call/editor-details.ts. What remains is the misfiling. Closing it means either carrying the raw details alongside the parsed ones on OnCallEntry, or giving isComplianceEntry the raw-row reading that rowMayBeComplianceRequirement already has. Either way a type that every consumer in the mode reads changes, and it changes for a row no editor in this app can produce, because the API validates against the same strict schema on write -- reachable only by a direct database edit, an import, or a row written before the current write path. Deferred on that cost against that benefit. NEXT ACTION: decide whether OnCallEntry should carry raw details at all; if the On Call view refactor lands first, make the decision there rather than as a separate type change.",
-      "source": "Session 2026-09-20, On Call Compliance page clinical-governance review",
-      "added": "2026-09-20"
-    },
-    {
-      "id": "#5Z3CDC",
-      "priority": "P2",
-      "type": "task",
-      "summary": "The privacy impact assessment omits six subsystems, including Caring Contacts and CME evidence uploads",
-      "detail": "UPDATE 2026-09-26 (removal PR, branch claude/remove-ward-flow-caring-contacts-ltxdgk; offline, no provider access): Caring Contacts was retired and deleted on 2026-09-26 by the removal PR, so it drops out of this item. The other omitted subsystems (CME evidence uploads and the rest listed below) are unchanged and still need the assessment. PRIOR DETAIL: REVIEW 2026-09-25 (offline audit of current main; no provider access): Still true: docs/privacy-impact-assessment.md has no mention of Caring Contacts, the pocket card, the service worker, the developer hub or site_content. Add a sixth gap: CME private evidence uploads (public.cme_evidence, migration 20260922175023, plus the 2026-09-24 evidence-removal migration). Also correct the line saying On Call compliance rows are cached in localStorage; closed #KJF5J7 stopped that. PRIOR DETAIL: docs/privacy-impact-assessment.md gained an On Call compliance entry (PIA-9) on 2026-09-20, but still does not mention, at all: (1) CARING CONTACTS, a whole patient-data subsystem with its own database (src/lib/caring-contacts/**, src/lib/caring-contacts-server/**, CARING_CONTACTS_DATABASE_URL) -- by far the largest gap and the only patient data in the product; (2) the PRINTED POCKET CARD, the only artefact that physically leaves the app; (3) the SERVICE WORKER caching policy (public/sw.js) and what it retains on the device; (4) the DEVELOPER HUB (src/components/developer-area/**) and what operational data it surfaces; (5) the PUBLIC CATALOGUE surface and its one anon-callable database function, public.read_site_content_public_records, granted to the anon role. Verified absent by grep on 2026-09-20: zero mentions of caring, pocket, service worker, developer hub or site_content anywhere in the document. This is governance documentation rather than an engineering defect -- nothing is leaking -- but the assessment is the artefact an external adviser reads, and as written it understates the data footprint of the product. NEXT ACTION: add one section-2 data-category row per subsystem and, where a residual risk exists, a numbered PIA entry; do Caring Contacts first and do not let the other four hold it up. Escalate the Caring Contacts part to P1 if the production-configuration check finds that workspace enabled in production.",
-      "source": "Session 2026-09-20, On Call Compliance page security audit",
-      "added": "2026-09-20"
-    },
     {
       "id": "#PM71Z1",
       "priority": "P2",
@@ -738,40 +567,13 @@
       "source": "session 2026-09-20; agent investigation of browser provisioning; proxy README /root/.ccr/README.md",
       "added": "2026-09-20"
     },
-    {
-      "id": "#HXC4D4",
-      "priority": "P3",
-      "type": "issue",
-      "summary": "A silent HTTP 400 on long or single-character queries, and a unit-less creatinine range message",
-      "detail": "PARTLY FIXED 2026-09-25 in eb55cf1a2: (a) use-universal-search.ts now reports a query over 200 characters as a distinct too-long state (no fetch), and a non-OK or network failure as an error that is never cached; aborted requests stay silent. The command surface shows a one-line notice for each (pinned by tests/use-universal-search-stream.dom.test.tsx and tests/universal-search-command-notice.dom.test.tsx). The API route is unchanged. The single-character half was dropped earlier (the client never sends a query under 2 characters). STILL OPEN: (b) the Serum creatinine NumberField rejects 1.02 with 'Enter 15-3000.' - the only numeric field whose range message carries no unit (CrCl says mL/min, QTc says ms). 1.02 is an ordinary mg/dL value and the bound shown is the umol/L one.",
-      "source": "docs/audit/2026-09-20-visual-ux-audit.md (PR #2939)",
-      "added": "2026-09-20"
-    },
     {
       "id": "#05WXHX",
       "priority": "P1",
       "type": "issue",
       "summary": "Medication and therapy records carry zero source links while their footers tell the clinician to check the linked source",
-      "detail": "UPDATE 2026-09-25: step 1 shipped in PR #3017. The medication footer no longer promises a linked source (it points to current Australian product information or the local guideline); the therapy footer points to the sources named under Source & review status. OWNER DECISION: default source per medication is the TGA Product Information, plus WA guidelines where they exist; engineering proposes, owner confirms, high-risk medicines first (clozapine, lithium, valproate and other anticonvulsants, QTc/overdose-risk drugs). Real links still need the data-model change described below. PRIOR DETAIL: /medications/[slug] has 0 anchors in <main> on all four tabs; /therapy-compass/[slug] the same. Footer on every tab: 'verify every dose and interaction against the linked source'. acamprosate states Max 1998 mg/day, a serum creatinine >120 micromol/L contraindication, Half-life 13-28.4 h and an unattributed EFFICACY: MODERATE tile; the only provenance is one prose sentence on tab 4 below the fold. Root cause: medication-records.ts:118-126 derives governance from a free-text src section with no URL or document id. /dictionary and /factsheets do this correctly. Fixing properly is a database migration plus clinical governance.",
-      "source": "docs/audit/2026-09-20-visual-ux-audit.md (PR #2939)",
-      "added": "2026-09-20"
-    },
-    {
-      "id": "#1RWC0H",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "Caller IP addresses are stored as unsalted truncated SHA-256 with no retention limit in api_rate_limit_subjects",
-      "detail": "anonymousApiSubjectKey (src/lib/public-api-access.ts) derives the rate-limit subject as the prefix anon: plus the first 32 hex characters of an unsalted SHA-256 of the trusted proxy IP, and stores it in api_rate_limit_subjects.subject_key. The IPv4 address space is small enough that an unsalted hash of it is brute-forced in seconds, so these rows are PSEUDONYMISED, not anonymised, and should be classified as personal information rather than treated as opaque. Separately, and unlike rag_queries, the table has no purge function and no retention window, so rows persist indefinitely (supabase/migrations/20260704000000_api_rate_limit_subjects.sql enables row level security and grants select/insert/update/delete to service_role only). NOT AN EXPOSURE: RLS is on and only service_role reaches it, so a stranger cannot read it. This is a retention and classification matter, which is why it was deferred rather than fixed on the day. NEXT ACTION: two separable decisions. (a) Replace the bare hash with a keyed HMAC using an environment secret, so the key stops being a reversible IP -- note that rotating that secret resets every live rate-limit window, so it needs a deliberate moment. (b) Ship a retention purge mirroring the rag_queries retention migration (supabase/migrations/20260629060603_rag_queries_retention.sql is the pattern). Both are Supabase migrations, so both are owner-merged and reach the live clinical database within seconds of merge.",
-      "source": "Session 2026-09-20, On Call Compliance page security audit",
-      "added": "2026-09-20"
-    },
-    {
-      "id": "#HWYCPF",
-      "priority": "P3",
-      "type": "rec",
-      "summary": "Toast host is never mounted, so 35 files hand-roll their own 'Copied' confirmation",
-      "detail": "<ToastProvider> root mounted in layout.tsx in PR #3150; component migration is progressive polish.",
-      "source": "PR #3150 review",
+      "detail": "UPDATE 2026-10-10: PR #3398 proposed WA-first sources in src/data/medication-source-links.json: wa-health-clozapine-guideline-2024 for clozapine, and the Australian Prescriber lithium article plus its correction for lithium-carbonate-ir-sr. They render nothing until the owner adopts and signs off those register records. Valproate, other anticonvulsants and QTc-risk drugs still have no proposal. UPDATE 2026-09-25: step 1 shipped in PR #3017. The medication footer no longer promises a linked source (it points to current Australian product information or the local guideline); the therapy footer points to the sources named under Source & review status. OWNER DECISION: default source per medication is the TGA Product Information, plus WA guidelines where they exist; engineering proposes, owner confirms, high-risk medicines first (clozapine, lithium, valproate and other anticonvulsants, QTc/overdose-risk drugs). Real links still need the data-model change described below. PRIOR DETAIL: /medications/[slug] has 0 anchors in <main> on all four tabs; /therapy-compass/[slug] the same. Footer on every tab: 'verify every dose and interaction against the linked source'. acamprosate states Max 1998 mg/day, a serum creatinine >120 micromol/L contraindication, Half-life 13-28.4 h and an unattributed EFFICACY: MODERATE tile; the only provenance is one prose sentence on tab 4 below the fold. Root cause: medication-records.ts:118-126 derives governance from a free-text src section with no URL or document id. /dictionary and /factsheets do this correctly. Fixing properly is a database migration plus clinical governance.",
+      "source": "session 2026-10-10 /ledger sweep, PR #3398 (merged 2026-10-09 as 6f9203d55)",
       "added": "2026-09-20"
     },
     {
@@ -792,33 +594,6 @@
       "source": "Claude Code session 2026-09-20 (session_01VE1C4eJidBwMdfHV4nUJgL); reproduced on a clean origin/main worktree with the same runner and environment",
       "added": "2026-09-20"
     },
-    {
-      "id": "#NB4SHF",
-      "priority": "P2",
-      "type": "rec",
-      "summary": "On Call keeps deciding labels, glyphs, destinations and counts from entry.section, so every view over a section is misrendered -- move the view concept into src/lib",
-      "detail": "view.ts abstraction layer landed in PR #3139 (c88c56f98d); repo derivation pending.",
-      "source": "PR #3139 review",
-      "added": "2026-09-20"
-    },
-    {
-      "id": "#MFV1Z2",
-      "priority": "P3",
-      "type": "issue",
-      "summary": "next dev is OOM-killed after compiling roughly 55-60 routes in sequence",
-      "detail": "Reproduced three times at ~13.6 GB RSS in a 16 GB container, each time around the same point in a sequential route sweep; a --max-old-space-size cap did not help. The visual audit had to build and serve production instead. Not a product defect, but it costs anyone doing sustained local work across many routes, and a whole sweep going blank looks like an app failure (the 2026-08-06 audit recorded exactly that misreading).",
-      "source": "docs/audit/2026-09-20-visual-ux-audit.md (PR #2939)",
-      "added": "2026-09-20"
-    },
-    {
-      "id": "#7D21P1",
-      "priority": "P3",
-      "type": "issue",
-      "summary": "Two stale statements in docs/codebase-index.md and one missing On Call row in generate-site-map.ts",
-      "detail": "Found while adding CME, deliberately not fixed there because none is CME's doing. (1) docs/codebase-index.md's mode-homes paragraph says 'Fourteen modes are now consolidated onto the shared home'. On Call has left consolidatedModeHomePaths, so the real count is thirteen. Verifying it properly means auditing every consolidated route, which was not worth widening a seventy-file change for. (2) scripts/generate-site-map.ts's renderModePageIndex() has no On Call row and has not had one since On Call shipped — this is the one site-map input with no gate behind it, which is exactly why it was missed. CME's row was added; On Call's was reported rather than added, as a separate change. (3) Already fixed in #2902 but worth knowing it happened: the 'Modes (16)' id list in codebase-index.md was missing On Call entirely, independent of CME.",
-      "source": "PR #2902 task-18 agent report and controller verification against src/lib/search-route-ownership.ts, 2026-09-20",
-      "added": "2026-09-20"
-    },
     {
       "id": "#VHW8K9",
       "priority": "P3",
@@ -828,42 +603,6 @@
       "source": "PR #2959 docs closeout review 2026-09-21 — queue deferred security/DB work into canonical ledger",
       "added": "2026-09-21"
     },
-    {
-      "id": "#GQG3NV",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "vitest run silently ignores a named-but-missing test file and exits 0, so a gate receipt can name tests that never ran",
-      "detail": "MEASURED 2026-09-21. 'npx vitest run tests/this-file-does-not-exist.test.ts tests/owner-scope.test.ts' reports 'Tests 9 passed (9)' and exits 0. Two files named, one real, no warning, no non-zero exit. HOW IT BIT: on PR #2974 a commit message claimed 'the committed test that checks both surfaces agree needed no change - verified rather than assumed, by running it', citing 'npx vitest run tests/tenancy-scan.test.ts tests/owner-scope*.test.ts -> Test Files 2 passed, Tests 19 passed'. tests/tenancy-scan.test.ts DOES NOT EXIST; the paired test is tests/api-tenancy-predicates.test.ts and was never loaded. The 19 tests came from owner-scope-guard and owner-scope alone. The conclusion happened to be correct (verified afterwards: api-tenancy-predicates passes with and without the doc row) but the evidence sentence was false, and in this repository gate receipts are quoted verbatim into PR bodies and the review ledger, so a false one propagates as fact. WHY IT IS P2 AND NOT COSMETIC: this is the same class as #JMX32A (a Playwright run whose own web server failed to start silently reused another and reported green) - a signal that cannot fail is worse than no signal, because it is trusted. It is also the class docs/agents/verification-gates.md exists to protect, and AGENTS.md 'Evidence and calibration are never compressed' requires pasting the decisive gate line, which this makes unsafe to trust. NEXT ACTION: 'npm run test:focused -- --files <paths>' is already documented as failing closed for deleted files; the bare 'vitest run <paths>' path has no such guard. Either route agents to the focused wrapper for named-file runs, or add a preflight that errors when a named spec path does not exist. Add a contract test that a named-but-missing spec exits non-zero. Not a RAG, clinical or privacy surface; offline gate only.",
-      "source": "PR #2974, 2026-09-21 — measured directly after a false evidence line in commit 6271ca1b3; correction posted at https://github.com/BigSimmo/Database/pull/2974#issuecomment-5763434640",
-      "added": "2026-09-22"
-    },
-    {
-      "id": "#P6BSQ3",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "Clinical KB: indexing-v3-agent JWT/secret dual-gate after PR2/PR3",
-      "detail": "Cron invokes every minute with Vault indexing_v3_agent_secret. Harden so JWT and secret are dual-gated after Codex PR2/PR3 land. Operational context: docs/supabase-remediation-closeout-notes.md §1.2 (PR #2959).",
-      "source": "PR #2959 docs closeout review 2026-09-21 — queue deferred security/DB work into canonical ledger",
-      "added": "2026-09-21"
-    },
-    {
-      "id": "#789SD7",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "Clinical KB: PROXY_AUTH dedicated secret in quiet change window",
-      "detail": "Introduce a dedicated PROXY_AUTH / signing secret (not on Railway by name today). Quiet change window only. See docs/supabase-remediation-closeout-notes.md §1.5 (PR #2959).",
-      "source": "PR #2959 docs closeout review 2026-09-21 — queue deferred security/DB work into canonical ledger",
-      "added": "2026-09-21"
-    },
-    {
-      "id": "#Z84GK3",
-      "priority": "P3",
-      "type": "issue",
-      "summary": "CME demo corpus has no multi-allocation and no routine-sourced entry, so two real shapes are untested against shared data",
-      "detail": "All 47 entries in src/lib/cme/demo-year.ts carry exactly one allocation, and none is routine-sourced. Two consequences. (1) The brief's own clipboard test could not run as written — it did .find(e => e.allocations.length > 1)! and would have crashed on undefined; the implementer kept the assertions and pointed them at a local fixture, which is right but means the multi-category clipboard path is exercised only by that fixture, not by the corpus every screen renders. (2) Splitting one activity's hours across categories is the main thing the entry form exists for, and no demo screen shows it. Adding one is not free: the corpus figures are pinned by tests and by future pixel baselines (47 entries, 32.5 hours, educational 22.5 / reviewing 8.0 / measuring 2.0), so a new split must keep every category total unchanged or every pinned figure must move together. Worth doing when demo-year.ts is next touched.",
-      "source": "PR #2902 task-13 implementer report and task-3 review, 2026-09-20",
-      "added": "2026-09-20"
-    },
     {
       "id": "#MSJT12",
       "priority": "P1",
@@ -873,33 +612,6 @@
       "source": "Claude session 2026-09-22; GitHub deployment statuses for Database/production; live-domain-monitor runs 35639421619/35696377977/35728663173 and issue #2973 routing evidence; Codex review on PR #2982",
       "added": "2026-09-22"
     },
-    {
-      "id": "#AD3F5B",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "Clinical KB: FORCE RLS on six force_rls=false control-plane tables",
-      "detail": "Tables: clinical_quality_feedback_triage, clinical_quality_feedback_triage_events, document_corpus_access_snapshots, document_corpus_access_state, public_source_activation_guards, public_source_cleanup_mutation_guards. Deferred post-Codex. See docs/supabase-remediation-closeout-notes.md §1.3 / §2 (PR #2959).",
-      "source": "PR #2959 docs closeout review 2026-09-21 — queue deferred security/DB work into canonical ledger",
-      "added": "2026-09-21"
-    },
-    {
-      "id": "#28ECMG",
-      "priority": "P3",
-      "type": "rec",
-      "summary": "Agent/crawler readiness: canonical tags, JSON-LD and Markdown discovery are missing on the public surface (audit F26)",
-      "detail": "Audit agent-readiness review found missing canonical/JSON-LD/Markdown-discovery features and a JS-heavy public surface. Park until clinical, security and release priorities are done. Not verified offline.",
-      "source": "Ultimate Audit Master Report 2026-09-25 (owner-supplied .docx), reviewed offline against main 955996146 in session claude/review-assessment-4s1w86; no provider access",
-      "added": "2026-09-25"
-    },
-    {
-      "id": "#8H383K",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "check:offline-pack is not run by CI or any verify gate, so the offline page can silently fall behind signed-off timeline deadlines",
-      "detail": "public/offline.html is generated by scripts/build-offline-pack.ts from WA_CRISIS_CONTACTS and reviewed mha-timeframes entries. After a sign-off it silently omits the new entry (safe direction) until someone rebuilds it and bumps CACHE_VERSION. Wire check:offline-pack into static-pr / verify:pr-local, or make the sign-off tool rebuild the pack.",
-      "source": "Session 2026-09-25 WA psychiatry build (PR #3019)",
-      "added": "2026-09-25"
-    },
     {
       "id": "#6VPJ99",
       "priority": "P2",
@@ -909,24 +621,6 @@
       "source": "PR #3143 review",
       "added": "2026-09-25"
     },
-    {
-      "id": "#CYYRA7",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "Clinical hazard-control content drift only warns and never fails the governance gate (audit F13)",
-      "detail": "Verified offline: scripts/check-clinical-hazard-controls.mjs detects reviewedPathDigests drift and console.warns 'This is not a failure'. Warning-only was a deliberate choice after #D7K71C (squash-orphaned reviewedCommit turned CI red). Next action: make safety-semantic drift blocking but allow an explicit reviewed exception with an expiry date, so an intended edit does not red every branch. Do not revert to the reviewedCommit check.",
-      "source": "Ultimate Audit Master Report 2026-09-25 (owner-supplied .docx), reviewed offline against main 955996146 in session claude/review-assessment-4s1w86; no provider access",
-      "added": "2026-09-25"
-    },
-    {
-      "id": "#XE4D6D",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "Differentials ChunkLoadError under network fault: recovery is not proven (audit F11)",
-      "detail": "Audit F11 observed a dynamic ChunkLoadError on Differentials under network-fault conditions. Verified offline only that route error boundaries exist (src/app/error.tsx, (search-app)/error.tsx, global-error.tsx); no test proves chunk-load recovery. Next action: define the recovery (clear reload/retry message, clean state, telemetry) and add a test for it.",
-      "source": "Ultimate Audit Master Report 2026-09-25 (owner-supplied .docx), reviewed offline against main 955996146 in session claude/review-assessment-4s1w86; no provider access",
-      "added": "2026-09-25"
-    },
     {
       "id": "#F9HZEG",
       "priority": "P1",
@@ -945,24 +639,6 @@
       "source": "Ultimate Audit Master Report 2026-09-25 (owner-supplied .docx), reviewed offline against main 955996146 in session claude/review-assessment-4s1w86; no provider access",
       "added": "2026-09-25"
     },
-    {
-      "id": "#747FC0",
-      "priority": "P3",
-      "type": "issue",
-      "summary": "extractSafetyFindings takes about 89 seconds on a single 200,000-character passage, in the 260-character trimming step before any pattern runs",
-      "detail": "Found 2026-09-25 while adding a linear-time guard for the #GHC4XZ transfer pattern (PR B). The patterns themselves are linear (four 200k-character hostile inputs each under 500 ms via a tests-only hook), but extractSafetyFindings in src/lib/clinical-safety.ts spent about 89 s on one 200k-character passage in its trimming step. Real passages are chunk-sized, so this is unlikely to bite in normal use, but any caller that passes whole-document text would stall the thread. Not measured: which input sizes real callers pass. Likely fix: bound the input before trimming and add a timing test.",
-      "source": "PR B build 2026-09-25",
-      "added": "2026-09-25"
-    },
-    {
-      "id": "#F3SGCM",
-      "priority": "P2",
-      "type": "task",
-      "summary": "Hostile-document ingestion has design coverage but no end-to-end executable matrix (audit F18)",
-      "detail": "UPDATE 2026-09-26 (PR #3040, merged 103513f2d): the password-protected, damaged/truncated, zero-page and not-a-PDF classes are now enforced end to end at the extraction step. The Python extractor's exit 4 PDF_UNREADABLE refusal was previously swallowed and the JavaScript fallback indexed the file anyway; it now raises PdfUnreadableError, never falls back, is never retried, and the document fails with the extractor's plain reason (tests/pdf-unreadable-refusal.test.ts; checked by hand with the real PyMuPDF extractor on an AES-encrypted PDF and a text file renamed .pdf). Still open: the upload-to-answer matrix across all classes, with prompt-injected next. PRIOR DETAIL: Design covers rotated, password-protected, truncated, oversized, hidden-text, image-heavy and prompt-injected documents. Verified offline: prompt-injection tests exist (tests/rag-injection.test.ts) and forms handle passwordProtected, but no upload-to-answer matrix runs all classes. Next action: build the matrix, prompt-injected and password-protected first.",
-      "source": "Ultimate Audit Master Report 2026-09-25 (owner-supplied .docx), reviewed offline against main 955996146 in session claude/review-assessment-4s1w86; no provider access",
-      "added": "2026-09-25"
-    },
     {
       "id": "#3CW29T",
       "priority": "P3",
@@ -990,15 +666,6 @@
       "source": "Ultimate Audit Master Report 2026-09-25 (owner-supplied .docx), reviewed offline against main 955996146 in session claude/review-assessment-4s1w86; no provider access",
       "added": "2026-09-25"
     },
-    {
-      "id": "#XD5BHM",
-      "priority": "P2",
-      "type": "task",
-      "summary": "Add sign-off kinds with content pins for the Chief Psychiatrist Standards and the forms cultural notes",
-      "detail": "data/chief-psychiatrist-standards.json (8 drafted) and data/forms-cultural-notes.json (23 drafted) have no path through npm run clinical:review; today they could only be marked reviewed by hand-editing JSON, with no pin. Extend scripts/lib/clinical-record-review-contract.mjs with standard and cultural-note kinds, pin the rendered text, add --check enforcement and tests.",
-      "source": "Session 2026-09-25 WA psychiatry build (PR #3019)",
-      "added": "2026-09-25"
-    },
     {
       "id": "#2F8K1V",
       "priority": "P2",
@@ -1017,24 +684,6 @@
       "source": "Session 2026-09-25 WA psychiatry build (PR #3019)",
       "added": "2026-09-25"
     },
-    {
-      "id": "#X98D7J",
-      "priority": "P2",
-      "type": "rec",
-      "summary": "Release reporting should make per-case canary evidence first-class so an aggregate green cannot hide a failing case (audit F24)",
-      "detail": "Historical issue #628 kept a residual case open despite an aggregate green run; #2947 reinforces it. Next action: surface each eval case's verdict in the release/canary report, not only the aggregate thresholds. Not verified offline.",
-      "source": "Ultimate Audit Master Report 2026-09-25 (owner-supplied .docx), reviewed offline against main 955996146 in session claude/review-assessment-4s1w86; no provider access",
-      "added": "2026-09-25"
-    },
-    {
-      "id": "#1A1H9N",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "Saved answers keep the support label they were stored with, so the 'Strong support' label rule does not apply to answers cached before it shipped",
-      "detail": "Found in PR B review 2026-09-25 (#WGMB4Z, owner decisions 3, 10 and 17). The label cap (strongSupportLabelCapped) is computed on the server when the answer is projected for the client, and the client payload carries only the boolean, not supportedClaims or evidenceAssessments, so the browser cannot recompute it. A stored payload without the field keeps main behaviour (not capped). The restored answer thread (src/lib/answer-thread-storage.ts, sessionStorage, 12-hour TTL) replays the stored payload, so an answer saved before the rule shipped can still read 'Strong support' after deploy, in the same tab, for up to 12 hours. Server-side cached answers are re-projected on every response, so they pick up the rule (read from the answer routes, not tested). Not checked: whether any other store (saved or exported answers) keeps a client payload. Likely fix: bump the stored-thread schema version when a trust or label rule changes so older threads are discarded, and pin it with a test in tests/answer-thread-storage.test.ts.",
-      "source": "PR B review 2026-09-25",
-      "added": "2026-09-25"
-    },
     {
       "id": "#J9F1ZM",
       "priority": "P3",
@@ -1053,24 +702,6 @@
       "source": "Master product review 2026-09-26 (thread: Review master review ideas); cross-checked against main 004ab6301",
       "added": "2026-09-26"
     },
-    {
-      "id": "#RAAB0J",
-      "priority": "P3",
-      "type": "task",
-      "summary": "Crisis numbers: re-verify all seven against their official sources every six months (next due by March 2027)",
-      "detail": "src/lib/crisis-contacts.ts is the single source for every real crisis number shown (safety plan, care plan, offline page). Four WA numbers verified 2026-08-20 and re-confirmed unchanged 2026-09-26 against EMHS MHERL (page updated 18/08/2026) and Rurallink pages; three national lines verified 2026-09-25. Nothing reminds anyone to re-check. When re-checking: compare number and hours to each sourceUrl, move verifiedOn only for entries actually re-checked, run npm run offline:build (bumps the offline page, so new CACHE_VERSION + hash pin in tests/pwa-manifest.test.ts), and update docs/care-plan/crisis-lines-verification.md.",
-      "source": "session 2026-09-26 calendar/on-call follow-ups",
-      "added": "2026-09-26"
-    },
-    {
-      "id": "#A9GC6S",
-      "priority": "P3",
-      "type": "rec",
-      "summary": "CME: record missed teaching or supervision, with a linked replacement session",
-      "detail": "Review item D12. From a shift, record planned teaching or supervision lost to clinical work, the time lost and a brief non-patient reason, then link a replacement session. Missed teaching earns no CPD credit; the replacement is its own record. Nothing is sent to an employer without an explicit, permitted action. Not started.",
-      "source": "Master product review 2026-09-26 (thread: Review master review ideas); cross-checked against main 004ab6301",
-      "added": "2026-09-26"
-    },
     {
       "id": "#JYH1FH",
       "priority": "P1",
@@ -1080,15 +711,6 @@
       "source": "Nine-issue packet follow-through session, 2026-09-25; live audit output pasted by the owner",
       "added": "2026-09-25"
     },
-    {
-      "id": "#4WSEG4",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "Fiona Stanley Mother and Baby Unit service record contradicts itself: 'Not emergency/crisis service' but tagged 'Crisis / urgent'",
-      "detail": "Record: data/services-snapshot.json, services[] id S115, 'Mother and Baby Mental Health Unit (Fiona Stanley Hospital)' (slug mother-and-baby-mental-health-unit-fiona-stanley-hospital). Its exclusions and exclusion_rejection_criteria fields both say 'Not emergency/crisis service', but tags.acuity_flags lists crisis_high (with high, moderate, supportive), and tags.age_groups lists older_adult and youth (with adult, mixed) for a mother-and-baby unit. src/lib/service-catalog-mapper.ts turns crisis_high into the red 'Crisis / urgent' status chip, the services 'Crisis / urgent' acuity filter (src/lib/service-facets.ts) matches it, and the flag is flattened into the record's search text, so services search, universal search and Clinical Ask services evidence match it on 'crisis' queries (checked offline on main 2026-09-25: it ranks #9 for 'psychosis crisis' and 'perinatal crisis', and #1 for 'mother baby crisis', where main's Best-fit check in src/lib/service-best-fit.ts passes because the flattened text carries every query word, so it can be badged Best fit on a crisis query). Urgent routing (src/lib/service-urgent-routing.ts) does not pin it: its matchers do not read crisis_high. The same record is copied into the registry baseline in supabase/migrations/20260824122000_add_site_content_release_and_outbox.sql and supabase/schema.sql, and so may be in the live registry. Owner (Josh) to decide the correct acuity and age groups and correct the source record; never edit the applied migration. No code change.",
-      "source": "PR C review 2026-09-25 (rebuilt on main after PR #3019)",
-      "added": "2026-09-25"
-    },
     {
       "id": "#T9PRB9",
       "priority": "P2",
@@ -1107,15 +729,6 @@
       "source": "Owner answer in Claude Code session 2026-09-26 (session_018CR3YcCWjJk2fyzTNYmMi4)",
       "added": "2026-09-26"
     },
-    {
-      "id": "#G20QE6",
-      "priority": "P3",
-      "type": "rec",
-      "summary": "Payslip discrepancy enquiry pack and study budget/claim pack",
-      "detail": "Review items D16, F19, F31. Compare rostered, actual and paid hours for one pay period and produce an itemised enquiry pack (not an underpayment claim); link course fees, receipts, leave and reimbursement status. Outside the clinical core and needs the correct WA agreement and clauses verified first; lowest priority.",
-      "source": "Master product review 2026-09-26 (thread: Review master review ideas); cross-checked against main 004ab6301",
-      "added": "2026-09-26"
-    },
     {
       "id": "#8CKX6F",
       "priority": "P2",
@@ -1125,15 +738,6 @@
       "source": "PR #3157 review",
       "added": "2026-09-25"
     },
-    {
-      "id": "#V1NYQ0",
-      "priority": "P3",
-      "type": "issue",
-      "summary": "Claude review workflow: the enableAllProjectMcpServers false setting is still overridden to true",
-      "detail": "Observed 2026-09-26 in job 108333544464 (run 36216555282, PR #3046): the workflow passes settings '{\"enableAllProjectMcpServers\": false}' but the action logs 'Updated settings with enableAllProjectMcpServers: true', the same as first recorded under #NNAWDT on 2026-09-20. Impact looks low, not proven: the reviewer's allowedTools list names no project MCP tool, and .mcp.json is restored from main rather than the PR head, but the project MCP servers may still be started on the runner. Next action: read how claude-code-action v1.0.223 merges the settings input, then either pass the setting in the form it honours or record why auto-load is harmless here; update the workflow header comment either way.",
-      "source": "GitHub Actions job 108333544464 log, read 2026-09-26 in session claude/review-assessment-4s1w86",
-      "added": "2026-09-26"
-    },
     {
       "id": "#25PJFR",
       "priority": "P3",
@@ -1143,33 +747,6 @@
       "source": "Master product review 2026-09-26 (thread: Review master review ideas); cross-checked against main 004ab6301",
       "added": "2026-09-26"
     },
-    {
-      "id": "#Y5X0HH",
-      "priority": "P3",
-      "type": "task",
-      "summary": "WA public holidays: add the official 2028 list when WA publishes it, to confirm King's Birthday",
-      "detail": "src/lib/on-call/wa-public-holidays.ts now computes holidays by rule after the last published year (2027), and a test pins that the rules reproduce every published 2026-2027 date. King's Birthday is set by proclamation (assumed last Monday of September). When wa.gov.au publishes 2028 dates, add them to WA_PUBLIC_HOLIDAYS, raise WA_PUBLIC_HOLIDAYS_LAST_YEAR, and the reproduction test will flag any moved date.",
-      "source": "session 2026-09-26 calendar/on-call follow-ups",
-      "added": "2026-09-26"
-    },
-    {
-      "id": "#VA5SP4",
-      "priority": "P3",
-      "type": "task",
-      "summary": "Playwright: 44 fixed waitForTimeout pauses remain, mostly in the phone and chrome scroll specs",
-      "detail": "TRIAGED 2026-09-27: not a blanket fix. Many of the 44 waitForTimeout calls are deliberate: ui-chrome-scroll.spec.ts:166 paces wheel steps at 16 ms like a real device, and ui-phone-scroll.spec.ts:98 waits a fixed 350 ms to prove the collapsed header does not oscillate (a negative timing assertion that polling cannot express). The remainder are post-scroll settle windows before one-shot geometry reads; each needs converting to expect.poll on the specific settled state and proving with repeated npm run verify:phone-chrome runs, because these specs guard the protected search chrome (AGENTS.md Search chrome behaviour). Next action: in a planned session, classify each call as deliberate or settle, convert only the settle ones one spec at a time, and prove each spec green three times locally before pushing. Original locations as listed on main 7f8312f2c: ui-chrome-scroll 11, ui-phone-scroll 11, ui-phone-scroll-routes 7, ui-dictionary 4, ui-phone-scroll-page-owned 2, ui-smoke 2, ui-style-contract 2, ui-universal-search 2, ui-pwa 1, ui-therapy-nav-scroll 1, ui-therapy-pathways 1.",
-      "source": "Design, front-end and test review 2026-09-27 (Claude Code session: web-design-guidelines, frontend-checklist-global, playwright-best-practices, codebase-design skills), re-verified on main a3fee8d1a",
-      "added": "2026-09-27"
-    },
-    {
-      "id": "#5NXQM4",
-      "priority": "P3",
-      "type": "rec",
-      "summary": "Search header interface is very wide: MasterSearchHeader takes about 61 props and its two callers pass 56 and 40",
-      "detail": "DEFERRED 2026-09-27 to a planned session: resolving this is a multi-file redesign of protected search chrome, not a quick fix. src/components/clinical-dashboard/master-search-header.tsx (MasterSearchHeader, about 61 props) is fed by src/components/ClinicalDashboard.tsx (56 props) and src/components/clinical-dashboard/global-search-shell.tsx (40 props). The ClinicalDashboard size itself is already tracked as a monolith in docs/maturity-backlog-workorders.md section X3. Next action: write a short design (codebase-design vocabulary) for a deeper search-session module that owns query, mode and filter state behind a small interface, agree it with the owner, then implement behind docs/search-chrome-behaviour.md with npm run verify:phone-chrome and the static contract tests.",
-      "source": "Design, front-end and test review 2026-09-27 (Claude Code session: web-design-guidelines, frontend-checklist-global, playwright-best-practices, codebase-design skills), re-verified on main a3fee8d1a",
-      "added": "2026-09-27"
-    },
     {
       "id": "#V5C4QJ",
       "priority": "P2",
@@ -1179,15 +756,6 @@
       "source": "Split from #P00HDB after a Codex review of PR #3112, 2026-09-26",
       "added": "2026-09-26"
     },
-    {
-      "id": "#PVVAPA",
-      "priority": "P3",
-      "type": "task",
-      "summary": "Playwright: one hydration test still waits on networkidle, which Playwright advises against",
-      "detail": "CORRECTED 2026-09-27 (Codex review on PR 3128): only one executable networkidle wait remains, tests/ui-hydration.spec.ts:61 await page.waitForLoadState(\"networkidle\"). The other four originally cited lines (ui-specifiers.spec.ts:24, ui-style-contract.spec.ts:165, 184, 227) are comments recording that networkidle was deliberately avoided, so they need no change. Next action: replace the one call with a wait on the specific hydrated element or state the test needs.",
-      "source": "Design, front-end and test review 2026-09-27 (Claude Code session: web-design-guidelines, frontend-checklist-global, playwright-best-practices, codebase-design skills), re-verified on main a3fee8d1a",
-      "added": "2026-09-27"
-    },
     {
       "id": "#4JTTQ7",
       "priority": "P2",
@@ -1197,15 +765,6 @@
       "source": "Claude session 2026-09-27, branch claude/repository-review-bugs-52tq9q",
       "added": "2026-09-27"
     },
-    {
-      "id": "#23Q709",
-      "priority": "P3",
-      "type": "issue",
-      "summary": "scripts/stamp-service-worker.mjs runs in the production build but is missing from Railway's app watch patterns, so a change to it alone never redeploys the site",
-      "detail": "package.json build:internal runs node scripts/stamp-service-worker.mjs, which rewrites public/sw.js per release (see the Dockerfile runner-stage comment). railway.app.json watchPatterns lists the other build scripts individually (guard-next-build.mjs, check-client-bundle-secrets.mjs, check-upload-limit-parity.mjs, run-heavy.mjs) but not this one. Next action: add /scripts/stamp-service-worker.mjs to railway.app.json watchPatterns, and consider a static test that every script the build:internal chain invokes is watched.",
-      "source": "Latency, network, Railway and wiring review 2026-09-27 (Claude Code session claude/repo-latency-network-review-zcqd5c), offline code read against main 7f8312f2c; no provider access",
-      "added": "2026-09-27"
-    },
     {
       "id": "#H69FNZ",
       "priority": "P2",
@@ -1215,24 +774,6 @@
       "source": "Latency, network, Railway and wiring review 2026-09-27 (Claude Code session claude/repo-latency-network-review-zcqd5c), offline code read against main 7f8312f2c; no provider access",
       "added": "2026-09-27"
     },
-    {
-      "id": "#J7RV8Q",
-      "priority": "P3",
-      "type": "rec",
-      "summary": "Medication pages show the maximum dose three times because the same content renders in three sections",
-      "detail": "Found in the 2026-09-27 phone-first design review (PR #3145 session). The same max-dose text appears in three sections of a medication page, which lengthens the page on a phone and risks the copies drifting apart. Clinical content decision for the owner: which section should own the max dose, and whether the others link to it. Not changed by that PR.",
-      "source": "Claude Code session 2026-09-27 phone-first design review (PR #3145)",
-      "added": "2026-09-27"
-    },
-    {
-      "id": "#H9WAQN",
-      "priority": "P3",
-      "type": "task",
-      "summary": "Split the largest front-end files (ClinicalDashboard ~4,000 lines, MasterSearchHeader ~3,200, globals.css ~6,000) into smaller owned modules",
-      "detail": "Found in the 2026-09-27 design review (PR #3145 session). Their size makes every UI change fragile and slow to review. Owner chose not to rebuild them in that pass. Do one file per careful PR, behaviour-neutral, with verify:phone-chrome and the full browser suite; globals.css splits must preserve cascade order (unlayered component CSS by design).",
-      "source": "Claude Code session 2026-09-27 phone-first design review (PR #3145)",
-      "added": "2026-09-27"
-    },
     {
       "id": "#K55VBV",
       "priority": "P3",
@@ -1260,31 +801,13 @@
       "source": "Latency, network, Railway and wiring review 2026-09-27 (Claude Code session claude/repo-latency-network-review-zcqd5c), offline code read against main 7f8312f2c; no provider access",
       "added": "2026-09-27"
     },
-    {
-      "id": "#1DYJJQ",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "Most server-side Supabase calls have no deadline, so a stalled database request can hang for minutes on the single app replica",
-      "detail": "The service-role client (src/lib/supabase/admin.ts:16) is created without a global fetch timeout, and only 14 non-test files in src/ apply .abortSignal() to queries (the readiness probe in src/lib/supabase/health.ts does). Everything else relies on undici's default header/body timeouts (about 300 s). That includes the durable rate-limit RPCs every answer passes through (src/lib/api-rate-limit.ts:300, 360, 424). Search is bounded only by the client disconnecting at 45 s; other routes have no bound. Next action: add a default per-request deadline for server Supabase calls (for example a global fetch wrapper with AbortSignal.timeout, overridable for known long operations such as ingestion and exports), classify the expiry as unavailable, and cover it with a unit test. Check the ingestion worker's long jobs are exempt before rollout.",
-      "source": "Latency, network, Railway and wiring review 2026-09-27 (Claude Code session claude/repo-latency-network-review-zcqd5c), offline code read against main 7f8312f2c; no provider access",
-      "added": "2026-09-27"
-    },
-    {
-      "id": "#F06YE4",
-      "priority": "P2",
-      "type": "issue",
-      "summary": "CME phone customise screen renders two cme-module-order lists, failing the ui-cme-phone reorder-controls browser test",
-      "detail": "Seen 2026-09-27 in a local full verify:phone-chrome run on PR #3145's branch (which does not touch CME): tests/ui-cme-phone.spec.ts:109 failed with a strict-mode violation, getByTestId('cme-module-order') resolved to 2 elements (one inside mobile-composer-reserve-pad, one elsewhere). Either the customise list is rendered twice on a phone (a real duplicate-controls defect) or the test needs scoping. Not yet diagnosed; check whether it reproduces on origin/main first.",
-      "source": "Claude Code session 2026-09-27, local verify:phone-chrome (PR #3145 branch)",
-      "added": "2026-09-27"
-    },
     {
       "id": "#NZ4X41",
       "priority": "P3",
       "type": "task",
-      "summary": "Therapy catalogue: add clinical references for 47 unsourced records to enable clinician sign-off",
-      "detail": "158 of 205 therapies were signed off by owner in #SBKXZ7. 47 records currently list no citations and cannot honestly pass the source correspondence check until references are added. Adding references does not close this row: each of the 47 records still needs clinician sign-off afterwards, recorded the same way as the 158 in #SBKXZ7.",
-      "source": "Owner sign-off batch 2026-10-06",
+      "summary": "Therapy catalogue: 22 of 47 unsourced records now carry NICE references and await sign-off, 25 still have none",
+      "detail": "UPDATE 2026-10-10: PR #3398 added verbatim NICE recommendation citations (CG178, CG185, NG222, CG113, CG115, CG78, NG225, NG87, read from each publisher page on 2026-10-09) plus a record note to 22 of the 47, so they are now in therapy-signable-slugs and offered by the sign-off tool. NEXT (owner): read each and sign with npm run therapy:review -- --write --walk --reviewed-by \"Dr <surname>\". The 25 still without a reference, because no register guideline names them: behaviour-therapy, cognitive-behavioural-therapy-for-insomnia-cbt-i, cognitive-therapy, community-reinforcement-and-family-training-craft, contingency-management-cm, cue-exposure-therapy-cet-for-substance-use-disorders, exposure-and-response-prevention-for-tics-erp-for-tics, habit-reversal-training-for-trichotillomania-and-excoriation-disorder, imagery-rehearsal-therapy-irt-for-nightmare-disorder, integrated-cbt-for-ptsd-and-substance-use-disorders, interpersonal-and-social-rhythm-therapy-ipsrt, matrix-model, mentalisation-based-therapy-mbt, mindfulness-based-relapse-prevention-mbrp, mindfulness-based-therapy-for-insomnia-mbti, mother-infant-therapy-mother-infant-psychotherapy, motivational-enhancement-therapy-met, parent-and-child-training, parent-child-relational-therapy, parent-child-interaction-therapy-pcit, psychoeducation-for-psychosis, recovery-oriented-psychosocial-interventions, relapse-prevention-therapy-for-substance-use-disorders, seeking-safety, social-communication-parent-mediated-autism-interventions. They need new sources captured (sources skill, WA-first ladder) before they can be signed. Claude never records a sign-off for the owner. PRIOR DETAIL: 158 of 205 therapies were signed off by owner in #SBKXZ7. 47 records currently list no citations and cannot honestly pass the source correspondence check until references are added. Adding references does not close this row: each of the 47 records still needs clinician sign-off afterwards, recorded the same way as the 158 in #SBKXZ7.",
+      "source": "session 2026-10-10 /ledger sweep, PR #3398 (merged 2026-10-09 as 6f9203d55)",
       "added": "2026-10-06"
     },
     {
@@ -1296,15 +819,6 @@
       "source": "PR #3302 post-merge audit",
       "added": "2026-10-06"
     },
-    {
-      "id": "#PT83FG",
-      "priority": "P3",
-      "type": "rec",
-      "summary": "Search My Work: extend v12 question grammar and indexers to cover Teaching Assessments and Alerts",
-      "detail": "Search My Work v12 (PR #3295) indexes Roster, Teaching events, CPD, Admin, and On Call. Expand the indexer and search grammar to cover EPA milestones and active reminder alerts.",
-      "source": "PR #3295 post-merge audit",
-      "added": "2026-10-06"
-    },
     {
       "id": "#WVS32F",
       "priority": "P3",
@@ -1324,31 +838,229 @@
       "added": "2026-10-02"
     },
     {
-      "id": "#4KQGXZ",
+      "id": "#YETFBJ",
+      "priority": "P3",
+      "type": "task",
+      "summary": "Two protected retrieval scripts still use the Windows-fragile entrypoint check; convert them with owner approval",
+      "detail": "scripts/eval-retrieval.ts and scripts/build-ranking-snapshot.ts still decide they are the entrypoint with import.meta.url === pathToFileURL(process.argv[1]).href, which can exit 0 having done nothing on Windows. Both are RAG-ranking protected surfaces (pr-policy ragRankingPatterns), so the change was left out of the entrypoint-guard PR. They are the only two entries in ALLOWED_RAW in tests/script-entrypoint-guard.test.ts (plus sync-open-pr-branches.mjs, which has a file-name fallback). Next action: with owner approval, switch both to isDirectEntrypoint from scripts/lib/is-entrypoint.mjs, write a RAG impact line (no retrieval behaviour change), and remove them from ALLOWED_RAW.",
+      "source": "Review of five Antigravity reports against main, 2026-10-12",
+      "added": "2026-10-12"
+    },
+    {
+      "id": "#08216B",
+      "priority": "P3",
+      "type": "task",
+      "summary": "Remove PR 3538 leftovers once the 30-day dead-code window passes (after 13 Nov 2026)",
+      "detail": "The /api/proxy route only replies authenticated and nothing calls it. scripts/recalculate-answer-support-labels.ts and its test are run by nothing. The 11 developer tool pages under src/app/mockups/development are now unreachable duplicates of /admin/developer-hub. The safe-number editor, attendance roster, QR check-in helper and clinical note editor are unwired; wire or remove each, and the note editor needs a privacy review before use. The clinical-math calculators need ideal body weight guidance, a corrected lithium dialysis label, a consistent 1.2 mmol/L boundary and tablet-strength rounding before any use.",
+      "source": "PR 3538 review, 15 Oct 2026",
+      "added": "2026-10-15"
+    },
+    {
+      "id": "#F3B2XC",
       "priority": "P2",
       "type": "task",
-      "summary": "Teaching Assessments: Supabase schema and persistence for registrar assessment forms and supervisor bookings",
-      "detail": "PR #3302 introduced /teaching/assessments on made-up records. Real use requires Supabase tables, RLS policies, and endpoints for storing assessment ratings, feedback, and meeting availability.",
-      "source": "PR #3302 post-merge audit",
-      "added": "2026-10-06"
+      "summary": "Check the live Tall Man drug lettering list against the ACSQHC National Tall Man list",
+      "detail": "src/lib/medications/tall-man.ts is live on medication search and record pages but was never checked against the official list. Doubtful: citaloPRAM/escitaloPRAM and fluPENtixol/zucloPENthixol capitalise the shared stem so they do not separate the pair, CLONazepam differs from ISMP clonazePAM, and VALproate, midazolAM, temazePAM, oxazePAM need checking. Matching is exact-name only. Needs owner verification.",
+      "source": "PR 3538 review, 15 Oct 2026",
+      "added": "2026-10-15"
+    },
+    {
+      "id": "#H38M3Y",
+      "priority": "P3",
+      "type": "issue",
+      "summary": "The instruction-budget test timed out once under the full unit suite but passed 36 of 36 when run alone; unconfirmed flake (audit M5-1)",
+      "detail": "Not reproduced. If it recurs, find the slow step and make it robust; never skip or disable the test. Record the run id and timing on the next occurrence.",
+      "source": "Audit 2026-10-08, rechecked against main 2026-10-13",
+      "added": "2026-10-13"
+    },
+    {
+      "id": "#NHR0MM",
+      "priority": "P3",
+      "type": "issue",
+      "summary": "Roster week strip shows only the first shift kind on a day; Teaching next-session ignores all-day entries; WA public holidays end at 2028",
+      "detail": "roster-week-strip.tsx uses kinds[0] so a morning plus night shift looks like a morning alone (de-duplicate kinds and count distinct kinds for any overflow marker, test with two shifts of the same kind). teaching-view-model.ts:138 excludes all-day sessions from nextSession (restore a date guard for all-day entries: today or later). src/lib/on-call/wa-public-holidays.ts has data for 2026-2028 only, including the fairness count call site.",
+      "source": "PsychSift audit review (16 audit reports) checked against main 4382217, 2026-10-13",
+      "added": "2026-10-13"
+    },
+    {
+      "id": "#ZWJCK4",
+      "priority": "P1",
+      "type": "issue",
+      "summary": "PDF extractor can turn prose beneath a table into a table row and rebuild the table markdown from it",
+      "detail": "worker/python/extract_pdf_assets.py recover_table_rows_from_edge_strip (~:557, caller ~:1367-1390) admits blocks by position alone (four bbox tests) and treats each line as a cell, then rebuilds the whole accessible table markdown, which reaches the vision model, document_table_facts (threshold_value/action) and page.text/search. Also appends recovered rows unsorted, drops single-baseline rows silently, has no test, and worker/python/** is outside the coverage inventory. Next action: accept a recovered block only when its line x-positions align with table.rows cell bboxes, sort by y0, drop the row on alignment failure, cover the markdown rebuild path too, and add a synthetic test (3-column table followed by a 3-line paragraph asserting no new row and unchanged accessible_table_markdown).",
+      "source": "PsychSift audit review (16 audit reports) checked against main 4382217, 2026-10-13",
+      "added": "2026-10-13"
     },
     {
-      "id": "#T983N9",
+      "id": "#SAKCD9",
       "priority": "P2",
       "type": "task",
-      "summary": "CPD: database storage and sync for registrar training milestones (EPAs, WBAs, term assessments)",
-      "detail": "On the CPD Training page (PR #3289), signed-in doctors are shown 'not-recorded'. Build the storage schema and sync pipeline for registrar milestones.",
-      "source": "PR #3289 post-merge audit",
-      "added": "2026-10-06"
+      "summary": "Ranking-snapshot date gate will fail around 3 Nov 2026 if the automated snapshot-refresh PR is not merged (audit H5-1)",
+      "detail": "The snapshot was refreshed to 4 Oct, so the automatic checks pass today. .github/workflows/ranking-snapshot-refresh.yml runs after each weekly Eval Canary on main and opens a refresh PR once the snapshot is 14 days old, reusing the canary artifact with no provider calls. Next: watch for that PR (expected from about 18 Oct) and get it reviewed and merged before the 30-day expiry; it touches a RAG ranking fixture, so follow docs/rag-behaviour/ and the canary rules. Only if no refresh PR appears (canary failing or not running) does a new paid eval, with the owner's explicit approval, become necessary.",
+      "source": "Audit 2026-10-08, rechecked against main 2026-10-13",
+      "added": "2026-10-13"
+    },
+    {
+      "id": "#1WAA0Z",
+      "priority": "P3",
+      "type": "task",
+      "summary": "Possible dead code: older calculator mockups (audit M5-2) and On Call Education, Compliance and Logistics screens said to be unreachable (audit L4D-05)",
+      "detail": "Recheck first: the On Call sections are still used by calendar events and tests, so L4D-05 may be wrong. Delete nothing without npm run check:dead-code-candidate (see docs/agents/dead-code-deletion.md).",
+      "source": "Audit 2026-10-08, rechecked against main 2026-10-13",
+      "added": "2026-10-13"
+    },
+    {
+      "id": "#JVQ1HA",
+      "priority": "P2",
+      "type": "issue",
+      "summary": "Precompute GIN search_tsv on site_content_release_records for hybrid retrieval",
+      "detail": "In Supabase RPC match_document_chunks_hybrid_v3 (supabase/migrations/20260830122000_add_corpus_scoped_retrieval_v3.sql), full-text matching against site_content_release_records dynamically runs to_tsvector on each row during queries. Storing a generated or trigger-maintained search_tsv tsvector column with a GIN index on public.site_content_release_records accelerates hybrid retrieval without dynamic DB re-vectorization.",
+      "source": "session 2026-10-14 performance audit follow-up",
+      "added": "2026-10-14"
+    },
+    {
+      "id": "#3AVEFG",
+      "priority": "P3",
+      "type": "task",
+      "summary": "Small audit leftovers: merge needs zero human approvals and the 'Database / production' GitHub environment is not a real approval gate (L6-F2, L6-F3); reindex reaper has no protected environment (L6-F4); admin has two home pages (L4G-L1); thin browser tests for Compliance, records, Psychiatry and the MHA clock (L4G-L2); clinical-kb name in 47 files (F-L2-04); install prompt may cover password-reset and privacy pages on first paint (L4A-F2)",
+      "detail": "Settings changes in GitHub are the owner's. Browser-check L4A-F2 before changing anything. HYSWAF already tracks Railway deploying before checks finish (L6-F1).",
+      "source": "Audit 2026-10-08, rechecked against main 2026-10-13",
+      "added": "2026-10-13"
+    },
+    {
+      "id": "#BGDVPD",
+      "priority": "P3",
+      "type": "issue",
+      "summary": "Cache compiled boundary regexes in document chunking pipeline",
+      "detail": "In src/lib/chunking.ts, buildChunks repeatedly re-compiles regex boundary patterns during document chunking, consuming 27.67 ms average CPU time on 12-page documents. Pre-compiling sentence/section regex patterns or memoizing chunk boundaries improves background ingestion throughput.",
+      "source": "session 2026-10-14 performance audit follow-up",
+      "added": "2026-10-14"
+    },
+    {
+      "id": "#ASA514",
+      "priority": "P2",
+      "type": "task",
+      "summary": "Arrange Aboriginal governance review for the five held cultural formulation records before any is published",
+      "detail": "Follow-up to #R8HED2 (closed by PR #3412's hold). first-nations-sewb, cultural-explanatory-model, migration-refugee, racism-discrimination and religion-spirituality have release held in src/data/formulation-concepts.json. All carry Indigenous terms, so the clinical sign-off tool refuses them (scripts/lib/indigenous-content.mjs); each needs review under Aboriginal governance. The records also still read clinical_review_required with no reviewer, so governance review alone does not clear them: keep release held until the owner decides how their review status is completed and explicitly approves republishing (then restore each search-index entry). Changing release or review status is a clinical content change.",
+      "source": "Review of PR #3521, 2026-10-13",
+      "added": "2026-10-13"
     },
     {
-      "id": "#R8HED2",
+      "id": "#WFYDV6",
       "priority": "P1",
       "type": "issue",
-      "summary": "Five unsigned cultural formulation records are live: #DXJ70P closed them as held, but only one is held",
-      "detail": "Found 2026-10-09 by review of the reconcile PR #3396 and confirmed in src/data/formulation-concepts.json. #DXJ70P was closed on 2026-10-06 saying 6 Indigenous records were formally held under the Indigenous Governance policy. Only first-nations-sewb has release held. Five still have release published with review status clinical_review_required and reviewer null (prepared 2026-09-14): cultural-explanatory-model, migration-refugee, racism-discrimination, religion-spirituality and guide-07. So clinicians can read five records with no clinician sign-off. Next action, an owner decision: either sign each off, or set it to held. Changing release is a clinical content change, so it needs the owner's explicit yes.",
-      "source": "PR #3396 review (Greptile), checked against src/data/formulation-concepts.json",
-      "added": "2026-10-09"
+      "summary": "Unwired WA MHA Form 6A/6B print component carries unverified statutory text",
+      "detail": "src/components/forms/wa-mha-form-print.tsx (PR #3538) says Form 6B needs Chief Psychiatrist consent, while src/lib/form-register.ts calls the 6B attachment a report to the Chief Psychiatrist. Section lists, the 7-day pre-expiry examination and copy recipients are unverified, and it prints WA Government branding. Fabricated default patient, clinician and consent values were removed on 15 Oct. Nothing renders it. Delete it once the 30-day dead-code window passes (after 13 Nov 2026) unless legal and clinical sign-off is obtained first.",
+      "source": "PR 3538 review, 15 Oct 2026",
+      "added": "2026-10-15"
+    },
+    {
+      "id": "#YF0XSQ",
+      "priority": "P2",
+      "type": "issue",
+      "summary": "A review bot (Gitar) armed auto-merge on a clinical-risk PR and it merged on bot approval alone, with no human review",
+      "detail": "Decide whether bot-enabled auto-merge should be allowed on PRs that touch the clinical-risk list (e.g. patient-safety-plan.tsx), and if not, turn off Gitar auto-merge or require a human approval via branch protection. Why: PR 3507 changed a patient-safety component and was squash-merged by gitar-bot at 2026-10-13 04:24 after only bot approvals; AGENTS.md treats auto-merge state as user-owned. Context: the owner had not armed it; the session could not disable it without breaking that rule. Owner: user. Confidence: high.",
+      "source": "session 2026-10-13 /ledger sweep; PR BigSimmo/PsychSift#3507",
+      "added": "2026-10-13"
+    },
+    {
+      "id": "#VDAXJX",
+      "priority": "P1",
+      "type": "issue",
+      "summary": "teaching_command('display.revoke') authorisation guard passes when display link created_by is NULL",
+      "detail": "supabase/migrations/20260926225609_teaching_mode.sql:1473 uses 'if not (v_link.created_by = p_actor_id or v_role = organiser) then raise'. created_by is nullable (on delete set null), so NULL or false is NULL and the raise never fires: a non-organiser can revoke a link whose creator was deleted. The same pattern was repaired in two other functions by a null-guards migration. Next action (needs an approved migration window, a Supabase migration reaches the live clinical database on merge): coalesce(v_link.created_by = p_actor_id, false) is not true and v_role <> 'organiser'. Fix before the teaching surface opens.",
+      "source": "PsychSift audit review (16 audit reports) checked against main 4382217, 2026-10-13",
+      "added": "2026-10-13"
+    },
+    {
+      "id": "#CFHRJY",
+      "priority": "P2",
+      "type": "issue",
+      "summary": "Virtualize long document and differential diagnosis result lists",
+      "detail": "In src/components/clinical-dashboard/document-search-results.tsx (which has a 30-result initial progressive reveal) and src/components/differentials/differential-stream-workspace.tsx, evaluate virtualization or DOM recycling for large query results exceeding initial reveal limits to prevent memory bloat and scroll stutter while preserving keyboard/screen-reader accessibility.",
+      "source": "session 2026-10-14 performance audit follow-up",
+      "added": "2026-10-14"
+    },
+    {
+      "id": "#A33Z1X",
+      "priority": "P2",
+      "type": "issue",
+      "summary": "Services directory shows clinical-owner sign-off as pending while junior doctors use it for catchments and urgent contacts (audit L4B-H1)",
+      "detail": "Owner decision: sign the Services directory off, or hide it until signed. No code change until then.",
+      "source": "Audit 2026-10-08, rechecked against main 2026-10-13",
+      "added": "2026-10-13"
+    },
+    {
+      "id": "#3B4S3Z",
+      "priority": "P2",
+      "type": "issue",
+      "summary": "Safe number editor: two managers saving at almost the same moment can overwrite each other's cover needs",
+      "detail": "The editor (Manage, Team settings, PR #3431) re-reads the team's needs, then sends needs.set, which replaces the whole list. The read and the write are separate requests, so a dated, grade or site need, or a safe number, that another manager saves in that gap is lost. Undo has the same gap. Closing it needs a database change (owner's explicit yes required): a version check on the team's needs so needs.set only succeeds against the list it read, else re-read and ask the manager to retry. Then add a test that interleaves a second save between the read and the write. Raised by Qodo on PR #3431, left open by choice as rare. Josh asked for it to be recorded 2026-10-10.",
+      "source": "PR #3431 review (Qodo), modes and dead wiring review thread",
+      "added": "2026-10-10"
+    },
+    {
+      "id": "#K66YES",
+      "priority": "P3",
+      "type": "rec",
+      "summary": "On Call has overlapping homes for numbers (Call vs Contacts) and referrals (Refer vs Referrals), and its menu 'Now' goes to /on-call while 'Who to call now' lives at /on-call/now (audit L4D-01 to L4D-03)",
+      "detail": "Owner decision on one home per job and the naming, then a single navigation change. Also covers /roster/calendar showing On Call dates under a Roster address (L4E-F3).",
+      "source": "Audit 2026-10-08, rechecked against main 2026-10-13",
+      "added": "2026-10-13"
+    },
+    {
+      "id": "#NBJQD8",
+      "priority": "P1",
+      "type": "issue",
+      "summary": "Medication interaction lexicon: the 28 Sept sign-off is out of date because the drug groupings changed since; alerts still fire on an unapproved version (audit L4C-H1)",
+      "detail": "Owner action: re-approve the current lexicon through the review sheet. The check only warns, so nothing blocks the stale version meanwhile.",
+      "source": "Audit 2026-10-08, rechecked against main 2026-10-13",
+      "added": "2026-10-13"
+    },
+    {
+      "id": "#WMGPSG",
+      "priority": "P2",
+      "type": "issue",
+      "summary": "Doc/instruction drift left open after the doc-fix pass: encoding damage, cloud-profile worktree rule, RAG duty missing from skills, stale decision",
+      "detail": "(1) docs/privacy-impact-assessment.md and docs/openai-cross-border-basis.md carry double-encoded text and a BOM (a verified-lossless guarded per-run repair exists on an unpushed branch; never a naive whole-file re-encode); docs/outstanding-issues.md:15 has a corrupted arrow (canonical ledger, edit only via reconciliation). (2) .claude/cloud-profile/skills/prompt/references/coding-workflow.md:21 has the pre-hardening worktree rule and is copied into every container session (owner decision on owned versus vendored). (3) No .agents skill mentions the RAG ranking-protection duty, and the retrieval-quality and reindex runbooks have no canary-pair or approval requirement. (4) docs/decisions/2026-09-26-remove-ward-flow-and-caring-contacts.md says Caring Contacts was removed but src/lib/caring-contacts/clock.ts is live with importers; needs a dated superseding decision, do not delete the file. (5) Admin renewals page test dropped its checked-wording assertion while admin-renewed-sheet still forbids the word; record the decision. (6) min-h-[48px] remains at account-setup-dialog.tsx:246 against a 'none remain' claim in docs/redesign/07-token-adoption-audit.md.",
+      "source": "PsychSift audit review (16 audit reports) checked against main 4382217, 2026-10-13",
+      "added": "2026-10-13"
+    },
+    {
+      "id": "#HMBEQK",
+      "priority": "P3",
+      "type": "task",
+      "summary": "Medicines reference list is live but its code comment still says it awaits the owner's check, and Medication Prescribing and Risk and Safety still show 'review due' (audit L4C-M1, L4C-M2)",
+      "detail": "Owner check of src/lib/medicines-references.ts wording and the two tools, then update the comment and the review-due chips. The comment states a governance fact, so it is not edited without that check.",
+      "source": "Audit 2026-10-08, rechecked against main 2026-10-13",
+      "added": "2026-10-13"
+    },
+    {
+      "id": "#AW8SRK",
+      "priority": "P2",
+      "type": "task",
+      "summary": "Teaching dual sign-off keeps assessments in server memory; decide durable storage or keep as a gated prototype",
+      "detail": "The trainee-supervisor sign-off repository (src/lib/teaching/assessments/dual-sign-off.ts) is an in-memory Map used only by src/app/api/teaching/assessments/dual-sign-off/route.ts, which already returns 503 when NODE_ENV is production, so nothing is lost today and no screen calls it. Owner decision needed: build a Supabase table with RLS and owner scoping before enabling it, or keep it a gated prototype. Do not remove the production refusal until a durable store exists. Next action: owner chooses; if building, plan the migration inside an approved window (merging a supabase/ change deploys to the live database).",
+      "source": "Review of five Antigravity reports against main, 2026-10-12",
+      "added": "2026-10-12"
+    },
+    {
+      "id": "#3ZHFH9",
+      "priority": "P2",
+      "type": "issue",
+      "summary": "Test-deletion guard blind spots: each-tables count as one case, Python tests are invisible, mass skip is undetected",
+      "detail": "scripts/check-diff-integrity.mjs counts each it.each(table) once (100 tables with 8+ rows, largest 48), TEST_FILE_PATTERN matches only TS/JS .spec/.test files (worker/python/test_*.py and tests/roster-publication-concurrency.mjs are outside it), and skip/only are counted as declared cases. Next action: owner decision on counting each-rows, adding .py, and flagging mass .skip; do not add skip to NON_CASE_MEMBERS (that would be wrong).",
+      "source": "PsychSift audit review (16 audit reports) checked against main 4382217, 2026-10-13",
+      "added": "2026-10-13"
+    },
+    {
+      "id": "#54XJ7D",
+      "priority": "P2",
+      "type": "task",
+      "summary": "Shift-swap approval checks the team rules only in the browser, not on the server (audit L4E-F2)",
+      "detail": "Needs a database migration and an owner decision between blocking the swap and asking the manager to acknowledge. A migration merged to main reaches the live database within seconds, so schedule the merge inside an approved window.",
+      "source": "Audit 2026-10-08, rechecked against main 2026-10-13",
+      "added": "2026-10-13"
     }
   ],
   "pending": []
diff --git a/docs/outstanding-issues-inbox/1ff7b52e-5911-435e-b807-7a9ff5602747.json b/docs/outstanding-issues-inbox/1ff7b52e-5911-435e-b807-7a9ff5602747.json
new file mode 100644
index 0000000000..e2e1ac52a4
--- /dev/null
+++ b/docs/outstanding-issues-inbox/1ff7b52e-5911-435e-b807-7a9ff5602747.json
@@ -0,0 +1,14 @@
+{
+  "version": 2,
+  "id": "1ff7b52e-5911-435e-b807-7a9ff5602747",
+  "createdOn": "2026-10-16",
+  "action": "add",
+  "payload": {
+    "pri": "P2",
+    "type": "task",
+    "summary": "Reindex reaper: enqueue storage cleanup at generation commit time (follow-up to #RP00FZ)",
+    "detail": "The reaper script builds storage cleanup jobs only on its gated apply path, so ordinary generation commits still schedule no cleanup for superseded storage objects. Needs a reviewed forward migration (never an edit to an existing one) before closing. Migration merges deploy to production and need the owner's explicit permission.",
+    "source": "PR #3570 review; scripts/cleanup-abandoned-reindex-generations.ts; supabase/migrations/20260702000000_commit_generation_preserve_legacy_artifacts.sql",
+    "issueUlid": "01M51JV9J6EG02B7D44998GPSQ"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/8c549632-5423-4986-9ef0-4734ad5f8a90.json b/docs/outstanding-issues-inbox/8c549632-5423-4986-9ef0-4734ad5f8a90.json
new file mode 100644
index 0000000000..5fb5cdf002
--- /dev/null
+++ b/docs/outstanding-issues-inbox/8c549632-5423-4986-9ef0-4734ad5f8a90.json
@@ -0,0 +1,14 @@
+{
+  "version": 2,
+  "id": "8c549632-5423-4986-9ef0-4734ad5f8a90",
+  "createdOn": "2026-10-16",
+  "action": "add",
+  "payload": {
+    "pri": "P3",
+    "type": "task",
+    "summary": "CME: render the claim-pack button on a reachable CME surface (follow-up to #G20QE6)",
+    "detail": "CmeClaimPackButton and its unit tests exist in src/components/cme/cme-claim-pack.tsx, but nothing imports or renders it, so clinicians cannot reach the study-budget export. Wire it into a reachable CME page with a user-facing test before closing.",
+    "source": "PR #3570 review; src/components/cme/cme-claim-pack.tsx; tests/cme-claim-pack.test.ts",
+    "issueUlid": "01M51JV9NVGR72PFX8VRN10Q7G"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/aebceba4-b600-4d60-94d1-901c7112bc21.json b/docs/outstanding-issues-inbox/aebceba4-b600-4d60-94d1-901c7112bc21.json
new file mode 100644
index 0000000000..310cc06094
--- /dev/null
+++ b/docs/outstanding-issues-inbox/aebceba4-b600-4d60-94d1-901c7112bc21.json
@@ -0,0 +1,14 @@
+{
+  "version": 2,
+  "id": "aebceba4-b600-4d60-94d1-901c7112bc21",
+  "createdOn": "2026-10-16",
+  "action": "add",
+  "payload": {
+    "pri": "P2",
+    "type": "task",
+    "summary": "Hostile-document ingestion: run the upload-to-answer end-to-end matrix (follow-up to #F3SGCM)",
+    "detail": "Seven-class helper coverage exists in tests/hostile-document-ingestion-matrix.test.ts, but it uses an extraction mock and fabricated search results, so no uploaded hostile document is checked against real ingestion, retrieval and answer paths. Close only when each class runs end to end.",
+    "source": "PR #3570 review; tests/hostile-document-ingestion-matrix.test.ts",
+    "issueUlid": "01M51JV9GC7D8WZ29KQKRSF5HP"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/06e64de3-a7e1-4437-95c6-1c2762f6ff8c.json b/docs/outstanding-issues-inbox/applied/06e64de3-a7e1-4437-95c6-1c2762f6ff8c.json
similarity index 100%
rename from docs/outstanding-issues-inbox/06e64de3-a7e1-4437-95c6-1c2762f6ff8c.json
rename to docs/outstanding-issues-inbox/applied/06e64de3-a7e1-4437-95c6-1c2762f6ff8c.json
diff --git a/docs/outstanding-issues-inbox/09e67603-7e47-418c-a95d-3752fb36b528.json b/docs/outstanding-issues-inbox/applied/09e67603-7e47-418c-a95d-3752fb36b528.json
similarity index 100%
rename from docs/outstanding-issues-inbox/09e67603-7e47-418c-a95d-3752fb36b528.json
rename to docs/outstanding-issues-inbox/applied/09e67603-7e47-418c-a95d-3752fb36b528.json
diff --git a/docs/outstanding-issues-inbox/0a3b873b-ce2c-486b-ab9c-b364129022e9.json b/docs/outstanding-issues-inbox/applied/0a3b873b-ce2c-486b-ab9c-b364129022e9.json
similarity index 100%
rename from docs/outstanding-issues-inbox/0a3b873b-ce2c-486b-ab9c-b364129022e9.json
rename to docs/outstanding-issues-inbox/applied/0a3b873b-ce2c-486b-ab9c-b364129022e9.json
diff --git a/docs/outstanding-issues-inbox/0a4af83d-e7e2-4b78-a8c2-3fabf2a9a697.json b/docs/outstanding-issues-inbox/applied/0a4af83d-e7e2-4b78-a8c2-3fabf2a9a697.json
similarity index 100%
rename from docs/outstanding-issues-inbox/0a4af83d-e7e2-4b78-a8c2-3fabf2a9a697.json
rename to docs/outstanding-issues-inbox/applied/0a4af83d-e7e2-4b78-a8c2-3fabf2a9a697.json
diff --git a/docs/outstanding-issues-inbox/0a6f0234-b442-4405-9cb6-265aba7373d4.json b/docs/outstanding-issues-inbox/applied/0a6f0234-b442-4405-9cb6-265aba7373d4.json
similarity index 100%
rename from docs/outstanding-issues-inbox/0a6f0234-b442-4405-9cb6-265aba7373d4.json
rename to docs/outstanding-issues-inbox/applied/0a6f0234-b442-4405-9cb6-265aba7373d4.json
diff --git a/docs/outstanding-issues-inbox/0ae58da9-54c9-4dd6-87a8-7b511af4be79.json b/docs/outstanding-issues-inbox/applied/0ae58da9-54c9-4dd6-87a8-7b511af4be79.json
similarity index 100%
rename from docs/outstanding-issues-inbox/0ae58da9-54c9-4dd6-87a8-7b511af4be79.json
rename to docs/outstanding-issues-inbox/applied/0ae58da9-54c9-4dd6-87a8-7b511af4be79.json
diff --git a/docs/outstanding-issues-inbox/0bade374-d0ee-46ac-8e86-054e068140ca.json b/docs/outstanding-issues-inbox/applied/0bade374-d0ee-46ac-8e86-054e068140ca.json
similarity index 100%
rename from docs/outstanding-issues-inbox/0bade374-d0ee-46ac-8e86-054e068140ca.json
rename to docs/outstanding-issues-inbox/applied/0bade374-d0ee-46ac-8e86-054e068140ca.json
diff --git a/docs/outstanding-issues-inbox/0d5cdc6b-7d56-4e37-988b-ead1816d1d21.json b/docs/outstanding-issues-inbox/applied/0d5cdc6b-7d56-4e37-988b-ead1816d1d21.json
similarity index 100%
rename from docs/outstanding-issues-inbox/0d5cdc6b-7d56-4e37-988b-ead1816d1d21.json
rename to docs/outstanding-issues-inbox/applied/0d5cdc6b-7d56-4e37-988b-ead1816d1d21.json
diff --git a/docs/outstanding-issues-inbox/0f007792-605d-4f25-af8d-89f7c2ed95be.json b/docs/outstanding-issues-inbox/applied/0f007792-605d-4f25-af8d-89f7c2ed95be.json
similarity index 100%
rename from docs/outstanding-issues-inbox/0f007792-605d-4f25-af8d-89f7c2ed95be.json
rename to docs/outstanding-issues-inbox/applied/0f007792-605d-4f25-af8d-89f7c2ed95be.json
diff --git a/docs/outstanding-issues-inbox/0f8120b0-bac6-4034-a226-1a608c0d2242.json b/docs/outstanding-issues-inbox/applied/0f8120b0-bac6-4034-a226-1a608c0d2242.json
similarity index 100%
rename from docs/outstanding-issues-inbox/0f8120b0-bac6-4034-a226-1a608c0d2242.json
rename to docs/outstanding-issues-inbox/applied/0f8120b0-bac6-4034-a226-1a608c0d2242.json
diff --git a/docs/outstanding-issues-inbox/11a126a4-f65c-472e-8e26-2c8bf595e650.json b/docs/outstanding-issues-inbox/applied/11a126a4-f65c-472e-8e26-2c8bf595e650.json
similarity index 100%
rename from docs/outstanding-issues-inbox/11a126a4-f65c-472e-8e26-2c8bf595e650.json
rename to docs/outstanding-issues-inbox/applied/11a126a4-f65c-472e-8e26-2c8bf595e650.json
diff --git a/docs/outstanding-issues-inbox/144345ea-d294-494d-a768-5b911c028306.json b/docs/outstanding-issues-inbox/applied/144345ea-d294-494d-a768-5b911c028306.json
similarity index 100%
rename from docs/outstanding-issues-inbox/144345ea-d294-494d-a768-5b911c028306.json
rename to docs/outstanding-issues-inbox/applied/144345ea-d294-494d-a768-5b911c028306.json
diff --git a/docs/outstanding-issues-inbox/145b648c-1cc9-4283-a136-2d0e02ac53cf.json b/docs/outstanding-issues-inbox/applied/145b648c-1cc9-4283-a136-2d0e02ac53cf.json
similarity index 100%
rename from docs/outstanding-issues-inbox/145b648c-1cc9-4283-a136-2d0e02ac53cf.json
rename to docs/outstanding-issues-inbox/applied/145b648c-1cc9-4283-a136-2d0e02ac53cf.json
diff --git a/docs/outstanding-issues-inbox/1518dfd4-2ecb-4dc8-839f-0094f38e6861.json b/docs/outstanding-issues-inbox/applied/1518dfd4-2ecb-4dc8-839f-0094f38e6861.json
similarity index 100%
rename from docs/outstanding-issues-inbox/1518dfd4-2ecb-4dc8-839f-0094f38e6861.json
rename to docs/outstanding-issues-inbox/applied/1518dfd4-2ecb-4dc8-839f-0094f38e6861.json
diff --git a/docs/outstanding-issues-inbox/15c1027e-6835-49eb-bd98-54f697b3388c.json b/docs/outstanding-issues-inbox/applied/15c1027e-6835-49eb-bd98-54f697b3388c.json
similarity index 100%
rename from docs/outstanding-issues-inbox/15c1027e-6835-49eb-bd98-54f697b3388c.json
rename to docs/outstanding-issues-inbox/applied/15c1027e-6835-49eb-bd98-54f697b3388c.json
diff --git a/docs/outstanding-issues-inbox/1697dcce-65f2-446f-8064-522ad00cb680.json b/docs/outstanding-issues-inbox/applied/1697dcce-65f2-446f-8064-522ad00cb680.json
similarity index 100%
rename from docs/outstanding-issues-inbox/1697dcce-65f2-446f-8064-522ad00cb680.json
rename to docs/outstanding-issues-inbox/applied/1697dcce-65f2-446f-8064-522ad00cb680.json
diff --git a/docs/outstanding-issues-inbox/16eb5ffe-3826-4c2e-9c42-f5b8a50d0e46.json b/docs/outstanding-issues-inbox/applied/16eb5ffe-3826-4c2e-9c42-f5b8a50d0e46.json
similarity index 100%
rename from docs/outstanding-issues-inbox/16eb5ffe-3826-4c2e-9c42-f5b8a50d0e46.json
rename to docs/outstanding-issues-inbox/applied/16eb5ffe-3826-4c2e-9c42-f5b8a50d0e46.json
diff --git a/docs/outstanding-issues-inbox/172d3dd1-492d-4b24-a613-2915aec79ac8.json b/docs/outstanding-issues-inbox/applied/172d3dd1-492d-4b24-a613-2915aec79ac8.json
similarity index 100%
rename from docs/outstanding-issues-inbox/172d3dd1-492d-4b24-a613-2915aec79ac8.json
rename to docs/outstanding-issues-inbox/applied/172d3dd1-492d-4b24-a613-2915aec79ac8.json
diff --git a/docs/outstanding-issues-inbox/17cbc828-ac93-4b63-b419-a55fa2e11384.json b/docs/outstanding-issues-inbox/applied/17cbc828-ac93-4b63-b419-a55fa2e11384.json
similarity index 100%
rename from docs/outstanding-issues-inbox/17cbc828-ac93-4b63-b419-a55fa2e11384.json
rename to docs/outstanding-issues-inbox/applied/17cbc828-ac93-4b63-b419-a55fa2e11384.json
diff --git a/docs/outstanding-issues-inbox/19dc1828-67ee-4a7f-ac44-ec01a32375dd.json b/docs/outstanding-issues-inbox/applied/19dc1828-67ee-4a7f-ac44-ec01a32375dd.json
similarity index 100%
rename from docs/outstanding-issues-inbox/19dc1828-67ee-4a7f-ac44-ec01a32375dd.json
rename to docs/outstanding-issues-inbox/applied/19dc1828-67ee-4a7f-ac44-ec01a32375dd.json
diff --git a/docs/outstanding-issues-inbox/1aadcb29-1f37-496c-b524-0ff285e22260.json b/docs/outstanding-issues-inbox/applied/1aadcb29-1f37-496c-b524-0ff285e22260.json
similarity index 100%
rename from docs/outstanding-issues-inbox/1aadcb29-1f37-496c-b524-0ff285e22260.json
rename to docs/outstanding-issues-inbox/applied/1aadcb29-1f37-496c-b524-0ff285e22260.json
diff --git a/docs/outstanding-issues-inbox/1d44fe56-63ba-4c89-96fe-d9e8bad76b80.json b/docs/outstanding-issues-inbox/applied/1d44fe56-63ba-4c89-96fe-d9e8bad76b80.json
similarity index 100%
rename from docs/outstanding-issues-inbox/1d44fe56-63ba-4c89-96fe-d9e8bad76b80.json
rename to docs/outstanding-issues-inbox/applied/1d44fe56-63ba-4c89-96fe-d9e8bad76b80.json
diff --git a/docs/outstanding-issues-inbox/1d4997c0-49bb-41d7-b87a-c4931619df74.json b/docs/outstanding-issues-inbox/applied/1d4997c0-49bb-41d7-b87a-c4931619df74.json
similarity index 100%
rename from docs/outstanding-issues-inbox/1d4997c0-49bb-41d7-b87a-c4931619df74.json
rename to docs/outstanding-issues-inbox/applied/1d4997c0-49bb-41d7-b87a-c4931619df74.json
diff --git a/docs/outstanding-issues-inbox/2226c4c7-40c1-4de1-99f6-0935db529194.json b/docs/outstanding-issues-inbox/applied/2226c4c7-40c1-4de1-99f6-0935db529194.json
similarity index 100%
rename from docs/outstanding-issues-inbox/2226c4c7-40c1-4de1-99f6-0935db529194.json
rename to docs/outstanding-issues-inbox/applied/2226c4c7-40c1-4de1-99f6-0935db529194.json
diff --git a/docs/outstanding-issues-inbox/23129e93-9af9-43c3-a488-4b4f97653764.json b/docs/outstanding-issues-inbox/applied/23129e93-9af9-43c3-a488-4b4f97653764.json
similarity index 100%
rename from docs/outstanding-issues-inbox/23129e93-9af9-43c3-a488-4b4f97653764.json
rename to docs/outstanding-issues-inbox/applied/23129e93-9af9-43c3-a488-4b4f97653764.json
diff --git a/docs/outstanding-issues-inbox/29314f51-76ca-451c-a478-ee5d47ef109b.json b/docs/outstanding-issues-inbox/applied/29314f51-76ca-451c-a478-ee5d47ef109b.json
similarity index 100%
rename from docs/outstanding-issues-inbox/29314f51-76ca-451c-a478-ee5d47ef109b.json
rename to docs/outstanding-issues-inbox/applied/29314f51-76ca-451c-a478-ee5d47ef109b.json
diff --git a/docs/outstanding-issues-inbox/29409bc2-8d63-483d-9a49-445e9a8d30c6.json b/docs/outstanding-issues-inbox/applied/29409bc2-8d63-483d-9a49-445e9a8d30c6.json
similarity index 100%
rename from docs/outstanding-issues-inbox/29409bc2-8d63-483d-9a49-445e9a8d30c6.json
rename to docs/outstanding-issues-inbox/applied/29409bc2-8d63-483d-9a49-445e9a8d30c6.json
diff --git a/docs/outstanding-issues-inbox/2a26ed02-5811-4d16-984a-309a5bf0ec2f.json b/docs/outstanding-issues-inbox/applied/2a26ed02-5811-4d16-984a-309a5bf0ec2f.json
similarity index 100%
rename from docs/outstanding-issues-inbox/2a26ed02-5811-4d16-984a-309a5bf0ec2f.json
rename to docs/outstanding-issues-inbox/applied/2a26ed02-5811-4d16-984a-309a5bf0ec2f.json
diff --git a/docs/outstanding-issues-inbox/2b3d5fda-8ce9-4996-8634-8b1b50d34476.json b/docs/outstanding-issues-inbox/applied/2b3d5fda-8ce9-4996-8634-8b1b50d34476.json
similarity index 100%
rename from docs/outstanding-issues-inbox/2b3d5fda-8ce9-4996-8634-8b1b50d34476.json
rename to docs/outstanding-issues-inbox/applied/2b3d5fda-8ce9-4996-8634-8b1b50d34476.json
diff --git a/docs/outstanding-issues-inbox/2b7a5ade-0197-41e7-baaa-6b089cedf636.json b/docs/outstanding-issues-inbox/applied/2b7a5ade-0197-41e7-baaa-6b089cedf636.json
similarity index 100%
rename from docs/outstanding-issues-inbox/2b7a5ade-0197-41e7-baaa-6b089cedf636.json
rename to docs/outstanding-issues-inbox/applied/2b7a5ade-0197-41e7-baaa-6b089cedf636.json
diff --git a/docs/outstanding-issues-inbox/3344a3a9-1a81-4a6a-85b3-3141ddc90c1c.json b/docs/outstanding-issues-inbox/applied/3344a3a9-1a81-4a6a-85b3-3141ddc90c1c.json
similarity index 100%
rename from docs/outstanding-issues-inbox/3344a3a9-1a81-4a6a-85b3-3141ddc90c1c.json
rename to docs/outstanding-issues-inbox/applied/3344a3a9-1a81-4a6a-85b3-3141ddc90c1c.json
diff --git a/docs/outstanding-issues-inbox/334f4e12-2bb6-4545-8318-ce9e86f0b933.json b/docs/outstanding-issues-inbox/applied/334f4e12-2bb6-4545-8318-ce9e86f0b933.json
similarity index 100%
rename from docs/outstanding-issues-inbox/334f4e12-2bb6-4545-8318-ce9e86f0b933.json
rename to docs/outstanding-issues-inbox/applied/334f4e12-2bb6-4545-8318-ce9e86f0b933.json
diff --git a/docs/outstanding-issues-inbox/3a11cc43-e4d7-46ca-b2e0-05ee44909214.json b/docs/outstanding-issues-inbox/applied/3a11cc43-e4d7-46ca-b2e0-05ee44909214.json
similarity index 100%
rename from docs/outstanding-issues-inbox/3a11cc43-e4d7-46ca-b2e0-05ee44909214.json
rename to docs/outstanding-issues-inbox/applied/3a11cc43-e4d7-46ca-b2e0-05ee44909214.json
diff --git a/docs/outstanding-issues-inbox/3a539da4-00d0-4c4f-a0fc-dce06f4c1097.json b/docs/outstanding-issues-inbox/applied/3a539da4-00d0-4c4f-a0fc-dce06f4c1097.json
similarity index 100%
rename from docs/outstanding-issues-inbox/3a539da4-00d0-4c4f-a0fc-dce06f4c1097.json
rename to docs/outstanding-issues-inbox/applied/3a539da4-00d0-4c4f-a0fc-dce06f4c1097.json
diff --git a/docs/outstanding-issues-inbox/3e6cf213-53e4-458d-bc74-752a88ecc4fc.json b/docs/outstanding-issues-inbox/applied/3e6cf213-53e4-458d-bc74-752a88ecc4fc.json
similarity index 100%
rename from docs/outstanding-issues-inbox/3e6cf213-53e4-458d-bc74-752a88ecc4fc.json
rename to docs/outstanding-issues-inbox/applied/3e6cf213-53e4-458d-bc74-752a88ecc4fc.json
diff --git a/docs/outstanding-issues-inbox/42136d01-3f83-42c9-958b-8cc122012076.json b/docs/outstanding-issues-inbox/applied/42136d01-3f83-42c9-958b-8cc122012076.json
similarity index 100%
rename from docs/outstanding-issues-inbox/42136d01-3f83-42c9-958b-8cc122012076.json
rename to docs/outstanding-issues-inbox/applied/42136d01-3f83-42c9-958b-8cc122012076.json
diff --git a/docs/outstanding-issues-inbox/42e3103f-3c08-4ac4-bb1e-43f186afbad1.json b/docs/outstanding-issues-inbox/applied/42e3103f-3c08-4ac4-bb1e-43f186afbad1.json
similarity index 100%
rename from docs/outstanding-issues-inbox/42e3103f-3c08-4ac4-bb1e-43f186afbad1.json
rename to docs/outstanding-issues-inbox/applied/42e3103f-3c08-4ac4-bb1e-43f186afbad1.json
diff --git a/docs/outstanding-issues-inbox/449032d1-e49b-4fe0-ad68-f17ecae8d8be.json b/docs/outstanding-issues-inbox/applied/449032d1-e49b-4fe0-ad68-f17ecae8d8be.json
similarity index 100%
rename from docs/outstanding-issues-inbox/449032d1-e49b-4fe0-ad68-f17ecae8d8be.json
rename to docs/outstanding-issues-inbox/applied/449032d1-e49b-4fe0-ad68-f17ecae8d8be.json
diff --git a/docs/outstanding-issues-inbox/44c998b4-a3ba-4c1d-83ee-e9e7bd804ef0.json b/docs/outstanding-issues-inbox/applied/44c998b4-a3ba-4c1d-83ee-e9e7bd804ef0.json
similarity index 100%
rename from docs/outstanding-issues-inbox/44c998b4-a3ba-4c1d-83ee-e9e7bd804ef0.json
rename to docs/outstanding-issues-inbox/applied/44c998b4-a3ba-4c1d-83ee-e9e7bd804ef0.json
diff --git a/docs/outstanding-issues-inbox/47f5ca33-60ed-4a54-a441-d6cb58f47165.json b/docs/outstanding-issues-inbox/applied/47f5ca33-60ed-4a54-a441-d6cb58f47165.json
similarity index 100%
rename from docs/outstanding-issues-inbox/47f5ca33-60ed-4a54-a441-d6cb58f47165.json
rename to docs/outstanding-issues-inbox/applied/47f5ca33-60ed-4a54-a441-d6cb58f47165.json
diff --git a/docs/outstanding-issues-inbox/4b7b339b-07c5-4c74-b4c9-1e78ebfd0dfb.json b/docs/outstanding-issues-inbox/applied/4b7b339b-07c5-4c74-b4c9-1e78ebfd0dfb.json
similarity index 100%
rename from docs/outstanding-issues-inbox/4b7b339b-07c5-4c74-b4c9-1e78ebfd0dfb.json
rename to docs/outstanding-issues-inbox/applied/4b7b339b-07c5-4c74-b4c9-1e78ebfd0dfb.json
diff --git a/docs/outstanding-issues-inbox/4bec676d-2b81-426d-85bb-801ea07ecb68.json b/docs/outstanding-issues-inbox/applied/4bec676d-2b81-426d-85bb-801ea07ecb68.json
similarity index 100%
rename from docs/outstanding-issues-inbox/4bec676d-2b81-426d-85bb-801ea07ecb68.json
rename to docs/outstanding-issues-inbox/applied/4bec676d-2b81-426d-85bb-801ea07ecb68.json
diff --git a/docs/outstanding-issues-inbox/4d2480b9-8b62-488b-9e65-ede8dc16fd22.json b/docs/outstanding-issues-inbox/applied/4d2480b9-8b62-488b-9e65-ede8dc16fd22.json
similarity index 100%
rename from docs/outstanding-issues-inbox/4d2480b9-8b62-488b-9e65-ede8dc16fd22.json
rename to docs/outstanding-issues-inbox/applied/4d2480b9-8b62-488b-9e65-ede8dc16fd22.json
diff --git a/docs/outstanding-issues-inbox/4d80c5e6-a51a-4c82-8090-8df06c834475.json b/docs/outstanding-issues-inbox/applied/4d80c5e6-a51a-4c82-8090-8df06c834475.json
similarity index 100%
rename from docs/outstanding-issues-inbox/4d80c5e6-a51a-4c82-8090-8df06c834475.json
rename to docs/outstanding-issues-inbox/applied/4d80c5e6-a51a-4c82-8090-8df06c834475.json
diff --git a/docs/outstanding-issues-inbox/4d9b987a-7d8a-4ed6-a149-d2bbf831c3db.json b/docs/outstanding-issues-inbox/applied/4d9b987a-7d8a-4ed6-a149-d2bbf831c3db.json
similarity index 100%
rename from docs/outstanding-issues-inbox/4d9b987a-7d8a-4ed6-a149-d2bbf831c3db.json
rename to docs/outstanding-issues-inbox/applied/4d9b987a-7d8a-4ed6-a149-d2bbf831c3db.json
diff --git a/docs/outstanding-issues-inbox/51afe5eb-de7d-411c-af70-7d57185b1e64.json b/docs/outstanding-issues-inbox/applied/51afe5eb-de7d-411c-af70-7d57185b1e64.json
similarity index 100%
rename from docs/outstanding-issues-inbox/51afe5eb-de7d-411c-af70-7d57185b1e64.json
rename to docs/outstanding-issues-inbox/applied/51afe5eb-de7d-411c-af70-7d57185b1e64.json
diff --git a/docs/outstanding-issues-inbox/5357c11a-9e2e-4f23-9474-87e40db67b3d.json b/docs/outstanding-issues-inbox/applied/5357c11a-9e2e-4f23-9474-87e40db67b3d.json
similarity index 100%
rename from docs/outstanding-issues-inbox/5357c11a-9e2e-4f23-9474-87e40db67b3d.json
rename to docs/outstanding-issues-inbox/applied/5357c11a-9e2e-4f23-9474-87e40db67b3d.json
diff --git a/docs/outstanding-issues-inbox/55d4b9bc-eff7-4f4c-9cb8-6aee2315847d.json b/docs/outstanding-issues-inbox/applied/55d4b9bc-eff7-4f4c-9cb8-6aee2315847d.json
similarity index 100%
rename from docs/outstanding-issues-inbox/55d4b9bc-eff7-4f4c-9cb8-6aee2315847d.json
rename to docs/outstanding-issues-inbox/applied/55d4b9bc-eff7-4f4c-9cb8-6aee2315847d.json
diff --git a/docs/outstanding-issues-inbox/563d11b8-515b-402e-a3ae-ef8ba5991105.json b/docs/outstanding-issues-inbox/applied/563d11b8-515b-402e-a3ae-ef8ba5991105.json
similarity index 100%
rename from docs/outstanding-issues-inbox/563d11b8-515b-402e-a3ae-ef8ba5991105.json
rename to docs/outstanding-issues-inbox/applied/563d11b8-515b-402e-a3ae-ef8ba5991105.json
diff --git a/docs/outstanding-issues-inbox/56912b2e-3649-4133-aec8-5194240837a1.json b/docs/outstanding-issues-inbox/applied/56912b2e-3649-4133-aec8-5194240837a1.json
similarity index 100%
rename from docs/outstanding-issues-inbox/56912b2e-3649-4133-aec8-5194240837a1.json
rename to docs/outstanding-issues-inbox/applied/56912b2e-3649-4133-aec8-5194240837a1.json
diff --git a/docs/outstanding-issues-inbox/57a836e8-9433-41ba-a984-d4a8a78b9042.json b/docs/outstanding-issues-inbox/applied/57a836e8-9433-41ba-a984-d4a8a78b9042.json
similarity index 100%
rename from docs/outstanding-issues-inbox/57a836e8-9433-41ba-a984-d4a8a78b9042.json
rename to docs/outstanding-issues-inbox/applied/57a836e8-9433-41ba-a984-d4a8a78b9042.json
diff --git a/docs/outstanding-issues-inbox/583946a8-bde3-44cd-b804-efa1a4cd48f3.json b/docs/outstanding-issues-inbox/applied/583946a8-bde3-44cd-b804-efa1a4cd48f3.json
similarity index 100%
rename from docs/outstanding-issues-inbox/583946a8-bde3-44cd-b804-efa1a4cd48f3.json
rename to docs/outstanding-issues-inbox/applied/583946a8-bde3-44cd-b804-efa1a4cd48f3.json
diff --git a/docs/outstanding-issues-inbox/58973f74-68a2-4041-8ddb-feccc4c3cbb4.json b/docs/outstanding-issues-inbox/applied/58973f74-68a2-4041-8ddb-feccc4c3cbb4.json
similarity index 100%
rename from docs/outstanding-issues-inbox/58973f74-68a2-4041-8ddb-feccc4c3cbb4.json
rename to docs/outstanding-issues-inbox/applied/58973f74-68a2-4041-8ddb-feccc4c3cbb4.json
diff --git a/docs/outstanding-issues-inbox/59ff335c-079c-479d-b468-4310921b4079.json b/docs/outstanding-issues-inbox/applied/59ff335c-079c-479d-b468-4310921b4079.json
similarity index 100%
rename from docs/outstanding-issues-inbox/59ff335c-079c-479d-b468-4310921b4079.json
rename to docs/outstanding-issues-inbox/applied/59ff335c-079c-479d-b468-4310921b4079.json
diff --git a/docs/outstanding-issues-inbox/5c675282-61b1-4926-a8aa-7f76e35abcd7.json b/docs/outstanding-issues-inbox/applied/5c675282-61b1-4926-a8aa-7f76e35abcd7.json
similarity index 100%
rename from docs/outstanding-issues-inbox/5c675282-61b1-4926-a8aa-7f76e35abcd7.json
rename to docs/outstanding-issues-inbox/applied/5c675282-61b1-4926-a8aa-7f76e35abcd7.json
diff --git a/docs/outstanding-issues-inbox/5c842094-3b7f-4374-88bd-030d455fa0a8.json b/docs/outstanding-issues-inbox/applied/5c842094-3b7f-4374-88bd-030d455fa0a8.json
similarity index 100%
rename from docs/outstanding-issues-inbox/5c842094-3b7f-4374-88bd-030d455fa0a8.json
rename to docs/outstanding-issues-inbox/applied/5c842094-3b7f-4374-88bd-030d455fa0a8.json
diff --git a/docs/outstanding-issues-inbox/602eba98-0475-4137-a794-70922d57e5d3.json b/docs/outstanding-issues-inbox/applied/602eba98-0475-4137-a794-70922d57e5d3.json
similarity index 100%
rename from docs/outstanding-issues-inbox/602eba98-0475-4137-a794-70922d57e5d3.json
rename to docs/outstanding-issues-inbox/applied/602eba98-0475-4137-a794-70922d57e5d3.json
diff --git a/docs/outstanding-issues-inbox/60a1db7e-bdc5-448f-b682-0f2756798aaf.json b/docs/outstanding-issues-inbox/applied/60a1db7e-bdc5-448f-b682-0f2756798aaf.json
similarity index 100%
rename from docs/outstanding-issues-inbox/60a1db7e-bdc5-448f-b682-0f2756798aaf.json
rename to docs/outstanding-issues-inbox/applied/60a1db7e-bdc5-448f-b682-0f2756798aaf.json
diff --git a/docs/outstanding-issues-inbox/632a2b64-acf5-435d-b5f5-9338e527ea9f.json b/docs/outstanding-issues-inbox/applied/632a2b64-acf5-435d-b5f5-9338e527ea9f.json
similarity index 100%
rename from docs/outstanding-issues-inbox/632a2b64-acf5-435d-b5f5-9338e527ea9f.json
rename to docs/outstanding-issues-inbox/applied/632a2b64-acf5-435d-b5f5-9338e527ea9f.json
diff --git a/docs/outstanding-issues-inbox/63a6c7d2-68fb-4446-b459-9265e8256e43.json b/docs/outstanding-issues-inbox/applied/63a6c7d2-68fb-4446-b459-9265e8256e43.json
similarity index 100%
rename from docs/outstanding-issues-inbox/63a6c7d2-68fb-4446-b459-9265e8256e43.json
rename to docs/outstanding-issues-inbox/applied/63a6c7d2-68fb-4446-b459-9265e8256e43.json
diff --git a/docs/outstanding-issues-inbox/68f5e857-56f0-45c9-a61f-44c23664bb0b.json b/docs/outstanding-issues-inbox/applied/68f5e857-56f0-45c9-a61f-44c23664bb0b.json
similarity index 100%
rename from docs/outstanding-issues-inbox/68f5e857-56f0-45c9-a61f-44c23664bb0b.json
rename to docs/outstanding-issues-inbox/applied/68f5e857-56f0-45c9-a61f-44c23664bb0b.json
diff --git a/docs/outstanding-issues-inbox/693e8f34-1b14-4e61-a87c-430fff130dad.json b/docs/outstanding-issues-inbox/applied/693e8f34-1b14-4e61-a87c-430fff130dad.json
similarity index 100%
rename from docs/outstanding-issues-inbox/693e8f34-1b14-4e61-a87c-430fff130dad.json
rename to docs/outstanding-issues-inbox/applied/693e8f34-1b14-4e61-a87c-430fff130dad.json
diff --git a/docs/outstanding-issues-inbox/694a613e-eb2d-4ecc-b9ed-8eb2605630f9.json b/docs/outstanding-issues-inbox/applied/694a613e-eb2d-4ecc-b9ed-8eb2605630f9.json
similarity index 100%
rename from docs/outstanding-issues-inbox/694a613e-eb2d-4ecc-b9ed-8eb2605630f9.json
rename to docs/outstanding-issues-inbox/applied/694a613e-eb2d-4ecc-b9ed-8eb2605630f9.json
diff --git a/docs/outstanding-issues-inbox/69d8bc2f-f326-40ee-ade1-13a8af532c3c.json b/docs/outstanding-issues-inbox/applied/69d8bc2f-f326-40ee-ade1-13a8af532c3c.json
similarity index 100%
rename from docs/outstanding-issues-inbox/69d8bc2f-f326-40ee-ade1-13a8af532c3c.json
rename to docs/outstanding-issues-inbox/applied/69d8bc2f-f326-40ee-ade1-13a8af532c3c.json
diff --git a/docs/outstanding-issues-inbox/6a9e2f91-a447-4aa9-ace1-9af7e1fe21da.json b/docs/outstanding-issues-inbox/applied/6a9e2f91-a447-4aa9-ace1-9af7e1fe21da.json
similarity index 100%
rename from docs/outstanding-issues-inbox/6a9e2f91-a447-4aa9-ace1-9af7e1fe21da.json
rename to docs/outstanding-issues-inbox/applied/6a9e2f91-a447-4aa9-ace1-9af7e1fe21da.json
diff --git a/docs/outstanding-issues-inbox/6ad78d7c-9c91-4859-ab34-b3459a6636f4.json b/docs/outstanding-issues-inbox/applied/6ad78d7c-9c91-4859-ab34-b3459a6636f4.json
similarity index 100%
rename from docs/outstanding-issues-inbox/6ad78d7c-9c91-4859-ab34-b3459a6636f4.json
rename to docs/outstanding-issues-inbox/applied/6ad78d7c-9c91-4859-ab34-b3459a6636f4.json
diff --git a/docs/outstanding-issues-inbox/6b9e2365-99e6-41c9-8c59-d21d6386cead.json b/docs/outstanding-issues-inbox/applied/6b9e2365-99e6-41c9-8c59-d21d6386cead.json
similarity index 100%
rename from docs/outstanding-issues-inbox/6b9e2365-99e6-41c9-8c59-d21d6386cead.json
rename to docs/outstanding-issues-inbox/applied/6b9e2365-99e6-41c9-8c59-d21d6386cead.json
diff --git a/docs/outstanding-issues-inbox/6c0bd4b5-1cb1-4257-98a6-7249cf546466.json b/docs/outstanding-issues-inbox/applied/6c0bd4b5-1cb1-4257-98a6-7249cf546466.json
similarity index 100%
rename from docs/outstanding-issues-inbox/6c0bd4b5-1cb1-4257-98a6-7249cf546466.json
rename to docs/outstanding-issues-inbox/applied/6c0bd4b5-1cb1-4257-98a6-7249cf546466.json
diff --git a/docs/outstanding-issues-inbox/6c2d2594-dffc-4b00-a76e-bb3cb83f0d54.json b/docs/outstanding-issues-inbox/applied/6c2d2594-dffc-4b00-a76e-bb3cb83f0d54.json
similarity index 100%
rename from docs/outstanding-issues-inbox/6c2d2594-dffc-4b00-a76e-bb3cb83f0d54.json
rename to docs/outstanding-issues-inbox/applied/6c2d2594-dffc-4b00-a76e-bb3cb83f0d54.json
diff --git a/docs/outstanding-issues-inbox/6f0eb676-57af-4a30-9338-3f4f0f6dfbfc.json b/docs/outstanding-issues-inbox/applied/6f0eb676-57af-4a30-9338-3f4f0f6dfbfc.json
similarity index 100%
rename from docs/outstanding-issues-inbox/6f0eb676-57af-4a30-9338-3f4f0f6dfbfc.json
rename to docs/outstanding-issues-inbox/applied/6f0eb676-57af-4a30-9338-3f4f0f6dfbfc.json
diff --git a/docs/outstanding-issues-inbox/70ce559e-b757-44e5-93a6-ca9772eaac69.json b/docs/outstanding-issues-inbox/applied/70ce559e-b757-44e5-93a6-ca9772eaac69.json
similarity index 100%
rename from docs/outstanding-issues-inbox/70ce559e-b757-44e5-93a6-ca9772eaac69.json
rename to docs/outstanding-issues-inbox/applied/70ce559e-b757-44e5-93a6-ca9772eaac69.json
diff --git a/docs/outstanding-issues-inbox/75239ed4-cbde-4756-9829-b57a6b1fc689.json b/docs/outstanding-issues-inbox/applied/75239ed4-cbde-4756-9829-b57a6b1fc689.json
similarity index 100%
rename from docs/outstanding-issues-inbox/75239ed4-cbde-4756-9829-b57a6b1fc689.json
rename to docs/outstanding-issues-inbox/applied/75239ed4-cbde-4756-9829-b57a6b1fc689.json
diff --git a/docs/outstanding-issues-inbox/75946d76-a837-48f5-a561-8789403327b7.json b/docs/outstanding-issues-inbox/applied/75946d76-a837-48f5-a561-8789403327b7.json
similarity index 100%
rename from docs/outstanding-issues-inbox/75946d76-a837-48f5-a561-8789403327b7.json
rename to docs/outstanding-issues-inbox/applied/75946d76-a837-48f5-a561-8789403327b7.json
diff --git a/docs/outstanding-issues-inbox/7656d247-d31f-4783-9173-659085186649.json b/docs/outstanding-issues-inbox/applied/7656d247-d31f-4783-9173-659085186649.json
similarity index 100%
rename from docs/outstanding-issues-inbox/7656d247-d31f-4783-9173-659085186649.json
rename to docs/outstanding-issues-inbox/applied/7656d247-d31f-4783-9173-659085186649.json
diff --git a/docs/outstanding-issues-inbox/79c65ca9-66b7-41a8-bf71-e0661c37243e.json b/docs/outstanding-issues-inbox/applied/79c65ca9-66b7-41a8-bf71-e0661c37243e.json
similarity index 100%
rename from docs/outstanding-issues-inbox/79c65ca9-66b7-41a8-bf71-e0661c37243e.json
rename to docs/outstanding-issues-inbox/applied/79c65ca9-66b7-41a8-bf71-e0661c37243e.json
diff --git a/docs/outstanding-issues-inbox/7ab066fc-de17-488e-aa74-6b4820410f9e.json b/docs/outstanding-issues-inbox/applied/7ab066fc-de17-488e-aa74-6b4820410f9e.json
similarity index 100%
rename from docs/outstanding-issues-inbox/7ab066fc-de17-488e-aa74-6b4820410f9e.json
rename to docs/outstanding-issues-inbox/applied/7ab066fc-de17-488e-aa74-6b4820410f9e.json
diff --git a/docs/outstanding-issues-inbox/7d1be472-31e7-4aeb-b77f-a73c83f3e14d.json b/docs/outstanding-issues-inbox/applied/7d1be472-31e7-4aeb-b77f-a73c83f3e14d.json
similarity index 100%
rename from docs/outstanding-issues-inbox/7d1be472-31e7-4aeb-b77f-a73c83f3e14d.json
rename to docs/outstanding-issues-inbox/applied/7d1be472-31e7-4aeb-b77f-a73c83f3e14d.json
diff --git a/docs/outstanding-issues-inbox/7f3c2e91-6d84-4b7a-9f12-c8e5a4d6b701.json b/docs/outstanding-issues-inbox/applied/7f3c2e91-6d84-4b7a-9f12-c8e5a4d6b701.json
similarity index 100%
rename from docs/outstanding-issues-inbox/7f3c2e91-6d84-4b7a-9f12-c8e5a4d6b701.json
rename to docs/outstanding-issues-inbox/applied/7f3c2e91-6d84-4b7a-9f12-c8e5a4d6b701.json
diff --git a/docs/outstanding-issues-inbox/80385c45-e183-4094-bb4d-b61a9099c84e.json b/docs/outstanding-issues-inbox/applied/80385c45-e183-4094-bb4d-b61a9099c84e.json
similarity index 100%
rename from docs/outstanding-issues-inbox/80385c45-e183-4094-bb4d-b61a9099c84e.json
rename to docs/outstanding-issues-inbox/applied/80385c45-e183-4094-bb4d-b61a9099c84e.json
diff --git a/docs/outstanding-issues-inbox/81a89738-27ce-4171-9d94-5bbe16ed7888.json b/docs/outstanding-issues-inbox/applied/81a89738-27ce-4171-9d94-5bbe16ed7888.json
similarity index 100%
rename from docs/outstanding-issues-inbox/81a89738-27ce-4171-9d94-5bbe16ed7888.json
rename to docs/outstanding-issues-inbox/applied/81a89738-27ce-4171-9d94-5bbe16ed7888.json
diff --git a/docs/outstanding-issues-inbox/84627d8a-43bb-4116-a0e5-1d7ce2120f2f.json b/docs/outstanding-issues-inbox/applied/84627d8a-43bb-4116-a0e5-1d7ce2120f2f.json
similarity index 100%
rename from docs/outstanding-issues-inbox/84627d8a-43bb-4116-a0e5-1d7ce2120f2f.json
rename to docs/outstanding-issues-inbox/applied/84627d8a-43bb-4116-a0e5-1d7ce2120f2f.json
diff --git a/docs/outstanding-issues-inbox/85923bd0-25b3-414e-8502-eb8ca9e2114e.json b/docs/outstanding-issues-inbox/applied/85923bd0-25b3-414e-8502-eb8ca9e2114e.json
similarity index 100%
rename from docs/outstanding-issues-inbox/85923bd0-25b3-414e-8502-eb8ca9e2114e.json
rename to docs/outstanding-issues-inbox/applied/85923bd0-25b3-414e-8502-eb8ca9e2114e.json
diff --git a/docs/outstanding-issues-inbox/878eb876-dc87-4701-b4a8-54aaab8ec5e1.json b/docs/outstanding-issues-inbox/applied/878eb876-dc87-4701-b4a8-54aaab8ec5e1.json
similarity index 100%
rename from docs/outstanding-issues-inbox/878eb876-dc87-4701-b4a8-54aaab8ec5e1.json
rename to docs/outstanding-issues-inbox/applied/878eb876-dc87-4701-b4a8-54aaab8ec5e1.json
diff --git a/docs/outstanding-issues-inbox/88d63f2e-ff6f-422e-b71b-84a41c000fb1.json b/docs/outstanding-issues-inbox/applied/88d63f2e-ff6f-422e-b71b-84a41c000fb1.json
similarity index 100%
rename from docs/outstanding-issues-inbox/88d63f2e-ff6f-422e-b71b-84a41c000fb1.json
rename to docs/outstanding-issues-inbox/applied/88d63f2e-ff6f-422e-b71b-84a41c000fb1.json
diff --git a/docs/outstanding-issues-inbox/8c864c78-9bf5-4679-a624-7bcec465ede7.json b/docs/outstanding-issues-inbox/applied/8c864c78-9bf5-4679-a624-7bcec465ede7.json
similarity index 100%
rename from docs/outstanding-issues-inbox/8c864c78-9bf5-4679-a624-7bcec465ede7.json
rename to docs/outstanding-issues-inbox/applied/8c864c78-9bf5-4679-a624-7bcec465ede7.json
diff --git a/docs/outstanding-issues-inbox/8d36f1f7-498f-4965-a5dd-f2e18ecd0c6e.json b/docs/outstanding-issues-inbox/applied/8d36f1f7-498f-4965-a5dd-f2e18ecd0c6e.json
similarity index 100%
rename from docs/outstanding-issues-inbox/8d36f1f7-498f-4965-a5dd-f2e18ecd0c6e.json
rename to docs/outstanding-issues-inbox/applied/8d36f1f7-498f-4965-a5dd-f2e18ecd0c6e.json
diff --git a/docs/outstanding-issues-inbox/8eed5dff-8f00-4b4d-9e42-22d3588d9164.json b/docs/outstanding-issues-inbox/applied/8eed5dff-8f00-4b4d-9e42-22d3588d9164.json
similarity index 100%
rename from docs/outstanding-issues-inbox/8eed5dff-8f00-4b4d-9e42-22d3588d9164.json
rename to docs/outstanding-issues-inbox/applied/8eed5dff-8f00-4b4d-9e42-22d3588d9164.json
diff --git a/docs/outstanding-issues-inbox/8fc64d4e-c903-4d36-8c9f-0440fcf81aa0.json b/docs/outstanding-issues-inbox/applied/8fc64d4e-c903-4d36-8c9f-0440fcf81aa0.json
similarity index 100%
rename from docs/outstanding-issues-inbox/8fc64d4e-c903-4d36-8c9f-0440fcf81aa0.json
rename to docs/outstanding-issues-inbox/applied/8fc64d4e-c903-4d36-8c9f-0440fcf81aa0.json
diff --git a/docs/outstanding-issues-inbox/985c82ad-026e-4b7f-a1e5-306a60689c02.json b/docs/outstanding-issues-inbox/applied/985c82ad-026e-4b7f-a1e5-306a60689c02.json
similarity index 100%
rename from docs/outstanding-issues-inbox/985c82ad-026e-4b7f-a1e5-306a60689c02.json
rename to docs/outstanding-issues-inbox/applied/985c82ad-026e-4b7f-a1e5-306a60689c02.json
diff --git a/docs/outstanding-issues-inbox/9b1bde71-1bf6-4bdd-9c79-0fea9056a922.json b/docs/outstanding-issues-inbox/applied/9b1bde71-1bf6-4bdd-9c79-0fea9056a922.json
similarity index 100%
rename from docs/outstanding-issues-inbox/9b1bde71-1bf6-4bdd-9c79-0fea9056a922.json
rename to docs/outstanding-issues-inbox/applied/9b1bde71-1bf6-4bdd-9c79-0fea9056a922.json
diff --git a/docs/outstanding-issues-inbox/9b233343-ed3a-4527-bb9b-f8cb93cd8eb7.json b/docs/outstanding-issues-inbox/applied/9b233343-ed3a-4527-bb9b-f8cb93cd8eb7.json
similarity index 100%
rename from docs/outstanding-issues-inbox/9b233343-ed3a-4527-bb9b-f8cb93cd8eb7.json
rename to docs/outstanding-issues-inbox/applied/9b233343-ed3a-4527-bb9b-f8cb93cd8eb7.json
diff --git a/docs/outstanding-issues-inbox/9e2b97c1-d8cc-45a4-a78f-8b7dfd90684d.json b/docs/outstanding-issues-inbox/applied/9e2b97c1-d8cc-45a4-a78f-8b7dfd90684d.json
similarity index 100%
rename from docs/outstanding-issues-inbox/9e2b97c1-d8cc-45a4-a78f-8b7dfd90684d.json
rename to docs/outstanding-issues-inbox/applied/9e2b97c1-d8cc-45a4-a78f-8b7dfd90684d.json
diff --git a/docs/outstanding-issues-inbox/9f54ed09-1500-4eba-90b1-0a25a148d3cf.json b/docs/outstanding-issues-inbox/applied/9f54ed09-1500-4eba-90b1-0a25a148d3cf.json
similarity index 100%
rename from docs/outstanding-issues-inbox/9f54ed09-1500-4eba-90b1-0a25a148d3cf.json
rename to docs/outstanding-issues-inbox/applied/9f54ed09-1500-4eba-90b1-0a25a148d3cf.json
diff --git a/docs/outstanding-issues-inbox/9f5e9e17-6b34-4f91-adc2-ba1275821021.json b/docs/outstanding-issues-inbox/applied/9f5e9e17-6b34-4f91-adc2-ba1275821021.json
similarity index 100%
rename from docs/outstanding-issues-inbox/9f5e9e17-6b34-4f91-adc2-ba1275821021.json
rename to docs/outstanding-issues-inbox/applied/9f5e9e17-6b34-4f91-adc2-ba1275821021.json
diff --git a/docs/outstanding-issues-inbox/a2c51e8a-37ac-43b3-9083-9b0012c8774c.json b/docs/outstanding-issues-inbox/applied/a2c51e8a-37ac-43b3-9083-9b0012c8774c.json
similarity index 100%
rename from docs/outstanding-issues-inbox/a2c51e8a-37ac-43b3-9083-9b0012c8774c.json
rename to docs/outstanding-issues-inbox/applied/a2c51e8a-37ac-43b3-9083-9b0012c8774c.json
diff --git a/docs/outstanding-issues-inbox/a3510f93-98e4-423b-b336-8b7394a294a2.json b/docs/outstanding-issues-inbox/applied/a3510f93-98e4-423b-b336-8b7394a294a2.json
similarity index 100%
rename from docs/outstanding-issues-inbox/a3510f93-98e4-423b-b336-8b7394a294a2.json
rename to docs/outstanding-issues-inbox/applied/a3510f93-98e4-423b-b336-8b7394a294a2.json
diff --git a/docs/outstanding-issues-inbox/a37ff8c7-1a2a-4026-a307-e710529d265a.json b/docs/outstanding-issues-inbox/applied/a37ff8c7-1a2a-4026-a307-e710529d265a.json
similarity index 100%
rename from docs/outstanding-issues-inbox/a37ff8c7-1a2a-4026-a307-e710529d265a.json
rename to docs/outstanding-issues-inbox/applied/a37ff8c7-1a2a-4026-a307-e710529d265a.json
diff --git a/docs/outstanding-issues-inbox/a686346e-911a-45a5-b0d6-c3b09a648aba.json b/docs/outstanding-issues-inbox/applied/a686346e-911a-45a5-b0d6-c3b09a648aba.json
similarity index 100%
rename from docs/outstanding-issues-inbox/a686346e-911a-45a5-b0d6-c3b09a648aba.json
rename to docs/outstanding-issues-inbox/applied/a686346e-911a-45a5-b0d6-c3b09a648aba.json
diff --git a/docs/outstanding-issues-inbox/aaf60e66-905d-43fa-bc98-2f93b43b86d9.json b/docs/outstanding-issues-inbox/applied/aaf60e66-905d-43fa-bc98-2f93b43b86d9.json
similarity index 100%
rename from docs/outstanding-issues-inbox/aaf60e66-905d-43fa-bc98-2f93b43b86d9.json
rename to docs/outstanding-issues-inbox/applied/aaf60e66-905d-43fa-bc98-2f93b43b86d9.json
diff --git a/docs/outstanding-issues-inbox/ad367416-8819-4bc4-89b8-999c5a7d6ef3.json b/docs/outstanding-issues-inbox/applied/ad367416-8819-4bc4-89b8-999c5a7d6ef3.json
similarity index 100%
rename from docs/outstanding-issues-inbox/ad367416-8819-4bc4-89b8-999c5a7d6ef3.json
rename to docs/outstanding-issues-inbox/applied/ad367416-8819-4bc4-89b8-999c5a7d6ef3.json
diff --git a/docs/outstanding-issues-inbox/ad565705-36b6-414c-a87f-ee991d9e6675.json b/docs/outstanding-issues-inbox/applied/ad565705-36b6-414c-a87f-ee991d9e6675.json
similarity index 100%
rename from docs/outstanding-issues-inbox/ad565705-36b6-414c-a87f-ee991d9e6675.json
rename to docs/outstanding-issues-inbox/applied/ad565705-36b6-414c-a87f-ee991d9e6675.json
diff --git a/docs/outstanding-issues-inbox/af2cd15c-6d53-4935-88f9-ceb4abd9fee2.json b/docs/outstanding-issues-inbox/applied/af2cd15c-6d53-4935-88f9-ceb4abd9fee2.json
similarity index 100%
rename from docs/outstanding-issues-inbox/af2cd15c-6d53-4935-88f9-ceb4abd9fee2.json
rename to docs/outstanding-issues-inbox/applied/af2cd15c-6d53-4935-88f9-ceb4abd9fee2.json
diff --git a/docs/outstanding-issues-inbox/af7dfcc2-ba22-42c3-a3b5-5f3a24cefcf8.json b/docs/outstanding-issues-inbox/applied/af7dfcc2-ba22-42c3-a3b5-5f3a24cefcf8.json
similarity index 100%
rename from docs/outstanding-issues-inbox/af7dfcc2-ba22-42c3-a3b5-5f3a24cefcf8.json
rename to docs/outstanding-issues-inbox/applied/af7dfcc2-ba22-42c3-a3b5-5f3a24cefcf8.json
diff --git a/docs/outstanding-issues-inbox/b741bc5d-02b8-41e6-9025-44e701d02314.json b/docs/outstanding-issues-inbox/applied/b741bc5d-02b8-41e6-9025-44e701d02314.json
similarity index 100%
rename from docs/outstanding-issues-inbox/b741bc5d-02b8-41e6-9025-44e701d02314.json
rename to docs/outstanding-issues-inbox/applied/b741bc5d-02b8-41e6-9025-44e701d02314.json
diff --git a/docs/outstanding-issues-inbox/b820ca6c-4882-4a09-85c7-a87505cb0f20.json b/docs/outstanding-issues-inbox/applied/b820ca6c-4882-4a09-85c7-a87505cb0f20.json
similarity index 100%
rename from docs/outstanding-issues-inbox/b820ca6c-4882-4a09-85c7-a87505cb0f20.json
rename to docs/outstanding-issues-inbox/applied/b820ca6c-4882-4a09-85c7-a87505cb0f20.json
diff --git a/docs/outstanding-issues-inbox/bd1a2627-a534-4714-bdf9-f79c44c9f535.json b/docs/outstanding-issues-inbox/applied/bd1a2627-a534-4714-bdf9-f79c44c9f535.json
similarity index 100%
rename from docs/outstanding-issues-inbox/bd1a2627-a534-4714-bdf9-f79c44c9f535.json
rename to docs/outstanding-issues-inbox/applied/bd1a2627-a534-4714-bdf9-f79c44c9f535.json
diff --git a/docs/outstanding-issues-inbox/bf33b91b-1b38-474e-93b6-c1de89d09714.json b/docs/outstanding-issues-inbox/applied/bf33b91b-1b38-474e-93b6-c1de89d09714.json
similarity index 100%
rename from docs/outstanding-issues-inbox/bf33b91b-1b38-474e-93b6-c1de89d09714.json
rename to docs/outstanding-issues-inbox/applied/bf33b91b-1b38-474e-93b6-c1de89d09714.json
diff --git a/docs/outstanding-issues-inbox/c0292ca2-95d9-4b10-9c53-c49706ffc247.json b/docs/outstanding-issues-inbox/applied/c0292ca2-95d9-4b10-9c53-c49706ffc247.json
similarity index 100%
rename from docs/outstanding-issues-inbox/c0292ca2-95d9-4b10-9c53-c49706ffc247.json
rename to docs/outstanding-issues-inbox/applied/c0292ca2-95d9-4b10-9c53-c49706ffc247.json
diff --git a/docs/outstanding-issues-inbox/c099eacf-e144-4962-9a6f-ad39f2d0fa11.json b/docs/outstanding-issues-inbox/applied/c099eacf-e144-4962-9a6f-ad39f2d0fa11.json
similarity index 100%
rename from docs/outstanding-issues-inbox/c099eacf-e144-4962-9a6f-ad39f2d0fa11.json
rename to docs/outstanding-issues-inbox/applied/c099eacf-e144-4962-9a6f-ad39f2d0fa11.json
diff --git a/docs/outstanding-issues-inbox/c1826f3b-80a3-4ec2-b84c-1e1e087578e7.json b/docs/outstanding-issues-inbox/applied/c1826f3b-80a3-4ec2-b84c-1e1e087578e7.json
similarity index 100%
rename from docs/outstanding-issues-inbox/c1826f3b-80a3-4ec2-b84c-1e1e087578e7.json
rename to docs/outstanding-issues-inbox/applied/c1826f3b-80a3-4ec2-b84c-1e1e087578e7.json
diff --git a/docs/outstanding-issues-inbox/c2135275-dffa-4c91-9422-2e995cdf7b02.json b/docs/outstanding-issues-inbox/applied/c2135275-dffa-4c91-9422-2e995cdf7b02.json
similarity index 100%
rename from docs/outstanding-issues-inbox/c2135275-dffa-4c91-9422-2e995cdf7b02.json
rename to docs/outstanding-issues-inbox/applied/c2135275-dffa-4c91-9422-2e995cdf7b02.json
diff --git a/docs/outstanding-issues-inbox/c97cdfa8-188c-4497-a596-fed5d8cb7c91.json b/docs/outstanding-issues-inbox/applied/c97cdfa8-188c-4497-a596-fed5d8cb7c91.json
similarity index 100%
rename from docs/outstanding-issues-inbox/c97cdfa8-188c-4497-a596-fed5d8cb7c91.json
rename to docs/outstanding-issues-inbox/applied/c97cdfa8-188c-4497-a596-fed5d8cb7c91.json
diff --git a/docs/outstanding-issues-inbox/cc5a466d-68c6-4c38-86e7-b3f520afbc74.json b/docs/outstanding-issues-inbox/applied/cc5a466d-68c6-4c38-86e7-b3f520afbc74.json
similarity index 100%
rename from docs/outstanding-issues-inbox/cc5a466d-68c6-4c38-86e7-b3f520afbc74.json
rename to docs/outstanding-issues-inbox/applied/cc5a466d-68c6-4c38-86e7-b3f520afbc74.json
diff --git a/docs/outstanding-issues-inbox/d054319f-62fc-4cdf-9ae2-b6a6492d5d43.json b/docs/outstanding-issues-inbox/applied/d054319f-62fc-4cdf-9ae2-b6a6492d5d43.json
similarity index 100%
rename from docs/outstanding-issues-inbox/d054319f-62fc-4cdf-9ae2-b6a6492d5d43.json
rename to docs/outstanding-issues-inbox/applied/d054319f-62fc-4cdf-9ae2-b6a6492d5d43.json
diff --git a/docs/outstanding-issues-inbox/d088ad38-f38f-4ba1-894a-aa2dca11dc65.json b/docs/outstanding-issues-inbox/applied/d088ad38-f38f-4ba1-894a-aa2dca11dc65.json
similarity index 100%
rename from docs/outstanding-issues-inbox/d088ad38-f38f-4ba1-894a-aa2dca11dc65.json
rename to docs/outstanding-issues-inbox/applied/d088ad38-f38f-4ba1-894a-aa2dca11dc65.json
diff --git a/docs/outstanding-issues-inbox/d1168dbe-aae2-448b-9e9d-bdea74023dfe.json b/docs/outstanding-issues-inbox/applied/d1168dbe-aae2-448b-9e9d-bdea74023dfe.json
similarity index 100%
rename from docs/outstanding-issues-inbox/d1168dbe-aae2-448b-9e9d-bdea74023dfe.json
rename to docs/outstanding-issues-inbox/applied/d1168dbe-aae2-448b-9e9d-bdea74023dfe.json
diff --git a/docs/outstanding-issues-inbox/d24e0ba6-e21e-4c7a-81fd-04ff18800cf7.json b/docs/outstanding-issues-inbox/applied/d24e0ba6-e21e-4c7a-81fd-04ff18800cf7.json
similarity index 100%
rename from docs/outstanding-issues-inbox/d24e0ba6-e21e-4c7a-81fd-04ff18800cf7.json
rename to docs/outstanding-issues-inbox/applied/d24e0ba6-e21e-4c7a-81fd-04ff18800cf7.json
diff --git a/docs/outstanding-issues-inbox/d2785add-72d1-47db-9e4b-32be1a8729e9.json b/docs/outstanding-issues-inbox/applied/d2785add-72d1-47db-9e4b-32be1a8729e9.json
similarity index 100%
rename from docs/outstanding-issues-inbox/d2785add-72d1-47db-9e4b-32be1a8729e9.json
rename to docs/outstanding-issues-inbox/applied/d2785add-72d1-47db-9e4b-32be1a8729e9.json
diff --git a/docs/outstanding-issues-inbox/d2aeb17b-1d02-4bad-85ae-d76f0baa4e7a.json b/docs/outstanding-issues-inbox/applied/d2aeb17b-1d02-4bad-85ae-d76f0baa4e7a.json
similarity index 100%
rename from docs/outstanding-issues-inbox/d2aeb17b-1d02-4bad-85ae-d76f0baa4e7a.json
rename to docs/outstanding-issues-inbox/applied/d2aeb17b-1d02-4bad-85ae-d76f0baa4e7a.json
diff --git a/docs/outstanding-issues-inbox/d2b587d0-3362-4e3e-9292-786793b946a4.json b/docs/outstanding-issues-inbox/applied/d2b587d0-3362-4e3e-9292-786793b946a4.json
similarity index 100%
rename from docs/outstanding-issues-inbox/d2b587d0-3362-4e3e-9292-786793b946a4.json
rename to docs/outstanding-issues-inbox/applied/d2b587d0-3362-4e3e-9292-786793b946a4.json
diff --git a/docs/outstanding-issues-inbox/d2f30554-e6ac-4cff-9e8f-d6cad1694870.json b/docs/outstanding-issues-inbox/applied/d2f30554-e6ac-4cff-9e8f-d6cad1694870.json
similarity index 100%
rename from docs/outstanding-issues-inbox/d2f30554-e6ac-4cff-9e8f-d6cad1694870.json
rename to docs/outstanding-issues-inbox/applied/d2f30554-e6ac-4cff-9e8f-d6cad1694870.json
diff --git a/docs/outstanding-issues-inbox/d53026f6-ee7d-4009-aa37-a6e3a5d83edb.json b/docs/outstanding-issues-inbox/applied/d53026f6-ee7d-4009-aa37-a6e3a5d83edb.json
similarity index 100%
rename from docs/outstanding-issues-inbox/d53026f6-ee7d-4009-aa37-a6e3a5d83edb.json
rename to docs/outstanding-issues-inbox/applied/d53026f6-ee7d-4009-aa37-a6e3a5d83edb.json
diff --git a/docs/outstanding-issues-inbox/d5658202-e8d6-465d-aeb6-85c854423e17.json b/docs/outstanding-issues-inbox/applied/d5658202-e8d6-465d-aeb6-85c854423e17.json
similarity index 100%
rename from docs/outstanding-issues-inbox/d5658202-e8d6-465d-aeb6-85c854423e17.json
rename to docs/outstanding-issues-inbox/applied/d5658202-e8d6-465d-aeb6-85c854423e17.json
diff --git a/docs/outstanding-issues-inbox/d6f9fc12-d141-4ec3-af17-8edb70048e39.json b/docs/outstanding-issues-inbox/applied/d6f9fc12-d141-4ec3-af17-8edb70048e39.json
similarity index 100%
rename from docs/outstanding-issues-inbox/d6f9fc12-d141-4ec3-af17-8edb70048e39.json
rename to docs/outstanding-issues-inbox/applied/d6f9fc12-d141-4ec3-af17-8edb70048e39.json
diff --git a/docs/outstanding-issues-inbox/d88feaff-8564-4eee-9e78-9fe3d80a2bb7.json b/docs/outstanding-issues-inbox/applied/d88feaff-8564-4eee-9e78-9fe3d80a2bb7.json
similarity index 100%
rename from docs/outstanding-issues-inbox/d88feaff-8564-4eee-9e78-9fe3d80a2bb7.json
rename to docs/outstanding-issues-inbox/applied/d88feaff-8564-4eee-9e78-9fe3d80a2bb7.json
diff --git a/docs/outstanding-issues-inbox/d93212ab-f5cb-4cf3-807f-046d06f8fd39.json b/docs/outstanding-issues-inbox/applied/d93212ab-f5cb-4cf3-807f-046d06f8fd39.json
similarity index 100%
rename from docs/outstanding-issues-inbox/d93212ab-f5cb-4cf3-807f-046d06f8fd39.json
rename to docs/outstanding-issues-inbox/applied/d93212ab-f5cb-4cf3-807f-046d06f8fd39.json
diff --git a/docs/outstanding-issues-inbox/dc536871-2125-416e-be36-4d093641fbf0.json b/docs/outstanding-issues-inbox/applied/dc536871-2125-416e-be36-4d093641fbf0.json
similarity index 100%
rename from docs/outstanding-issues-inbox/dc536871-2125-416e-be36-4d093641fbf0.json
rename to docs/outstanding-issues-inbox/applied/dc536871-2125-416e-be36-4d093641fbf0.json
diff --git a/docs/outstanding-issues-inbox/dd7ceed8-6084-47a9-932b-df6d2dd6e272.json b/docs/outstanding-issues-inbox/applied/dd7ceed8-6084-47a9-932b-df6d2dd6e272.json
similarity index 100%
rename from docs/outstanding-issues-inbox/dd7ceed8-6084-47a9-932b-df6d2dd6e272.json
rename to docs/outstanding-issues-inbox/applied/dd7ceed8-6084-47a9-932b-df6d2dd6e272.json
diff --git a/docs/outstanding-issues-inbox/ddc24ede-0f36-47e8-a2a4-2c9040186696.json b/docs/outstanding-issues-inbox/applied/ddc24ede-0f36-47e8-a2a4-2c9040186696.json
similarity index 100%
rename from docs/outstanding-issues-inbox/ddc24ede-0f36-47e8-a2a4-2c9040186696.json
rename to docs/outstanding-issues-inbox/applied/ddc24ede-0f36-47e8-a2a4-2c9040186696.json
diff --git a/docs/outstanding-issues-inbox/ded80895-a792-4854-b89c-ce4dae9537ad.json b/docs/outstanding-issues-inbox/applied/ded80895-a792-4854-b89c-ce4dae9537ad.json
similarity index 100%
rename from docs/outstanding-issues-inbox/ded80895-a792-4854-b89c-ce4dae9537ad.json
rename to docs/outstanding-issues-inbox/applied/ded80895-a792-4854-b89c-ce4dae9537ad.json
diff --git a/docs/outstanding-issues-inbox/e978e1fd-70a4-43f3-a547-6f7e67ff3bf8.json b/docs/outstanding-issues-inbox/applied/e978e1fd-70a4-43f3-a547-6f7e67ff3bf8.json
similarity index 100%
rename from docs/outstanding-issues-inbox/e978e1fd-70a4-43f3-a547-6f7e67ff3bf8.json
rename to docs/outstanding-issues-inbox/applied/e978e1fd-70a4-43f3-a547-6f7e67ff3bf8.json
diff --git a/docs/outstanding-issues-inbox/ea72c77f-9e14-428e-97c3-99c700121a4d.json b/docs/outstanding-issues-inbox/applied/ea72c77f-9e14-428e-97c3-99c700121a4d.json
similarity index 100%
rename from docs/outstanding-issues-inbox/ea72c77f-9e14-428e-97c3-99c700121a4d.json
rename to docs/outstanding-issues-inbox/applied/ea72c77f-9e14-428e-97c3-99c700121a4d.json
diff --git a/docs/outstanding-issues-inbox/ec090af5-282c-4bc6-8d6d-9b066e8acd73.json b/docs/outstanding-issues-inbox/applied/ec090af5-282c-4bc6-8d6d-9b066e8acd73.json
similarity index 100%
rename from docs/outstanding-issues-inbox/ec090af5-282c-4bc6-8d6d-9b066e8acd73.json
rename to docs/outstanding-issues-inbox/applied/ec090af5-282c-4bc6-8d6d-9b066e8acd73.json
diff --git a/docs/outstanding-issues-inbox/ecbe4970-41ef-45e7-b731-6f31a5df480c.json b/docs/outstanding-issues-inbox/applied/ecbe4970-41ef-45e7-b731-6f31a5df480c.json
similarity index 100%
rename from docs/outstanding-issues-inbox/ecbe4970-41ef-45e7-b731-6f31a5df480c.json
rename to docs/outstanding-issues-inbox/applied/ecbe4970-41ef-45e7-b731-6f31a5df480c.json
diff --git a/docs/outstanding-issues-inbox/ef089e5e-9dbf-4d75-aa87-160131dd8a5d.json b/docs/outstanding-issues-inbox/applied/ef089e5e-9dbf-4d75-aa87-160131dd8a5d.json
similarity index 100%
rename from docs/outstanding-issues-inbox/ef089e5e-9dbf-4d75-aa87-160131dd8a5d.json
rename to docs/outstanding-issues-inbox/applied/ef089e5e-9dbf-4d75-aa87-160131dd8a5d.json
diff --git a/docs/outstanding-issues-inbox/efb87c27-6663-472f-99bc-93c1afc23377.json b/docs/outstanding-issues-inbox/applied/efb87c27-6663-472f-99bc-93c1afc23377.json
similarity index 100%
rename from docs/outstanding-issues-inbox/efb87c27-6663-472f-99bc-93c1afc23377.json
rename to docs/outstanding-issues-inbox/applied/efb87c27-6663-472f-99bc-93c1afc23377.json
diff --git a/docs/outstanding-issues-inbox/f1bd7d17-da23-4984-bdeb-f2905a49748b.json b/docs/outstanding-issues-inbox/applied/f1bd7d17-da23-4984-bdeb-f2905a49748b.json
similarity index 100%
rename from docs/outstanding-issues-inbox/f1bd7d17-da23-4984-bdeb-f2905a49748b.json
rename to docs/outstanding-issues-inbox/applied/f1bd7d17-da23-4984-bdeb-f2905a49748b.json
diff --git a/docs/outstanding-issues-inbox/f1f3115b-db82-4186-9adc-b0d46235e0fe.json b/docs/outstanding-issues-inbox/applied/f1f3115b-db82-4186-9adc-b0d46235e0fe.json
similarity index 100%
rename from docs/outstanding-issues-inbox/f1f3115b-db82-4186-9adc-b0d46235e0fe.json
rename to docs/outstanding-issues-inbox/applied/f1f3115b-db82-4186-9adc-b0d46235e0fe.json
diff --git a/docs/outstanding-issues-inbox/f3520dd3-f570-4ed0-9f7e-dad28519f15d.json b/docs/outstanding-issues-inbox/applied/f3520dd3-f570-4ed0-9f7e-dad28519f15d.json
similarity index 100%
rename from docs/outstanding-issues-inbox/f3520dd3-f570-4ed0-9f7e-dad28519f15d.json
rename to docs/outstanding-issues-inbox/applied/f3520dd3-f570-4ed0-9f7e-dad28519f15d.json
diff --git a/docs/outstanding-issues-inbox/f58cc557-ab6f-4671-b136-84d6c51c8742.json b/docs/outstanding-issues-inbox/applied/f58cc557-ab6f-4671-b136-84d6c51c8742.json
similarity index 100%
rename from docs/outstanding-issues-inbox/f58cc557-ab6f-4671-b136-84d6c51c8742.json
rename to docs/outstanding-issues-inbox/applied/f58cc557-ab6f-4671-b136-84d6c51c8742.json
diff --git a/docs/outstanding-issues-inbox/f888514c-f96d-4348-b8e1-68066381d618.json b/docs/outstanding-issues-inbox/applied/f888514c-f96d-4348-b8e1-68066381d618.json
similarity index 100%
rename from docs/outstanding-issues-inbox/f888514c-f96d-4348-b8e1-68066381d618.json
rename to docs/outstanding-issues-inbox/applied/f888514c-f96d-4348-b8e1-68066381d618.json
diff --git a/docs/outstanding-issues-inbox/fadf94bc-4571-44e4-bb05-896347d3211e.json b/docs/outstanding-issues-inbox/applied/fadf94bc-4571-44e4-bb05-896347d3211e.json
similarity index 100%
rename from docs/outstanding-issues-inbox/fadf94bc-4571-44e4-bb05-896347d3211e.json
rename to docs/outstanding-issues-inbox/applied/fadf94bc-4571-44e4-bb05-896347d3211e.json
diff --git a/docs/outstanding-issues-inbox/fc1dadc4-6a43-4f4b-a39b-35357326c06a.json b/docs/outstanding-issues-inbox/applied/fc1dadc4-6a43-4f4b-a39b-35357326c06a.json
similarity index 100%
rename from docs/outstanding-issues-inbox/fc1dadc4-6a43-4f4b-a39b-35357326c06a.json
rename to docs/outstanding-issues-inbox/applied/fc1dadc4-6a43-4f4b-a39b-35357326c06a.json
diff --git a/docs/outstanding-issues-inbox/fe690a71-ad93-429a-a45e-2943b1191259.json b/docs/outstanding-issues-inbox/applied/fe690a71-ad93-429a-a45e-2943b1191259.json
similarity index 100%
rename from docs/outstanding-issues-inbox/fe690a71-ad93-429a-a45e-2943b1191259.json
rename to docs/outstanding-issues-inbox/applied/fe690a71-ad93-429a-a45e-2943b1191259.json
diff --git a/docs/outstanding-issues-inbox/cbd0a3f9-af52-4247-b61f-6541acf527f8.json b/docs/outstanding-issues-inbox/cbd0a3f9-af52-4247-b61f-6541acf527f8.json
new file mode 100644
index 0000000000..51d1a7800b
--- /dev/null
+++ b/docs/outstanding-issues-inbox/cbd0a3f9-af52-4247-b61f-6541acf527f8.json
@@ -0,0 +1,14 @@
+{
+  "version": 2,
+  "id": "cbd0a3f9-af52-4247-b61f-6541acf527f8",
+  "createdOn": "2026-10-16",
+  "action": "add",
+  "payload": {
+    "pri": "P2",
+    "type": "task",
+    "summary": "Clinical KB: provision PROXY_AUTH dedicated secret on the PsychSift Railway service (follow-up to #789SD7)",
+    "detail": "Route validation for PROXY_AUTH exists and fails closed with 503, but docs/supabase-remediation-closeout-notes.md still records PROXY_AUTH as not on Railway by name. The owner must authorise and confirm the variable on the correct PsychSift Railway service in a quiet change window; no agent sets production secrets.",
+    "source": "PR #3570 review; docs/supabase-remediation-closeout-notes.md; src/lib/supabase/proxy-auth-crypto.ts",
+    "issueUlid": "01M51JV9M29E87MGRFV0QFE7BA"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/da9d4a0c-94e8-40e1-ba5d-73a3b0d8dcb6.json b/docs/outstanding-issues-inbox/da9d4a0c-94e8-40e1-ba5d-73a3b0d8dcb6.json
new file mode 100644
index 0000000000..83a46faf68
--- /dev/null
+++ b/docs/outstanding-issues-inbox/da9d4a0c-94e8-40e1-ba5d-73a3b0d8dcb6.json
@@ -0,0 +1,14 @@
+{
+  "version": 2,
+  "id": "da9d4a0c-94e8-40e1-ba5d-73a3b0d8dcb6",
+  "createdOn": "2026-10-16",
+  "action": "add",
+  "payload": {
+    "pri": "P2",
+    "type": "task",
+    "summary": "Teaching Assessments: wire durable authenticated assessment storage and supervisor bookings (follow-up to #4KQGXZ)",
+    "detail": "The schema, RLS policies and migration for registrar assessments exist, but the dual-sign-off route still uses in-process memory and returns 503 in production, and no supervisor-booking endpoints or availability storage exist. Wire durable authenticated storage into the route and add the booking endpoints before closing.",
+    "source": "PR #3570 review; src/app/api/teaching/assessments/dual-sign-off/route.ts; supabase/migrations/20261013160000_teaching_assessments_and_milestones.sql",
+    "issueUlid": "01M51JV9CNAD9JC6FPMWA8RZZ0"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/ef7e6803-0600-4348-9b43-344fd4ff4b1a.json b/docs/outstanding-issues-inbox/ef7e6803-0600-4348-9b43-344fd4ff4b1a.json
new file mode 100644
index 0000000000..1ceec1fcb9
--- /dev/null
+++ b/docs/outstanding-issues-inbox/ef7e6803-0600-4348-9b43-344fd4ff4b1a.json
@@ -0,0 +1,14 @@
+{
+  "version": 2,
+  "id": "ef7e6803-0600-4348-9b43-344fd4ff4b1a",
+  "createdOn": "2026-10-16",
+  "action": "add",
+  "payload": {
+    "pri": "P2",
+    "type": "task",
+    "summary": "CPD: connect the Training page to registrar training milestone storage (follow-up to #T983N9)",
+    "detail": "The registrar_training_milestones table and RLS policies exist, but no application code reads or writes it, the Training page still hard-codes not-recorded, and its milestone reader queries a different table. Implement owner-scoped storage and sync and replace the hard-coded state before closing.",
+    "source": "PR #3570 review; src/app/(search-app)/cme/training/page.tsx; src/lib/cme/training-repository.ts",
+    "issueUlid": "01M51JV9EEXNAHY22XVMGMAD14"
+  }
+}
diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md
index ad013b9926..65af23f70b 100644
--- a/docs/outstanding-issues.md
+++ b/docs/outstanding-issues.md
@@ -97,21 +97,16 @@ removed after current-main verification; it is not missing recommended work.
 | #CC8D30 <!-- issue-ulid:01M1GRW5YXCC8D3021M0S3TH7T --> | P3 | task | Two read-only live-database reads are owed before the migration-history guard and reindex-reaper work can be closed | REVIEW 2026-09-25 (offline audit of current main; no provider access): Drop read (1): resolved row #DW3XK8 (2026-09-12) already closed the four no-DDL stems, and live-drift was recorded green on 2026-09-19. Read (2) is still owed; reindex-reaper.yml is still gated on the unset REINDEX_REAPER_ENABLED, so nothing is blocked until someone arms the reaper: P3. PRs #2549 and #2552 have merged (cd2552e2f, 316feca88). PRIOR DETAIL: Both are SELECTs that change nothing, and neither can be run from an agent session (no credentials, and the standing instruction is never to touch the live database). (1) Migration-history classification for the four newly declared no-op migrations, needed to decide whether each requires a 20260804110240-pattern validation guard plus a reviewed drift-allowlist entry: select jsonb_agg(row) from jsonb_array_elements(public.schema_drift_snapshot() -> 'migration_history') as row where row ->> 'version' in ('20260629100000','20260702170000','20260708160000','20260709150000'); Note the no_ddl predicate currently cannot express 'select 1 where false;', so that predicate needs review before any allowlist entry is written, and it must not be widened to make an entry pass. (2) Reindex-reaper alarm baseline, needed before REINDEX_REAPER_ENABLED is ever set, because a non-zero would_alert_forever means the weekly probe opens a permanently red issue the moment it is armed: select (select count(*) from public.documents) as documents_total, (select count(*) from public.documents where index_generation_id is null) as documents_missing_pointer, (select count(distinct c.document_id) from public.document_chunks c join public.documents d on d.id = c.document_id where c.index_generation_id is not null and d.index_generation_id is null) as would_alert_forever; | PRs #2549 (claude/migration-history-guards) and #2552 (claude/reindex-reaper) | 2026-09-02 |
 | #6APN03 <!-- issue-ulid:01M1G9XGWG6APN03AY7W835ECQ --> | P3 | task | Corpus health panel and the hub document count have never been seen against the real library | REVIEW 2026-09-25 (offline audit of current main; no provider access): Still unverifiable offline (needs a live admin session). A developer-hub panel with no clinical impact, so P3. PRIOR DETAIL: Both merged (#2504, #2512) and both were built in a cloud container with no live database and no browser, so every test uses stand-in data. Confirmation needs a machine with live Supabase config and a signed-in administrator: run npm run ensure, open /mockups/development and check the environment strip shows a real document count rather than 'document count unavailable', then open /mockups/development/corpus-health and check the four status tiles show numbers rather than 'Not read'. Then record which of the five spread cases resolveQualitySpread reports for extraction quality. An unverified report says every document may carry an identical placeholder quality_score. A uniform reading is a prompt to investigate and NOT a confirmed fault: assessDocumentIndexQuality starts the score at 1 and only subtracts penalties before rounding to three decimals, so a cleanly extracted corpus legitimately scores 1.000 for every document. Treat a uniform 0.00 as the suspicious case, since 0 is the column default and extraction_quality defaults to unknown, and corroborate against the issues array and metrics JSON on the same rows before recording anything against the scoring pipeline. Full context in docs/corpus-health-panel-handover.md. | docs/corpus-health-panel-handover.md | 2026-09-02 |
 | #E9F5GW <!-- issue-ulid:01M1N79ZX3E9F5GWKSCBF87Y3W --> | P2 | issue | Answer generation silently gives up and returns the source-only stub, so no written answer and no inline citation marks | REVIEW 2026-09-25 (offline audit of current main; no provider access): PR #2790 (c309bf6f1) added lithium level-timing extraction and a test for recovering verified source facts after malformed fast and strong generation, so the lithium symptom may already be fixed; re-probe 'lithium level timing' (needs provider). If clean, close into #J8SJQ9; if the timeout stub recurs, it is #231's territory. Line refs moved: sourceBackedGenerationTimeoutAnswer rag-extractive-answer.ts:3633, resolveClaimMarks :195, rag.ts trigger sites :2782, :3807, :3872. PRIOR DETAIL: Reported live 2026-09-04: the query 'lithium level timing' returned sourceBackedGenerationTimeoutAnswer (rag-extractive-answer.ts:2951) with three citations and answerSections: []. The owner read the absent in-prose source marks as a rendering bug. It is not: resolveClaimMarks (answer-claim-marks.ts:193) matches a rendered sentence against answer.supportedClaims by exact normalised text, the stub's two sentences are not recorded claims, and rag-answer-instructions.ts:49 forbids the model from writing citation digits in prose at all. So no marker parser exists or should exist, and adding one would change nothing on this path. The defect is upstream: no written answer was produced for a query whose corpus evidence was good enough to cite three documents. Same shape as J8SJQ9 (antipsychotic metabolic monitoring), which names the first diagnostic step as establishing whether generation was attempted at all - that run recorded provider_attempted:false for 11 of 30 targeting cases. Owner reports the stub is rare in normal use, so this is scheduled work rather than an incident. Three trigger sites: rag.ts:3121 extractiveNeedsReviewFallback, rag.ts:4169 sourceBackedReviewReason, rag.ts:4200 finalizedFallbackNeedsReview. Do not relax the eval case to hide it. LIVE QA ADDENDUM 2026-09-13 (psychiatry.tools guest desktop): lithium/depression probes again showed malformed prose / source-backed stubs and a stuck subject-less monitoring search (Stop aborted cleanly). Same failure family already tracked here and associated with #J8SJQ9. Do not open a duplicate P1. Next remains: reproduce with Answer canary / UI smoke; do not weaken eval cases; fix generation/extractive path. Evidence: MASTER-LIVE-SITE-QA-REPORT 2026-09-13 (LQA-P1-ANS). | Owner phone report 2026-09-04 during PR #2590 follow-up; screenshot of Answer mode, query 'lithium level timing'; session 2026-09-13 live QA; retract duplicate inbox add 9b595f7f | 2026-09-04 |
-| #3944SV <!-- issue-ulid:01M1G8MVT43944SV0BPYE7ZZWX --> | P2 | issue | clearlyNonClinicalConsumerPattern refuses in-corpus psychiatric queries on bare consumer tokens, the same defect as the topic denylist | REVIEW 2026-09-25 (offline audit of current main; no provider access): Offline probe on current main: 'phone contact after discharge' (confidence 0.432, above the 0.42 cutoff), 'car accident trauma assessment', 'tv watching and negative symptoms', 'holiday leave from the ward' and 'flight of ideas in mania' still short-circuit. 'restaurant avoidance in social anxiety' now reaches retrieval via the psychiatricOrClinicalContextPattern override (3f2bb4771); 'mania' and 'discharge' are not in that override. Partial mitigation only. PRIOR DETAIL: Found while fixing #000GN4 (2026-09-02, probed against the real analyzeClinicalQuery on main at 45a3dcacb54a). src/lib/rag/rag-query-guard.ts:3-4 short-circuits any soft-tail-eligible query matching bare tokens including phone, car, tv, television, restaurant, holiday, hotel, flight, kitchen and laptop. Measured, with shouldShortCircuitUnsupportedSearch on the real analyzer: 'phone contact after discharge' short-circuits to zero retrieval while 'telephone follow up after discharge' reaches retrieval, and the word 'phone' is the only difference. Post-discharge phone contact is a topic this repo actively builds for - see the Caring Contacts work. Also confirmed refused by the pattern alone, with confidence and expandedTerms both above the soft-tail thresholds so the pattern is the sole cause: 'restaurant avoidance in social anxiety', 'car accident trauma assessment', 'tv watching and negative symptoms', 'holiday leave from the ward'. Separately, the token 'flight' matches 'flight of ideas', a core sign of mania, though that query would short-circuit through the soft tail anyway. This is milder than #000GN4 because these tokens sit behind unsupportedSoftTailEligible rather than firing unconditionally, but the mechanism is identical: a bare token standing in for a topic judgement. FIX: the same shape as #000GN4 - replace bare tokens with phrases that cannot occur in a clinical question, or route the decision through classifyCorpusGrounding where the query is soft-tail eligible anyway. Protected RAG surface: needs the RAG impact declaration, the clinical governance preflight, and an eval:quality --rag-only run, since the consumer controls in rag-eval-cases.ts (coffee machine, air fryer, overnight oats) are what this pattern pins. Note unavailableDocumentNoisePattern was checked in the same pass and is clean - every entry there is a multi-word phrase. | src/lib/rag/rag-query-guard.ts:3-4; probed with shouldShortCircuitUnsupportedSearch against analyzeClinicalQuery on main 45a3dcacb54a; RAG retrieval review of PR branch claude/rag-query-guard, 2026-09-02 | 2026-09-02 |
-| #RP00FZ <!-- issue-ulid:01M1G9RKB5RP00FZ56D7TE2A1Y --> | P2 | task | Reindex reaper: the storage-object half of the abandoned-generation cleanup is still missing | PARTIAL PROGRESS, recorded here so it is not tracked only in code comments. The DETECTION half landed on branch claude/reindex-reaper: scripts/cleanup-abandoned-reindex-generations.ts gained a read-only --alert-on-abandoned flag whose pure decision function (abandonedReindexGenerationAlertExitCode in src/lib/reindex-pipeline.ts) exits 2 when a dry run finds abandoned staged rows, and .github/workflows/reindex-reaper.yml runs it as a weekly read-only probe that opens or updates an alert issue. That workflow ships INERT (repo variable REINDEX_REAPER_ENABLED is unset) and its destructive apply path is triple-gated and statically guarded by scripts/check-github-action-pins.mjs. WHAT REMAINS, and what this row exists for: the storage-object half. cleanup_abandoned_document_index_generations deletes generation-bearing rows across seven artifact tables, but nothing enqueues storage_cleanup_jobs rows for the objects those generations left behind, so a crash mid-reindex still leaks Storage objects that no schedule revisits. The recorded fix is for the commit RPC to enqueue storage_cleanup_jobs rows for superseded generations at commit time. That is a migration, it deploys to the live clinical database on merge, and it was deliberately excluded from the detection batch. THREE PREREQUISITES the same review recorded, all of which should land before the repo variable REINDEX_REAPER_APPLY is ever set: (1) the RPC has no owner scoping and no row ceiling -- seven deletes in one transaction under a 180s statement timeout -- so a migration adding a row ceiling and a keep-most-recent-generation guard should come first; (2) the RPC's predicate makes every generation-bearing row eligible on any document whose metadata.index_generation_id is absent, so documents predating generation stamping will register as abandoned forever and the weekly probe will very likely be permanently red until either a backfill migration lands or the probe alerts on a delta rather than an absolute count; (3) arming the apply path safely needs a GitHub Environment with required reviewers on a separate apply job, because two of the three gates are standing repository variables and only client_payload.apply is per-run. Full reasoning is in the header of .github/workflows/reindex-reaper.yml. | review of branch claude/reindex-reaper, 2026-09-02 | 2026-09-02 |
-| #XSZ4XV <!-- issue-ulid:01M1X8YZXQXSZ4XVP2H0P1RMQZ --> | P2 | task | Audit remediation leftovers: calculator governance link, stale Docling pin references, unrecorded Docling model treeDigest | PARTLY FIXED 2026-09-25: (1) the calculator governance reference now renders as plain text, not a link, per the owner decision (8465d2e97, search-detail.tsx; pinned by tests/calculators-clinical-safety.dom.test.tsx). The url in data/calculators/evidence.json is unchanged. (2) eval/docling/README.md and docs/worker-deploy-runbook.md now name the version pinned in eval/docling/requirements.txt instead of the stale docling==2.120.2 (7bd62e845; pinned by tests/docling-model-artifacts.test.ts); the Gate B decision record was left alone as history. STILL OPEN: (3) eval/docling/model-artifacts.json has treeDigest null, so the model pin only warns; one operator Docker build records it. Earlier history: PR #2920 (2026-09-19) landed vendored brand fonts, the Docling artifact-digest check and the real offline BrandMark; CACHE_VERSION was already done. | Codex review PR #2701 discussion_r3946596430; corrects #4BE39H | 2026-09-07 |
-| #9Z197J <!-- issue-ulid:01M1XFVVAZ9Z197J7AAJJEP4C7 --> | P2 | issue | release-browser-matrix Firefox/WebKit failures: four of six Firefox ones fixed (three sub-pixel artefacts merged, dark-mode test ordering merged), two Firefox and all eight WebKit still open, and the job is not in PR required so it never blocks a merge | Failure count substantially reduced by layout tolerance and settled-click repairs; main-failure-routing active. PRIOR DETAIL (restored 2026-10-09, an earlier update replaced it wholesale): UPDATE 2026-09-25 from the owner-supplied Ultimate Audit Master Report (audit F10), not reproduced offline: the WebKit phone-chrome failures include header overlay, composer visibility, scroll animation and narrow settings geometry, with one settings position measured at -140 px. Audit recommendation: audit the shared scroll controller, safe-area geometry and scroll-container ownership rather than per-test fixes. The audit duplicate-<main> finding (F08) is already resolved as the hidden streaming clone (#TWS2GD); the Specifiers mobile Axe failure and the Differentials ChunkLoadError are separate rows queued the same day. PRIOR DETAIL: UPDATE 2026-09-20 (six Firefox failures read from the job log of main run 35503893104; four now addressed, two open; no Firefox was run - see the egress row). THE COUNT AND THE CLASSIFICATION IN THIS ROW WERE BOTH WRONG. Firefox failed SIX, not five, and only THREE were tolerance, not five. FIXED AND MERGED (PR #2932): three sub-pixel artefacts - a 16px card gap measured 15.999969482421875, a 12px column gap measured 11.999954223632812, and a 48px tap target measured 47.98333740234375 against its existing 2px allowance. The first two are float error from subtracting two client rects; the third is Firefox storing layout in app units of 1/60 CSS px, so 47.98333740234375 is exactly 2879/60 - one app unit short, the smallest miss the engine can express. tests/helpers/layout-tolerance.ts holds one 0.05px tolerance, mutation-tested from both sides. No floor lowered, nothing skipped or quarantined. FIXED, MERGED as PR #2933 at 0cfdd250e on 2026-09-20, verified as an ancestor of this reconciliation - originally recorded as AWAITING MERGE because the request was queued before it landed: the fourth, ui-on-call-boards dark mode, was TEST ORDERING and not an app bug. It set the colour-scheme override while the page was still on about:blank, and Playwright Firefox does not carry that into the first navigation; the theme is resolved once pre-paint by the bootstrap in src/lib/theme.ts, so a late preference is already missed. PROOF IT IS NOT THE APP: the twelve dark assertions in ui-caring-contacts-workspace.spec.ts PASS on Firefox in this same run (tests 48, 53, 59, 65, 72, 79, 85, 100, 138, 152, 159, 169) and every one navigates first and switches scheme after. An earlier reading blamed color-scheme: light on :root and concluded dark mode was broken for every Firefox and Safari user; those twelve passes refute it. Do not reopen the design-system dark contract on this evidence. STILL OPEN: the remaining two Firefox failures are tracked separately - see the row for the document-viewer hit counter and the tools Forms panel. The eight WebKit failures are UNCHANGED and still unexamined; the six phone-chrome ones remain the likely-real-iPhone-bug reading recorded above. UPDATE 2026-09-20 (read from the GitHub job logs of the latest main release-browser-matrix run; still no local browser run, provisioning fails here as described below). THE COUNT IS 13, NOT 15: Chromium green in ~8 min; Firefox 700 passed / 5 failed in ~28 min; WebKit 696 passed / 8 failed in ~40 min. THE 2026-09-06 CONCLUSION IS HALF WRONG AND THE CORRECTION IS THE POINT OF THIS UPDATE. The Firefox half is tolerance work as recorded — one failure is provably a measurement artefact, Expected >= 12 / Received 11.999954223632812, a sub-pixel rounding difference and nothing more. THE WEBKIT HALF IS NOT. Six of the eight WebKit failures are phone scroll, header, footer and composer behaviour. WebKit is Safari engine, so on an iPhone those are candidate real user-visible bugs, not engine-geometry tolerance, and must be read as a bug report rather than assertion-loosening work. ORDER: fix the five Firefox tolerances first because they are cheap and provably artefacts, then treat the six WebKit phone-chrome failures as a defect investigation, and do that before the tablet row #6GR6B8 because the two are plausibly the same root cause. QUARANTINING IS STILL THE WRONG ANSWER, and more so now: quarantining a phone-chrome failure on Safari engine would hide a defect, not a flake. tests/flake-ledger.json is for REPRODUCED flakes, requires @quarantine in the test title, and expires every entry within 31 days — and it is currently empty by design. NOT FIXED 2026-09-18. WHY IT WAS NOT DONE: the failures are only visible by running Firefox and WebKit, and browser provisioning fails in this environment — scripts/setup-claude-cloud.sh browsers returns 403, no allowlist entry for cdn.playwright.dev. A substitute Chromium exists at /opt/pw-browsers and playwright.config.ts honours PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH, so Chromium work is possible here; the other two engines are not. Sizing this needs a machine that can run all three. Note also that this is the one thing keeping main red, so it will be the first failure the new red-main reporting (#T82ND3) raises. Historical note only: an earlier 2026-09-06 write-up used a 15-failure count and treated the whole set as deterministic geometry differences to loosen; that count and that blanket remedy are superseded by this update and must not be reapplied. | Release matrix review | 2026-09-07 |
-| #Z3GZ5P <!-- issue-ulid:01M1XS1N1YZ3GZ5PDNEACPWDY8 --> | P2 | task | DSM-5-TR specifier catalogue has no clinician sign-off: 585 items, 71 signed off in PR #3143, 514 still pending review | 71 specifiers signed off in PR #3143; pending review dropped from 585 to 514. PRIOR DETAIL (restored 2026-10-09, an earlier update replaced it wholesale): UPDATE 2026-09-25 (offline traversal of data/specifiers-content.json; no provider access). Two corrections to this row's own headline, both reproducible from the committed file. FIRST: '71 source-verified' overstates the work. 57 of the 71 restate their own label, matching 'For <disorder>, "<label>" uses the stated threshold: <the label's own parenthesis>' — the Adjustment Disorders entry for 'Acute (less than 6 months)' resolves to 'uses the stated threshold: less than 6 months'. Only 14 carry content beyond the label, all in the ICD-11 trauma, dissociative, ARFID and personality material. Real coverage is 14 of 585, not 71. SECOND: neurodevelopmental, schizophrenia spectrum, bipolar, depressive and anxiety disorders hold 192 items and no definitions between them, so the commonest presentations are the least covered. SETTLED 2026-09-18 (owner instruction): the sign-off value is clinician-reviewed-approved, set only by a named clinician; the unit of work is one definition per specifier plus per-disorder exception notes; severity and remission for sexual dysfunctions and paraphilic disorders (41 of 164 undefined severity items) are out of scope. PR #3028 made the audit recognise clinician-reviewed-approved — under the previous exact-match test the first signed specifier would have gone unexamined. WORKLIST AND FIRST ENTRY, both on main from PR #2879: docs/specifier-definition-worklist-2026-09-18.md (A/B/C triage; Group A is 63 management-changing rows carrying only 17 distinct labels) and docs/specifier-entry-worksheet-with-catatonia.md (all nine disorders enumerated, every clinical statement blank). NEXT ACTION is clinician-only: write the four blanks in section 1 of the worksheet. No agent writes the clinical text. | PR #3143 review | 2026-09-07 |
+| #9Z197J <!-- issue-ulid:01M1XFVVAZ9Z197J7AAJJEP4C7 --> | P2 | issue | release-browser-matrix Firefox/WebKit failures: WebKit now runs in CI and its ~26 failures are down to intermittent timing races (2026-10-12); confirm the next main run, and the job is not in PR required so it never blocks a merge | UPDATE 2026-10-12 (read from main CI job logs via the GitHub MCP; WebKit cannot run in the cloud container): WebKit/Safari now launches in CI (PR #3487) and the ~26 genuine Safari failures it exposed were fixed test-side in small PRs #3492-#3494 and #3501-#3504, with no test skipped, quarantined or loosened. Main run 38300091965 (after #3503) had every Firefox, WebKit desktop, phone and tablet shard green except ONE installed-app (mobile-pwa-standalone) failure, the DSM category facet keyboard test, fixed in #3504. PATTERN: the last three failures were the same race, a keypress or fill straight after navigation before React attached the handler, which slower WebKit runners expose intermittently. Use expectHydrated (tests/playwright-settlement.ts) or the handler poll in tests/ui-clinical-ask.spec.ts before the first interaction after load. NEXT: read the release-browser-matrix jobs of the first main run after #3504; if all green, close this row. A new single failure of the same shape is the same race in another test, not an app bug. The two Firefox items in #33346A did not fail in runs 38291430591 or 38300091965 (Firefox 3/3 green both times); re-check before working that row. PRIOR DETAIL: Failure count substantially reduced by layout tolerance and settled-click repairs; main-failure-routing active. PRIOR DETAIL (restored 2026-10-09, an earlier update replaced it wholesale): UPDATE 2026-09-25 from the owner-supplied Ultimate Audit Master Report (audit F10), not reproduced offline: the WebKit phone-chrome failures include header overlay, composer visibility, scroll animation and narrow settings geometry, with one settings position measured at -140 px. Audit recommendation: audit the shared scroll controller, safe-area geometry and scroll-container ownership rather than per-test fixes. The audit duplicate-<main> finding (F08) is already resolved as the hidden streaming clone (#TWS2GD); the Specifiers mobile Axe failure and the Differentials ChunkLoadError are separate rows queued the same day. PRIOR DETAIL: UPDATE 2026-09-20 (six Firefox failures read from the job log of main run 35503893104; four now addressed, two open; no Firefox was run - see the egress row). THE COUNT AND THE CLASSIFICATION IN THIS ROW WERE BOTH WRONG. Firefox failed SIX, not five, and only THREE were tolerance, not five. FIXED AND MERGED (PR #2932): three sub-pixel artefacts - a 16px card gap measured 15.999969482421875, a 12px column gap measured 11.999954223632812, and a 48px tap target measured 47.98333740234375 against its existing 2px allowance. The first two are float error from subtracting two client rects; the third is Firefox storing layout in app units of 1/60 CSS px, so 47.98333740234375 is exactly 2879/60 - one app unit short, the smallest miss the engine can express. tests/helpers/layout-tolerance.ts holds one 0.05px tolerance, mutation-tested from both sides. No floor lowered, nothing skipped or quarantined. FIXED, MERGED as PR #2933 at 0cfdd250e on 2026-09-20, verified as an ancestor of this reconciliation - originally recorded as AWAITING MERGE because the request was queued before it landed: the fourth, ui-on-call-boards dark mode, was TEST ORDERING and not an app bug. It set the colour-scheme override while the page was still on about:blank, and Playwright Firefox does not carry that into the first navigation; the theme is resolved once pre-paint by the bootstrap in src/lib/theme.ts, so a late preference is already missed. PROOF IT IS NOT THE APP: the twelve dark assertions in ui-caring-contacts-workspace.spec.ts PASS on Firefox in this same run (tests 48, 53, 59, 65, 72, 79, 85, 100, 138, 152, 159, 169) and every one navigates first and switches scheme after. An earlier reading blamed color-scheme: light on :root and concluded dark mode was broken for every Firefox and Safari user; those twelve passes refute it. Do not reopen the design-system dark contract on this evidence. STILL OPEN: the remaining two Firefox failures are tracked separately - see the row for the document-viewer hit counter and the tools Forms panel. The eight WebKit failures are UNCHANGED and still unexamined; the six phone-chrome ones remain the likely-real-iPhone-bug reading recorded above. UPDATE 2026-09-20 (read from the GitHub job logs of the latest main release-browser-matrix run; still no local browser run, provisioning fails here as described below). THE COUNT IS 13, NOT 15: Chromium green in ~8 min; Firefox 700 passed / 5 failed in ~28 min; WebKit 696 passed / 8 failed in ~40 min. THE 2026-09-06 CONCLUSION IS HALF WRONG AND THE CORRECTION IS THE POINT OF THIS UPDATE. The Firefox half is tolerance work as recorded — one failure is provably a measurement artefact, Expected >= 12 / Received 11.999954223632812, a sub-pixel rounding difference and nothing more. THE WEBKIT HALF IS NOT. Six of the eight WebKit failures are phone scroll, header, footer and composer behaviour. WebKit is Safari engine, so on an iPhone those are candidate real user-visible bugs, not engine-geometry tolerance, and must be read as a bug report rather than assertion-loosening work. ORDER: fix the five Firefox tolerances first because they are cheap and provably artefacts, then treat the six WebKit phone-chrome failures as a defect investigation, and do that before the tablet row #6GR6B8 because the two are plausibly the same root cause. QUARANTINING IS STILL THE WRONG ANSWER, and more so now: quarantining a phone-chrome failure on Safari engine would hide a defect, not a flake. tests/flake-ledger.json is for REPRODUCED flakes, requires @quarantine in the test title, and expires every entry within 31 days — and it is currently empty by design. NOT FIXED 2026-09-18. WHY IT WAS NOT DONE: the failures are only visible by running Firefox and WebKit, and browser provisioning fails in this environment — scripts/setup-claude-cloud.sh browsers returns 403, no allowlist entry for cdn.playwright.dev. A substitute Chromium exists at /opt/pw-browsers and playwright.config.ts honours PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH, so Chromium work is possible here; the other two engines are not. Sizing this needs a machine that can run all three. Note also that this is the one thing keeping main red, so it will be the first failure the new red-main reporting (#T82ND3) raises. Historical note only: an earlier 2026-09-06 write-up used a 15-failure count and treated the whole set as deterministic geometry differences to loosen; that count and that blanket remedy are superseded by this update and must not be reapplied. | Release matrix review | 2026-09-07 |
+| #Z3GZ5P <!-- issue-ulid:01M1XS1N1YZ3GZ5PDNEACPWDY8 --> | P2 | task | DSM-5-TR specifier catalogue: 514 of 585 items still pending clinician review, and the 71 marked reviewed in PR #3143 name no clinician reviewer | 71 specifiers signed off in PR #3143; pending review dropped from 585 to 514. PRIOR DETAIL (restored 2026-10-09, an earlier update replaced it wholesale): UPDATE 2026-09-25 (offline traversal of data/specifiers-content.json; no provider access). Two corrections to this row's own headline, both reproducible from the committed file. FIRST: '71 source-verified' overstates the work. 57 of the 71 restate their own label, matching 'For <disorder>, "<label>" uses the stated threshold: <the label's own parenthesis>' — the Adjustment Disorders entry for 'Acute (less than 6 months)' resolves to 'uses the stated threshold: less than 6 months'. Only 14 carry content beyond the label, all in the ICD-11 trauma, dissociative, ARFID and personality material. Real coverage is 14 of 585, not 71. SECOND: neurodevelopmental, schizophrenia spectrum, bipolar, depressive and anxiety disorders hold 192 items and no definitions between them, so the commonest presentations are the least covered. SETTLED 2026-09-18 (owner instruction): the sign-off value is clinician-reviewed-approved, set only by a named clinician; the unit of work is one definition per specifier plus per-disorder exception notes; severity and remission for sexual dysfunctions and paraphilic disorders (41 of 164 undefined severity items) are out of scope. PR #3028 made the audit recognise clinician-reviewed-approved — under the previous exact-match test the first signed specifier would have gone unexamined. WORKLIST AND FIRST ENTRY, both on main from PR #2879: docs/specifier-definition-worklist-2026-09-18.md (A/B/C triage; Group A is 63 management-changing rows carrying only 17 distinct labels) and docs/specifier-entry-worksheet-with-catatonia.md (all nine disorders enumerated, every clinical statement blank). NEXT ACTION is clinician-only: write the four blanks in section 1 of the worksheet. No agent writes the clinical text. | PR #3143 review | 2026-09-07 |
 | #K06J63 <!-- issue-ulid:01M1XP1FE7K06J63XSYVBS40HA --> | P2 | issue | PR required failed repeatedly on a UI-only branch with no cause ever identified | NO FIX IS POSSIBLE UNTIL IT RECURS, and PR #2884 (merged 2026-09-18) adds the one runbook line that makes the next occurrence readable: unlock the CI log marker FIRST, then read the failing job. The reason this row has no diagnosis is that the failing job was never read — log access was locked at the time, and it still is in this environment (the artifact host and results receiver both return Forbidden through the egress proxy, and check-run annotations carry only 'Process completed with exit code 1'). SEPARATELY WORTH KNOWING, because it explains most sightings of this shape: a PR required failure whose child jobs all read 'cancelled' rather than 'failed' is the cancel-in-progress behaviour working as designed — a newer push superseded the run — not a test result. That was observed repeatedly on 2026-09-18 across five PRs. Check the child job conclusions before treating a PR required failure as real. | docs/branch-review-records + session 331c4d4d | 2026-09-07 |
 | #VMG7D8 <!-- issue-ulid:01M1XMVVBHVMG7D8T4KN1HCQ0R --> | P2 | issue | The differentials export leaves 194 of 201 records with an empty section summary, and at least one carries another diagnosis's content | REVIEW 2026-09-25 (offline audit of current main; no provider access): Counts re-run on the unchanged snapshot match (150, 110, 91, 194). The lithium part is handled in-app (generatedBodyUnreliable / withholdGeneratedBody on every read path). The export step lives upstream of scripts/import-differentials-export.ts, which reads a zip on the owner's Windows machine: the same blocker as #N9XFVN and #HNJF5X. PRIOR DETAIL: Measured over all 201 records in data/differentials-snapshot.json during the 2026-09-06 session: 150 carry NO investigations, 110 carry NO immediate actions, 194 have at least one EMPTY section summary, and 55 of the 91 records that do have "immediate actions" carry statements rather than actions. Worse than sparse in at least one case: lithium-physiological-withdrawal-tremor is titled "Lithium" with a tremor subtitle, but its clinicalHinge is the definition of AKATHISIA, its four immediateActions are statements about akathisia, drug-induced parkinsonism and tardive syndromes rather than actions, and its related nodes are the EPS family rather than tremor differentials. That is another diagnosis's content presented under this one. WHY THIS IS P2 AND NOT P1: the detail page now degrades honestly around it. Every panel added in PR #2665 renders only when it has content, so a sparse record produces a sparse page rather than a confident-looking empty one; buildDiscriminators derives a row only from data the catalogue actually carries and leaves the cell blank rather than echoing the other column; and the one known-mismatched record shows a content note saying its generated sections mix material from other diagnoses. Nothing fabricates. WHAT REMAINS: the overlay in src/lib/differential-curated.ts treats symptoms one record at a time and does not scale - repairing the generator that produced 194 records with an empty section summary is a data-pipeline job, and no row owned it before this one. NEXT: find the export/generation step behind data/differentials-snapshot.json, establish whether the empty sections are a source-content gap or a mapping bug in the exporter, and fix at that layer. The per-record counts above are the measurement to re-run afterwards - a fix should move them materially, and the lithium record specifically should stop carrying akathisia content. STOP: do not paper over further records by seeding differential-curated.ts; that overlay exists for correction and high-yield enrichment, not as a substitute for a working export, and every seeded record adds clinical content that needs its own sign-off (see the authored-records row). | Claude Code session 2026-09-06 (session_01GMHX5TDG34BBn2yDdi81s5), measured across data/differentials-snapshot.json while building PR #2665 | 2026-09-07 |
-| #CHPC5C <!-- issue-ulid:01M1XRS8BHCHPC5CF8NY75663V --> | P3 | issue | ui-tools differentials compare queue navigation is intermittently slow enough to time out inside the full Production UI shard 3 | UPDATE 2026-09-27: FIX BUILT on branch claude/repo-review-design-fixes-ao0dqw (PR #3145), NOT YET MERGED — close this row only after it lands. The 'way out' below was built: claimPhoneOverlayAddonReserve (use-phone-overlay-chrome-reserve.ts) is called by both portals and writes --phone-overlay-chrome-h inline as calc(<value in force> + <row>px) before settle, re-measures after settle, and subtracts the row on release. A production-build trace found a second cause: under reduced motion every element gets a 0.01ms transition and transition-property defaults to all, so the pad painted the stale padding-top for one frame; globals.css now sets transition-property: none on mobile-composer-reserve-pad at phone width. The required Playwright settle assertion was added (#CHPC5C test in tests/ui-phone-scroll.spec.ts): 10/10 pass on a production build, fails on the pre-fix portals. verify:full green (20027 tests); the full verify:phone-chrome run was stopped by the owner at ~342/687 and is left to CI. PREVIOUS: CAUSE FOUND AND PROVEN 2026-09-20; NO LONGER PARKED. This is not a flaky test — it catches a real phone defect that also hits clinicians. The Differentials mode-nav row (49px) paints IN page flow, then ModeNavHeaderPortal moves it into the fixed phone header at ~315ms; content loses that height and every element rises 49px. usePhoneOverlayChromeReserve only republishes the measured 121px at ~423ms, so for ~110ms the whole page sits 49px too high. A press that straddles that correction lands on one control and releases on another: recorded trace shows pointerdown on the compare-open link at y 492-540, pointerup at the identical y hitting "Edit selection" because the link had moved to 443-491, and the browser retargeting the click to their common ancestor. The link never activates — no error, no navigation. scrollY is 0 throughout, so this is layout, not scrolling, and Playwright hit-target checks cannot see it because press and release were each individually on a real element. EVIDENCE: 0/41 reproductions through the repo runner (10x alone, 10x under 4 busy loops, 20x under 12, plus a full shard) — shard load is not the right kind of slowness. Under Chrome DevTools renderer throttling: 0/10 at 4x, 10/10 at 10x, 9/10 at 20x, and 0/10 at 10x when the phone chrome is allowed to settle first. That last row is the control. TWO CORRECTIONS TO THIS ROW. (1) It is the PHONE click that fails, not the desktop one. tests/ui-tools.spec.ts:2928 is the test declaration; the test contains two compare-open clicks, and the URL CI recorded has no q=Pain, which matches the 390x844 phone block. Above the phone breakpoint the reserve publishes 0px and no addon row mounts, so desktop is not exposed. (2) The TO-UNBLOCK suggestion in this row does not work and is refuted: the destination "Loading presentation" role=status skeleton cannot be the settle signal, because it lives inside the destination route and only renders AFTER the URL commits. Proven by holding the destination response 20s — urlChangedAfterMs 20130, loadingSkeletonSeenAfterMs null. The "racing an unhydrated link" hypothesis is the right family but the wrong mechanism: the link is a plain next/link anchor from a Server Component, so a pre-hydration click would still navigate natively. The race is hydration-driven LAYOUT, not handlers. STILL OPEN AFTER PR #2929 — READ THIS BEFORE CLOSING THE ROW. PR #2929 (publishPhoneOverlayChromeReserveNow, called from both portals) closes this only for IN-SESSION navigation, and NOT for the cold page.goto the trace above was taken on, which is the path CI fails on. The publisher refuses to act until the reserve hook has settled a value at least once — it must, because before that responsive layout can still report the wide 200px stack (#147) and publishing that would move content twice. React runs layout effects children-first and the hook belongs to the shell, so on a cold load a portal effect ALWAYS runs before the hook has settled and the immediate publish is suppressed, every time. Established by adversarial review of #2929 and independently reproduced; pinned as failing-when-fixed cases in tests/phone-overlay-reserve-portal-wiring.dom.test.tsx, which is also the only coverage of the portals wiring at all — every case in tests/phone-overlay-chrome-reserve.dom.test.ts calls the publisher directly and would pass with both useLayoutEffect blocks deleted. A second gap: unmounting a portal does not shrink the reserve, so content sits 49px too LOW instead; a cleanup cannot simply publish, because React runs layout-effect destroys before it detaches portal children. THE WAY OUT, not yet built or verified: have the portal publish its OWN height as a delta to the reserve currently in force instead of re-measuring the whole stack. That removes the #147 exposure, and with it the settle precondition, and it gives the shrink direction naturally via the effect cleanup. It is a real change to shared phone chrome on every route and needs its own browser evidence — verify:phone-chrome plus the Playwright settle assertion docs/search-chrome-behaviour.md mandates, which was not added and is still required. OWNER DECISION PENDING on whether to do that work. MERGE VERIFICATION, carried over from the refuted request a13b357d so it is not lost: #2929 merged 2026-09-20 as commit 80cf3df6c69a, and publishPhoneOverlayChromeReserveNow is present on origin/main in globals.css, phone-header-collapse-portal.tsx and use-phone-overlay-chrome-reserve.ts. That request read presence as proof the defect was fixed and told future sessions it MUST NOT BE REDONE; presence is not execution, and the scope limit above is why. It was cancelled with that reasoning recorded. | Claude Code session 2026-09-20 (session_01VE1C4eJidBwMdfHV4nUJgL); reissued against the current row after fbc169da applied; scope limit reproduced in tests/phone-overlay-reserve-portal-wiring.dom.test.tsx (PR #2938) | 2026-09-07 |
 | #2G06NM <!-- issue-ulid:01M1XMW2GY2G06NMEYBWSAC6MH --> | P2 | issue | Five adversarial answer_from_evidence cases produce no written answer offline, and were only passing because the review fallback claimed to be grounded | Surfaced by the #ZK460W fix (branch claude/rag-review-fallback-grounded-flip, 2026-09-07). inj-canary-exfiltration, unsup-causal-upgrade, meta-inflated-similarity, meta-spoofed-governance-status and cost-unbounded-enumeration all carry the normative fixture expectation answer_from_evidence in scripts/fixtures/rag-adversarial-cases.v1.json. Offline, with the provider forbidden for these categories, the pipeline has never answered them: the extractive candidate fails its own quality gate and the route degrades to the source-backed review fallback. That fallback used to set grounded true, which satisfied adversarialAssertionFailures' only test for the behaviour, so five cases reported a pass on a flag rather than an answer. With the flag now honest they diverge, and each has a KNOWN_DIVERGENCES entry pinning the observed shape (grounded false, confidence unsupported, tier source_only, modelUsed null, responseMode evidence_gap, exactly the allowed chunk cited, review_only provenance). All safety invariants continue to hold for these cases: no network, round-trip budget, canary absence in telemetry, forbidden substrings. Next: decide per case whether the offline extractive path should be able to answer it at all, or whether the fixture expectation should be degrade_source_only rather than answer_from_evidence. Do not delete the pins without the behaviour change and do not weaken the fixture. RAG-surface change; own PR; RAG impact line; canary pair. | #ZK460W fix, offline adversarial harness run on branch claude/rag-review-fallback-grounded-flip | 2026-09-07 |
-| #458SAC <!-- issue-ulid:01M2GCR00X458SACFXMFZERNY6 --> | P3 | issue | read_site_content_health() still computes the release digest twice (about 3%) | REVIEW 2026-09-25 (offline audit of current main; no provider access): The ~7 s title is out of date: a2f0770bc records a 47% cut and a mean of about 410 ms, and the RPC is deliberately off the readiness path (health-response.ts), so it cannot trip the deploy gate and did not cause the 2026-09-21 deploy stall. Absorbs the residual of closed #08W0F7. PRIOR DETAIL: PARTLY FIXED, measured. Migration 20260918120000_evaluate_bootstrap_digest_once_per_health_read (PR #2886, merged; live-drift green 2026-09-19) removed the larger half. read_site_content_health() compared two stored columns to the SAME freshly computed site_content_bootstrap_digest, evaluating it twice. Counted with track_functions=all in the pinned image: one bootstrap digest costs 164,820 site_content_canonical_json invocations, one release digest 10,969, one dynamic-state digest 3, and ONE health read cost 351,594 before and 186,774 after - a 47 percent reduction, with output byte-identical across all 23 fields and the state-machine fixture passing on both. Live pg_stat_statements over 3d05h also shows the catalogue reader's mean falling from 8,656 ms to roughly 410 ms for post-fix calls. STILL OPEN, and small: site_content_release_digest is evaluated once in the private base and again in the public wrapper - 10,969 invocations, about 3 percent. Folding those two is a subtler equivalence argument than the first and is worth doing only if the probe is still gating deploys after this. | docs/deployment-architecture.md (Readiness section); src/lib/health-response.ts; supabase/migrations/20260913072413_materialize_site_content_health_operational_base.sql | 2026-09-14 |
 | #9V1TJ5 <!-- issue-ulid:01M2JW4Z4A9V1TJ54QF9GQCH08 --> | P3 | issue | Uploaded-local retrieval is fail-closed by design, and nothing connects that decision to the canary cases it keeps red | OWNER DECISION 2026-09-26 (Josh, 'all as recommended' in the project chat): keep uploaded-local retrieval fail-closed for now; turning it on is a separate, larger safety project (P16 generation-bound activation). Canary cases are NOT red because of this: #4WR2XZ's live search found the WA clozapine guidelines scoped public, so do not re-investigate that link. Remaining cleanup only: the app still treats uploaded_local (and international_supplementary, fail-closed by migration 20260901130000) as live scopes in src/lib/rag/rag-candidate-sources.ts, rag-governed-search.ts, source-conflict-section.ts and rag-reviewed-policy-input.ts while match_governed_candidate_chunks_v3 returns nothing for them; making app and database agree is a RAG-surface change needing the usual flag and canary. DO NOT route around the fail-closed migration. | Claude Code session 2026-09-15 (session_01Fj3ue1Dv89wSgzZWVQ6v3L), offline read of supabase/schema.sql and supabase/migrations/20260901120100; PR #2803 review round | 2026-09-15 |
 | #4DFNHJ <!-- issue-ulid:01M2MR66DN4DFNHJ36JHSPKJJ9 --> | P2 | issue | Six corrected ledger sources were reset to unverified and need a fresh owner review, not a re-attestation | REVIEW 2026-09-25 (offline audit of current main; no provider access): PR #2815 (5b1a8cf8f) reset all six to validationStatus unverified; only two records in src/data/source-acquisitions.json are still locally_reviewed, and they are other Chief Psychiatrist sources. The six now sit in the Sources sign-off queue as ordinary candidates. PRIOR DETAIL: IMPLEMENTED 2026-09-16 by commit 2f7072e43: the six publisher-page corrections (RANZCP mood guideline documentStatus outdated; five Chief Psychiatrist guidelines publicationDate 2015-12-01 and version December 2025 revision) are applied. Residual only: all six remain validationStatus locally_reviewed from the owner's 2026-09-06 sign-off, which predates the corrections, so each still needs owner re-attestation rather than another agent edit. CORRECTION to the original claim that wrong publication dates overstated Currency by about ten years: Currency is scored from documentStatus alone in src/lib/sources/catalogue-core.ts; publicationDate contributes only a boolean to traceability. Measured: the five Chief Psychiatrist guidelines score 91 band A both before and after; only the RANZCP documentStatus change moved a score (band A to B, 89 to 74). Verify with npm run check:source-acquisitions. | PsychSift Therapy Claude cloud handover session, 2026-09-16; narrowed for Codex P2 on #2817 | 2026-09-16 |
-| #V3E3BV <!-- issue-ulid:01M2MR6GADV3E3BVJJH8C5J7GW --> | P2 | task | 15 of 16 candidate clinical sources reviewed in PR #3143, none adopted yet, so 47 Therapy records still cite nothing | 15 candidate sources reviewed to locally_reviewed in PR #3143; 47 therapies still need citations adopted. PRIOR DETAIL (restored 2026-10-09, an earlier update replaced it wholesale): Commit 88dd7aaea registered 23 reconciled Therapy sources in src/data/source-acquisitions.json, taking the ledger from 8 to 31. Sixteen are disposition candidate with validationStatus unverified: 14 NICE guidelines at rung 5, one RANZCP president's update at rung 3, and therapy-wa-aboriginal-impact-policy (WA Aboriginal Health Impact Statement and Declaration Policy). Publication dates and current status were re-read from each publisher's own page on 2026-09-16 and all matched the handover; nine NICE guidelines are filed review_due because the publisher's most recent date for them is over five years old. Nothing is adopted, so no Therapy record may cite any of them yet. This is the gate on the 47 records that currently have null references and null evidenceNotes. Distinct from #SBKXZ7, which tracks clinician sign-off of the 205 therapy records themselves rather than source adoption. Seven further sources were recorded as rejections with the reason each would need resolved before re-capture; five are blocked because the publisher prints an update date but no publication date. Next action: owner reviews the 16 candidates and decides adoption. npm run check:source-acquisitions lists them under 'Awaiting clinical sign-off'. | PR #3143 review | 2026-09-16 |
+| #V3E3BV <!-- issue-ulid:01M2MR6GADV3E3BVJJH8C5J7GW --> | P2 | task | 15 of 16 candidate clinical sources reviewed in PR #3143, none adopted yet, so 47 Therapy records still cite nothing | UPDATE 2026-10-10: eight of the candidates (NICE CG178, CG185, NG222, CG113, CG115, CG78, NG225, NG87) are now cited in free text by 22 Therapy records (PR #3398), each citation followed by a note that the source is not yet adopted. Their register entries still read as uncited; that text is hash-attested, so refresh it in the same change that adopts them rather than editing it alone. NEXT (owner): adopt the reviewed NICE records you stand behind. PRIOR DETAIL: 15 candidate sources reviewed to locally_reviewed in PR #3143; 47 therapies still need citations adopted. PRIOR DETAIL (restored 2026-10-09, an earlier update replaced it wholesale): Commit 88dd7aaea registered 23 reconciled Therapy sources in src/data/source-acquisitions.json, taking the ledger from 8 to 31. Sixteen are disposition candidate with validationStatus unverified: 14 NICE guidelines at rung 5, one RANZCP president's update at rung 3, and therapy-wa-aboriginal-impact-policy (WA Aboriginal Health Impact Statement and Declaration Policy). Publication dates and current status were re-read from each publisher's own page on 2026-09-16 and all matched the handover; nine NICE guidelines are filed review_due because the publisher's most recent date for them is over five years old. Nothing is adopted, so no Therapy record may cite any of them yet. This is the gate on the 47 records that currently have null references and null evidenceNotes. Distinct from #SBKXZ7, which tracks clinician sign-off of the 205 therapy records themselves rather than source adoption. Seven further sources were recorded as rejections with the reason each would need resolved before re-capture; five are blocked because the publisher prints an update date but no publication date. Next action: owner reviews the 16 candidates and decides adoption. npm run check:source-acquisitions lists them under 'Awaiting clinical sign-off'. | session 2026-10-10 /ledger sweep, PR #3398 (merged 2026-10-09 as 6f9203d55) | 2026-09-16 |
 | #WY625D <!-- issue-ulid:01M2MTYZ0YWY625D8YN1AS21XM --> | P2 | task | Dictionary sources still missing a publication date: 9 after PR #3067 (row opened at 21) | 17 dictionary sources now have dates; only 9 sources still lack dates (PR #3067). PRIOR DETAIL (restored 2026-10-09, an earlier update replaced it wholesale): UPDATE 2026-09-26 (owner decisions relayed via the coordinator, 'yes to all five'; offline, no provider access; PR #3067): Owner approved recording a publisher's 'last updated' stamp as its own date (lastUpdatedDate, dateModel last_updated), never as a publication or review date. Five more sources admitted as unverified candidates on their own stamps: AIHW-NASS-2026, AIHW-SUICIDE-2026, WA-MHAS, WA-MHERL, WA-OCP-MHA. Counts now 26 admitted, 32 held. RCH-MSE-2024 stays held (rch.org.au not governed; jurisdiction not in register form). Moved documents: WA-MHC-FORM-LIST found at a new MHC address (undated), health-mental-rights found as the November 2012 statement; nsw-mse-handbook is no longer hosted and is recommended for retirement. PRIOR DETAIL: UPDATE 2026-09-26 (owner-approved page reads from the cloud session, no provider access): All 21 date-needing sources plus the two held for unreadable pages were read. Three now have a stated date and are admitted as unverified candidates: NSW-ACI-SCI ('Publication date 2021-08-30', 'Version: 1'), nsw-mental-assessment ('Published: December 2023') and APA-BIPOLAR (physician review 'April 2024', continuously updated). Held 40 -> 37. Four now have a date but stay held on GOVERNED_SOURCE_HOSTS, which the owner declined to widen: AADPA-ADHD (First Edition, released October 2022), ACSQHC-MED-2024 (Publication Year 2024), WA-HSP-ACRONYMS-2026 (published September 2023), WA-AHD-2026 (last reviewed 01-08-2022). WA-PSOLIS-HSS gives only an update stamp. Three URLs no longer serve the document (WA-MHC-FORM-LIST-2022, health-mental-rights, nsw-mse-handbook). WA-ABORIGINAL-TITLES-2026 states two conflicting 'as at' dates. AMHOCN, Columbia, DIVA, the three NACCHO pages, ASSIST Plus and COPE state no visible date (metadata timestamps were not used). Per-source findings are in dictionary-source-dispositions.json. NEXT: owner decisions on host policy and an update-date event; find current URLs for the three moved documents. PRIOR DETAIL: RECHECKED 2026-09-25: no dates added. The cloud session's network egress refuses every publisher host (wa.gov.au, mhc.wa.gov.au, aihw.gov.au, ruah.org.au, youthfocus.com.au, passages.org.au, healthdirect.gov.au and others all returned connect_rejected on 2026-09-25), and the sources skill forbids taking a publisher, date or contact detail from anywhere but the publisher's own page, so this cannot be done from a cloud session. TO UNBLOCK: run it from an unrestricted network, for example a Remote Control session on the owner's PC, or have the owner approve each page fetch. Never infer a date from a search summary. PRIOR DETAIL: REVIEW 2026-09-25 (offline audit of current main; no provider access): Dispositions now show 40 held and 18 admitted (row said 41 held). The 'publisher registered, date still required' blocker applies to 12 sources, not 17. The AIHW premise is stale: PR #2819 (8cdadc445) read the AIHW pages; AIHW-OAT-2026 is admitted, and AOD, NASS and SUICIDE are held because the publisher gives only an update stamp or undated page, not because of a 403. The count of 21 needing a date is correct. PRIOR DETAIL: After the 2026-09-16 register work, 41 of the 58 dictionary-handover sources remain held and the binding constraint is now a date rather than governance. None of the 41 carries a publication or review date in the handover. Seventeen have a publisher that is now registered and need only a date read from the publisher's own page. Four AIHW pages (alcohol and other drug treatment glossary, suicide and self-harm monitoring glossary, ambulance attendances, opioid agonist therapy in the prisons report) returned HTTP 403 to automated fetch; AIHW is registered and ledger-eligible, so a release date is the only thing missing for all four. A WA Health PDF and the national recovery framework also need a browser read. Per-source blockers and next actions are in src/data/dictionary-source-dispositions.json. | PR #3067 review | 2026-09-16 |
-| #6X06YS <!-- issue-ulid:01M2MSJY9Q6X06YSV30566X5Z7 --> | P2 | task | Three curated WA services remain unwritten: MHAS, Zonta House and SARC counselling | 2 written in PR #3067; only 3 remain unwritten (MHAS, Zonta House, SARC counselling). PRIOR DETAIL (restored 2026-10-09, an earlier update replaced it wholesale): UPDATE 2026-09-26 (owner decisions relayed via the coordinator, 'yes to all five'; offline, no provider access; PR #3067): Owner approved registering Ruah and the Mental Health Advocacy Service. Ruah Engagement Hub written as SVC-HOU-003 and the Mental Health Law Centre as SVC-LEG-003, matching the legacy 'Ruah specialist legal services' entry so it is replaced rather than duplicated. Both pending the owner's clinical sign-off. PRIOR DETAIL: UPDATE 2026-09-26 (owner-approved page reads from the cloud session, no provider access): Links Court Program written (SVC-LEG-002, new part-09.ts) from the North Metropolitan Health Service forensic services page ('Page Last Updated: 04/08/2026'): Perth Children's Court, ages 10 to 18, (08) 9218 4819; hours not stated. Legal Yarn already exists (SVC-LEG-001, PR #3019). Ruah MHLC adjudication: Ruah's own page says the Mental Health Law Centre 'merged with Ruah in 2019' and is Ruah's mental health legal service, so it is the same organisation as the legacy 'Ruah specialist legal services' entry: update and rename that entry, do not add a second record. Ruah Engagement Hub page read (247 James Street Northbridge, 13 7824, 8.30am-2pm Mon-Fri, over-20s, drop-in, last modified 2025-05-07) but NOT written: Ruah is not in the source authority register, and the #3019 convention registers each service issuer first (owner decision, retrieval-ranking surface). NEXT: owner decision to register Ruah (catalogue identity only), then write the Engagement Hub and rename the legal-services entry. PRIOR DETAIL: RECHECKED 2026-09-25 on main 2c787a506: Ruah Engagement Hub, Links Court Program and Legal Yarn are still absent (Passages and Youth Focus tracked in #YDENFM), and the Ruah Mental Health Law Centre adjudication is still open. The cloud session's network egress refuses every publisher host (wa.gov.au, mhc.wa.gov.au, aihw.gov.au, ruah.org.au, youthfocus.com.au, passages.org.au, healthdirect.gov.au and others all returned connect_rejected on 2026-09-25), and the sources skill forbids taking a publisher, date or contact detail from anywhere but the publisher's own page, so this cannot be done from a cloud session. TO UNBLOCK: run it from an unrestricted network, for example a Remote Control session on the owner's PC, or have the owner approve each page fetch. PRIOR DETAIL: REVIEW 2026-09-25 (offline audit of current main; no provider access): Five of the original ten were added in PR #2814 (c68c6ff41, part-05.ts): KEMH Mother Baby Unit, PCH Eating Disorders Service, PCH Gender Diversity Service, MHC My Services directory, Bunbury MHOA (held as planned). Still absent: Ruah Engagement Hub, Links Court Program, Legal Yarn, and Passages Perth, Passages Peel and Youth Focus (see #YDENFM). The Ruah Mental Health Law Centre adjudication is still open. PRIOR DETAIL: The 2026-09-14 Services handover package holds 88 curated records. Reconciled against the repository on 2026-09-16: 15 already existed as canonical records, 22 are genuinely new, and the remaining 50 are updates to records already held. Twelve of the 22 are now written on branch claude/relaxed-lamport-nkowqs. The ten still to write are Ruah Engagement Hub, the Mental Health Commission My Services online directory, Links Court Program, Legal Yarn, PCH Eating Disorders Service, PCH Gender Diversity Service, Bunbury Regional Hospital Mental Health Observation Area, the KEMH Mother Baby Unit (which is a split of the existing conflated S115 record), plus Passages Perth, Passages Peel and Youth Focus, which are blocked on the publisher-registration decision. Two need adjudication before writing: PCH Gender Diversity Service against the existing Gender Pathways Service under NMHS YouthLink, and Ruah Mental Health Law Centre against the existing Ruah specialist legal services entry, which is probably a rename rather than a new record. NEXT: write the unblocked records in one batch so a single bootstrap refresh covers every addition rather than one per batch. The package's own crosswalk file is unusable for this: it never read the repository, so it marks all 88 as do-not-auto-insert, and its first record is corrupted, carrying the entire guide text in its name field. | PR #3067 review | 2026-09-16 |
+| #6X06YS <!-- issue-ulid:01M2MSJY9Q6X06YSV30566X5Z7 --> | P2 | task | Two curated WA services remain unwritten (MHAS, Zonta House), and SARC counselling may already be covered | NOTE 2026-10-09 (PR #3403 review): the canonical SARC record SVC-SV-001 already covers counselling (its best use and hours list crisis counselling and counselling appointments). Check whether a separate SARC counselling record is still needed before writing one, otherwise only MHAS and Zonta House remain. 2 written in PR #3067; only 3 remain unwritten (MHAS, Zonta House, SARC counselling). PRIOR DETAIL (restored 2026-10-09, an earlier update replaced it wholesale): UPDATE 2026-09-26 (owner decisions relayed via the coordinator, 'yes to all five'; offline, no provider access; PR #3067): Owner approved registering Ruah and the Mental Health Advocacy Service. Ruah Engagement Hub written as SVC-HOU-003 and the Mental Health Law Centre as SVC-LEG-003, matching the legacy 'Ruah specialist legal services' entry so it is replaced rather than duplicated. Both pending the owner's clinical sign-off. PRIOR DETAIL: UPDATE 2026-09-26 (owner-approved page reads from the cloud session, no provider access): Links Court Program written (SVC-LEG-002, new part-09.ts) from the North Metropolitan Health Service forensic services page ('Page Last Updated: 04/08/2026'): Perth Children's Court, ages 10 to 18, (08) 9218 4819; hours not stated. Legal Yarn already exists (SVC-LEG-001, PR #3019). Ruah MHLC adjudication: Ruah's own page says the Mental Health Law Centre 'merged with Ruah in 2019' and is Ruah's mental health legal service, so it is the same organisation as the legacy 'Ruah specialist legal services' entry: update and rename that entry, do not add a second record. Ruah Engagement Hub page read (247 James Street Northbridge, 13 7824, 8.30am-2pm Mon-Fri, over-20s, drop-in, last modified 2025-05-07) but NOT written: Ruah is not in the source authority register, and the #3019 convention registers each service issuer first (owner decision, retrieval-ranking surface). NEXT: owner decision to register Ruah (catalogue identity only), then write the Engagement Hub and rename the legal-services entry. PRIOR DETAIL: RECHECKED 2026-09-25 on main 2c787a506: Ruah Engagement Hub, Links Court Program and Legal Yarn are still absent (Passages and Youth Focus tracked in #YDENFM), and the Ruah Mental Health Law Centre adjudication is still open. The cloud session's network egress refuses every publisher host (wa.gov.au, mhc.wa.gov.au, aihw.gov.au, ruah.org.au, youthfocus.com.au, passages.org.au, healthdirect.gov.au and others all returned connect_rejected on 2026-09-25), and the sources skill forbids taking a publisher, date or contact detail from anywhere but the publisher's own page, so this cannot be done from a cloud session. TO UNBLOCK: run it from an unrestricted network, for example a Remote Control session on the owner's PC, or have the owner approve each page fetch. PRIOR DETAIL: REVIEW 2026-09-25 (offline audit of current main; no provider access): Five of the original ten were added in PR #2814 (c68c6ff41, part-05.ts): KEMH Mother Baby Unit, PCH Eating Disorders Service, PCH Gender Diversity Service, MHC My Services directory, Bunbury MHOA (held as planned). Still absent: Ruah Engagement Hub, Links Court Program, Legal Yarn, and Passages Perth, Passages Peel and Youth Focus (see #YDENFM). The Ruah Mental Health Law Centre adjudication is still open. PRIOR DETAIL: The 2026-09-14 Services handover package holds 88 curated records. Reconciled against the repository on 2026-09-16: 15 already existed as canonical records, 22 are genuinely new, and the remaining 50 are updates to records already held. Twelve of the 22 are now written on branch claude/relaxed-lamport-nkowqs. The ten still to write are Ruah Engagement Hub, the Mental Health Commission My Services online directory, Links Court Program, Legal Yarn, PCH Eating Disorders Service, PCH Gender Diversity Service, Bunbury Regional Hospital Mental Health Observation Area, the KEMH Mother Baby Unit (which is a split of the existing conflated S115 record), plus Passages Perth, Passages Peel and Youth Focus, which are blocked on the publisher-registration decision. Two need adjudication before writing: PCH Gender Diversity Service against the existing Gender Pathways Service under NMHS YouthLink, and Ruah Mental Health Law Centre against the existing Ruah specialist legal services entry, which is probably a rename rather than a new record. NEXT: write the unblocked records in one batch so a single bootstrap refresh covers every addition rather than one per batch. The package's own crosswalk file is unusable for this: it never read the repository, so it marks all 88 as do-not-auto-insert, and its first record is corrupted, carrying the entire guide text in its name field. | PR #3067 review | 2026-09-16 |
 | #N9XFVN <!-- issue-ulid:01M2MRG1VYN9XFVNBNV3JV666P --> | P3 | rec | Re-import the differentials corpus once the fixed export parser can read the source zip | UPDATE 2026-09-25 (offline): the offline option (apply scope inside loadDifferentialSnapshot) was evaluated and NOT done. The format-only pin would allow it, but that loader also feeds buildDefaultDifferentialRows, so every one of the 201 diagnosis payloads would change on the next differentials:seed or publication, widening the #H6HPTF lithium republish from one record to all of them. It also needs the scope code moved out of differentials.ts to avoid an import cycle. Do it deliberately, after or together with the #H6HPTF republish, not as a side effect. The workstation re-import commands are unchanged. PRIOR DETAIL: REVIEW 2026-09-25 (offline audit of current main; no provider access): Absorbs closed #DF1DFT: the committed snapshot's rows are unscoped at rest, and the re-import writes scope into it. New option: the pin in tests/site-content-publication-route.test.ts now checks shape only, so applying scope inside loadDifferentialSnapshot may be possible without the workstation. The 'byte-for-byte' comment at differentials.ts:79-83 is stale. PRIOR DETAIL: scripts/lib/parse-differentials-export.ts now emits presentation scope directly (commit 4628295f5), but the committed data/differentials-snapshot.json predates it and cannot be regenerated in a cloud session: scripts/import-differentials-export.ts reads a Windows workstation path (C:/Users/joshs/AppData/Local/Temp/differentials-data.zip). Until then withPresentationScope() in src/lib/differentials.ts derives the same labels at load time, which keeps the app correct but means the file and the runtime describe the record differently. Next action: re-run npm-equivalent 'node scripts/run-tsx.mjs scripts/import-differentials-export.ts --zip=<path> --write' on the workstation, confirm the emitted scope matches the derivation, then consider retiring the derivation. PARKED 2026-09-18: the import script reads a zip at a Windows workstation path that exists only on the owner's machine, so no cloud session can regenerate the snapshot. The app stays correct meanwhile because withPresentationScope() derives the same labels at load time. TO UNBLOCK: run the import on the workstation with the zip, confirm the emitted scope matches the derivation, then consider retiring the derivation. | PsychSift Differentials handover reconciliation 2026-09-16 | 2026-09-16 |
 | #YDENFM <!-- issue-ulid:01M2MSJ01SYDENFMMPBTN1N0MS --> | P2 | task | Write the Passages, Youth Focus and related WA service records now that their publishers are registered | UPDATE 2026-09-26 (owner decisions relayed via the coordinator, 'yes to all five'; offline, no provider access; PR #3067): Owner approved registering St Vincent de Paul Society (WA) and Youth Focus and governing vinnies.org.au and youthfocus.com.au. Passages Perth (SVC-YTH-017), Passages Peel (SVC-YTH-018) and Youth Focus (SVC-YTH-019) written from the operators' own pages; pending the owner's clinical sign-off. PRIOR DETAIL: UPDATE 2026-09-26 (owner-approved page reads from the cloud session, no provider access): Still blocked, and the earlier 'publisher blocker removed' note was incomplete. The City of Vincent Passages page (vincent.wa.gov.au/community/your-community/youth/passages.aspx) now returns 404, and no Department of Communities page describing Passages was found. The operator's own page (vinnies.org.au, St Vincent de Paul Society (WA) Inc) gives Passages Perth (143 Edward St, 08 9228 1478) and Passages Peel (20 Davey St Mandurah, 08 9583 5160), ages 12 to 25, with hours, but states no date; the publisher is not registered and vinnies.org.au is not a governed host. Youth Focus is likewise unregistered and youthfocus.com.au is ungoverned. NEXT: owner decision on registering St Vincent de Paul Society (WA) and Youth Focus and governing their hosts (both are decisions the owner has so far declined or not made), or leave these three unwritten. PRIOR DETAIL: RECHECKED 2026-09-25 on main 2c787a506: still no Passages Perth, Passages Peel or Youth Focus record in src/lib/services-canonical-data/ or source-acquisitions.json. The cloud session's network egress refuses every publisher host (wa.gov.au, mhc.wa.gov.au, aihw.gov.au, ruah.org.au, youthfocus.com.au, passages.org.au, healthdirect.gov.au and others all returned connect_rejected on 2026-09-25), and the sources skill forbids taking a publisher, date or contact detail from anywhere but the publisher's own page, so this cannot be done from a cloud session. TO UNBLOCK: run it from an unrestricted network, for example a Remote Control session on the owner's PC, or have the owner approve each page fetch. PRIOR DETAIL: REVIEW 2026-09-25 (offline audit of current main; no provider access): The publisher blocker is gone: PR #2880 (0bf2488d5) registered them (source-authority-registry.ts, catalogueIdentityOnly). The claim that Passages Youth Engagement Hub and the two others 'now appear in the clinical sign-off queue' is false: no Passages record exists in src/lib/services-canonical-data/ or source-acquisitions.json, and c68c6ff41 says they were deliberately absent. Next action: capture those service records and their sources. Lowered to P2 because nothing is blocked any more. PRIOR DETAIL: BLOCKER REMOVED 2026-09-18 (PR #2880, merged); THE DECISION IS STILL THE OWNER'S, which is why this row stays open. Both publishers the three WA services depend on are now registered in source-authority-registry.ts as named agencies: Department of Communities (WA) and City of Vincent. They are deliberately NOT the 'Government of Western Australia' catch-all an earlier block refused — a catch-all resolves every WA government document to one authority, whereas these two resolve only their own material. Both are catalogueIdentityOnly: true, so they are excluded from runtime retrieval classification and ranking is unchanged. WHAT IS LEFT IS THE OWNER DECISION THIS ROW ASKS FOR: registering a publisher admits no source. Passages Youth Engagement Hub and the two others still enter as unreviewed candidates at D band and cite nothing until signed off. They now appear in the clinical sign-off queue at /mockups/development/clinical-sign-off under Sources, which is where that decision can be worked. | Session work on branch claude/relaxed-lamport-nkowqs, 2026-09-16 | 2026-09-16 |
 | #GJHKYC <!-- issue-ulid:01M2MWJEY9GJHKYCQ0T41B63F8 --> | P1 | task | Do NOT re-index until the worker has deployed the extraction fix, then re-index and run the canary pair around it | UPDATE 2026-09-26 (Railway connector read): the precondition is met. The production worker is running commit f7c9beeaa (deployment 0ac40fc7, SUCCESS 05:30 UTC) and then 2459df42 from 05:44 UTC; both descend from db7432a9b, the PR #2810 extraction fix, and from 103513f2d (PR #3040, unreadable-PDF refusal). Re-index and the canary pair can now start, but need a session with Supabase and OpenAI credentials; this one had neither. PRIOR DETAIL: OWNER DECISION 2026-09-25: re-index and the canary pair are APPROVED, conditional on first confirming the worker running in production includes the PR #2810 extraction fix. Not started: this session had no Supabase/OpenAI/Railway credentials and the Railway MCP was unreachable, so neither the deploy check nor the re-index could be run. PRIOR DETAIL: REVIEW 2026-09-25 (offline audit of current main; no provider access): Canonical re-index row. Absorbs closed #4WR2XZ (cause fixed by PR #2810, db7432a9b) and action 1 of closed #SCYQAE. 'Production still serving a708a95, pre-fix' is stale: db7432a9b is an ancestor of the 2026-09-22 app deploy 76bf29ffa, and later merges touching worker/** and src/lib/** (#2865, #2835, #3002) should have rebuilt the worker. Not verifiable offline, so step 1 (confirm the worker runs the fix) stays. PRIOR DETAIL: SEQUENCING GUARD, written because the obvious next action is wrong if taken today. The extraction fix merged to main as db7432a9b on 2026-09-16. Production was still serving a708a95093c7922163166b7bafc63afd6852bc69 immediately afterwards, which PREDATES the fix (verified via /api/health deploymentCommitSha, uptime 2754 s). RE-INDEXING BEFORE THE INGESTION WORKER CARRIES THE FIX RE-EXTRACTS WITH THE OLD CODE. That achieves nothing, spends provider budget on embeddings, churns the live clinical corpus and produces a false all-clear, because the re-indexed chunks would still carry interleaved table text. ORDER OF OPERATIONS: (1) confirm the worker service, not just the app service, is running a build that contains db7432a9b; the two are separate Railway services in project Database and both auto-deploy from main, so confirm the worker specifically. (2) Run Step 6 of scripts/operator-clozapine-retrieval-diagnosis.sql to get the per-document re-index worklist; it is read-only and its fingerprints were validated against real production text. (3) Capture an eval canary BASELINE before re-indexing. (4) Re-index the worklist documents. (5) Capture the canary POST run. Per AGENTS.md RAG ranking protection the before/after pair belongs around the RE-INDEX, not around the merge, because the merge cannot change any retrieval result until documents are re-ingested; PR #2810 said so explicitly and must not be treated as canary-cleared. (6) Only then expect the four clozapine eval cases to move, and note they may still not pass if the underlying RKPG document is itself wrong, which is its own P1 row. Re-indexing is provider-backed and mutates the live clinical corpus, so it needs explicit owner approval at the time, not standing approval from this session. | Claude Code session 2026-09-16 (session_01Fj3ue1Dv89wSgzZWVQ6v3L), deployment state verified against production /api/health after merging db7432a9b | 2026-09-16 |
@@ -122,7 +117,6 @@ removed after current-main verification; it is not missing recommended work.
 | #3E42FH <!-- issue-ulid:01M2MSJA293E42FH6W3NV64JPX --> | P2 | task | Twelve new WA service records and their three sources await clinical sign-off | 21 of 25 services signed off in PR #3143; only 4 services remain pending. | PR #3143 review | 2026-09-16 |
 | #81A3YJ <!-- issue-ulid:01M2MS3DGS81A3YJQTS5FQ6G9Y --> | P2 | issue | Drift def_hash normaliser strips from any '--' to end of line, hiding 91 percent of the P03 seed function | schema_drift_snapshot() computes a function def_hash as md5 of pg_get_functiondef with block comments, then '--[^\n]*', then all whitespace removed (supabase/migrations/20260706200000_schema_drift_snapshot.sql:89 and the 20260818090000 history-probe rewrite:97). The line-comment regex cannot tell a real comment from '--' inside a string literal. public.site_content_registry_baseline embeds the whole registry seed as a single-line dollar-quoted JSON blob, and the first '--' falls at offset 176107 inside a service URL (Next-Step---Drug-and-Alcohol-Services), so 91.1 percent of the definition - 1841007 normalised chars down to 164524 - is stripped before hashing. Measured, not inferred: replaying both the old and the new function body into a local Postgres 16 produced the identical pinned hash c2dc2183657bab3c994af7f18ddfcb9b even though the bodies differ, and that same replay reproduces the manifest value exactly for the unchanged body, so the control is sound. Consequence: check:drift and the post-merge live-drift workflow cannot see a change to that function's seed data after the first '--'. Every other function loses only genuine comments, which is the intended behaviour. A fix has to distinguish a comment from a literal - dollar-quoted bodies could be hashed unstripped, or the strip applied only outside string literals - and it changes def_hash for every function, so it needs a manifest regeneration in the same change. | scripts/refresh-site-content-p03-baseline.ts | 2026-09-16 |
 | #TNYENC <!-- issue-ulid:01M2NAGY09TNYENCKDDYX9F268 --> | P3 | issue | site_content_registry_baseline on live holds only the 281 frozen baselines, so a record published after 2026-08-24 has no baseline for SQL field merging | REVIEW 2026-09-25 (offline audit of current main; no provider access): No forward migration for site_content_registry_baseline exists after 20260824122000. Matters only once #HTZPQ8 and #ZPHK2F clear, so P3. Under #81A3YJ a seed change here would be invisible to check:drift after the first '--', so do #81A3YJ first. PRIOR DETAIL: site_content_registry_baseline(kind, slug) is an immutable SQL lookup whose blob was frozen into migration 20260824122000 with 281 entries. site_content_registry_source_render calls it for every registry record it renders, so a service or form published after the freeze resolves to a null baseline and loses the forced-field and null merging the frozen records get. PR #2814 tried to fix this by regenerating the applied migration, which cannot reach live and was reverted on 2026-09-16. THE CORRECT MECHANISM is a NEW forward migration carrying create or replace function public.site_content_registry_baseline with the current catalogue blob: the Supabase integration applies new versions, so it reaches live, and it changes only an immutable lookup body with no data write and no lock. It must merge inside an approved Supabase window per AGENTS.md, and it is only worth doing when the publication pipeline is actually going to publish post-freeze records, so it is coupled to the P1 row about the live catalogue still serving the 2026-08-24 freeze. | Session 2026-09-16 repairing the epoch-zero freeze regression from PR #2814 | 2026-09-16 |
-| #KVYHWZ <!-- issue-ulid:01M2MSJK7HKVYHWZCYMXQT8FES --> | P2 | issue | Most of the legacy WA service catalogue carries no source URL or hours yet is marked high confidence | UPDATE 2026-09-26 (owner decisions relayed via the coordinator, 'yes to all five'; offline, no provider access; PR #3067): Women's Domestic Violence Helpline written as SVC-FDV-004, and family-violence urgent routing now lists it first with 1800RESPECT straight after (1800RESPECT leads if the helpline is unusable). Crisis Resolution Home Treatment Team written as SVC-URG-006 (Kadadjiny Marr Koodjal Mia, EMHS page 'Last Updated: 26/11/2025'); YouthLink SVC-YTH-020 and Youth-HITH SVC-YTH-021 written. Kununurra Safe Place (S089) is already covered by SVC-URG-005. Deferred: RAPID (S159/S160 are one service and its page gives no contact or referral route; S160's contacts belong to City East CMHS) and YCATT (three separate services run by NMHS, EMHS and SMHS). Catalogue now 251 records. All new records pending the owner's clinical sign-off. PRIOR DETAIL: UPDATE 2026-09-26 (owner-approved page reads from the cloud session, no provider access): First batch, crisis and urgent lines first. The merged live catalogue has 247 records, 93 with no source URL (57 of them High confidence). Child Protection Central Intake is now a canonical record (SVC-CHP-001) sourced from the Department of Communities child-safety page (last updated 19 May 2026; hours not stated). The Women's Domestic Violence Helpline page was read (24 hours, 1800 007 339, last updated 14 January 2025) and captured in source-acquisitions.json but NOT written as a record: a verified record becomes the first usable family-violence match in service-urgent-routing.ts and displaces 1800RESPECT as the pinned route (services-safety-routing test), which is an owner decision. Next highest-risk unsourced records: Crisis Care and Child Protection Central Intake (S034, a duplicate), Crisis Resolution Home Treatment Team (S035), Kununurra Safe Place (S089), RAPID at RPH (S159/S160), YouthLink (S216), Youth-HITH (S212), YCATT (S210), and the metropolitan CMHS clinics. PRIOR DETAIL: RECHECKED 2026-09-25: no verification batch done. The cloud session's network egress refuses every publisher host (wa.gov.au, mhc.wa.gov.au, aihw.gov.au, ruah.org.au, youthfocus.com.au, passages.org.au, healthdirect.gov.au and others all returned connect_rejected on 2026-09-25), and the sources skill forbids taking a publisher, date or contact detail from anywhere but the publisher's own page, so this cannot be done from a cloud session. TO UNBLOCK: run it from an unrestricted network, for example a Remote Control session on the owner's PC, or have the owner approve each page fetch. Telephone confirmation and sign-off stay with the owner regardless. PRIOR DETAIL: Measured on data/services-snapshot.json, 2026-09-16: of 219 legacy service records, 100 carry no public source URL at all, 98 state no opening hours, and 100 were extracted from an earlier research document without ever being checked against a live page. Despite that, 159 are marked confidence High. Examples with no source link and High confidence: Armadale Community Mental Health Service, Bentley Older Adult, Butler CMHS, Child Protection Central Intake, and the Childbirth and Mental Illness Service at KEMH. The read-time ageing fix on this branch makes the deficiency visible rather than hiding it, because a record with no recorded review now reads as unknown instead of current, but it does not supply the missing evidence. A separate data error found while reconciling: the Mother and Baby Unit record (S115) conflates KEMH and Fiona Stanley into one entry, listing the Fiona Stanley number under a provider field naming both. NEXT: verify in risk order rather than alphabetically, per docs/services-mode-governance.md, taking crisis and urgent contacts first, then common referral routes, then descriptive content. Page checking and record drafting can be done per batch; telephone confirmation and sign-off cannot. | Session work on branch claude/relaxed-lamport-nkowqs, 2026-09-16 | 2026-09-16 |
 | #61GQYY <!-- issue-ulid:01M2N7NYVH61GQYYTNFBK6H4F9 --> | P2 | task | Formulation: 41 handover sources stay held, each with a named blocker | Publishers resolved for CCI, Phoenix Australia, and Monash in PR #2880; 34 sources held with named blockers. | PR #2880 review | 2026-09-16 |
 | #BPPRG2 <!-- issue-ulid:01M2N5ASXZBPPRG2KFVG2RN39N --> | P3 | rec | Sentry source maps remain unuploaded, so production stack frames stay minified | REVIEW 2026-09-25 (offline audit of current main; no provider access): Still a deliberate parked operator decision (docs/error-tracking.md). Now also holds the source-map and Railway-variables note moved from #YBJVM7, which is unblocked since PR #2871 merged. PRIOR DETAIL: SENTRY_AUTH_TOKEN, SENTRY_ORG and SENTRY_PROJECT are all absent from the production Database service (confirmed 2026-09-16 via Railway list-variables), so next.config.ts skips withSentryConfig entirely and no maps are uploaded. docs/error-tracking.md already records this as a deliberate operator decision, so this is a standing choice rather than a defect. The fragmentation it caused is now fixed independently: the fingerprint normalises build-volatile chunk filenames and mangled identifiers (tests/error-tracking-fingerprint-stability.test.ts). Supplying the three values would still make frames readable, at the cost of build-time provider coupling; the token needs only project release/sourcemap scope. Revisit if a production fault cannot be diagnosed from route, exception type and the stable frame tail alone. PARKED 2026-09-18: docs/error-tracking.md already records leaving the source maps unuploaded as a deliberate operator decision, and supplying the three values is a provider-backed change to production secrets. The fragmentation this caused was fixed independently by the fingerprint normalisation. TO UNBLOCK: only worth revisiting if a production fault cannot be diagnosed from route, exception type and the stable frame tail; then set SENTRY_AUTH_TOKEN, SENTRY_ORG and SENTRY_PROJECT on the Database service. | 2026-09-16 Sentry/Railway investigation | 2026-09-16 |
 | #TN512M <!-- issue-ulid:01M2QPC3QXTN512MBBWEWHTM8E --> | P1 | issue | Three systems correctly detect production failures and report to nobody: the live monitor, Sentry, and CI on main | UPDATE 2026-09-26: CI ON MAIN CONFIRMED END TO END. The owner confirmed at 10:56Z that main-failure issue #3092 (a real red main, opened 09:45Z) reached his GitHub app Inbox through the owner assignment from PR #3017; #T82ND3 closed on that evidence. The live monitor, eval-canary, live-drift and ingestion-autopilot use the same assign-the-owner path, so the channel is proven, but none of those has yet been seen to fire since #3017. Sentry alert routing is still unaddressed. Close once Sentry routes to the owner (or the owner decides it need not). PRIOR DETAIL: UPDATE 2026-09-25: OWNER DECISION on the channel: phone notifications through the GitHub mobile app. Shipped in PR #3017: live-domain-monitor, CI on main, eval-canary, live-drift and ingestion-autopilot now assign the repository owner (best-effort, the alert still opens if assignment is refused) on open and on update, so every opening and later comment notifies the owner. Close condition unchanged: one real or deliberately triggered failure must be seen to reach the owner's phone. Sentry alert routing is still unaddressed (Sentry MCP was unreachable). PRIOR DETAIL: REVIEW 2026-09-25 (offline audit of current main; no provider access): The close condition now has a negative answer: during the 27-hour production deploy stall on 2026-09-21/22, monitor issue #2973 was opened and updated and nobody acted on it. GitHub-issue routing is proven to fire but not to reach a person. Next action: choose a channel that reaches the owner (phone push, Slack or page). Fact fix: live-monitor routing shipped in #2877 (28dabe0c3), not #2884 (which covered CI on main and eval). The stall's own root cause is tracked separately (inbox add of 2026-09-22); CI on main is #T82ND3. PRIOR DETAIL: TWO OF THE THREE SYSTEMS NOW REPORT, as of 2026-09-18. (1) LIVE MONITOR: live-domain-monitor.yml had no failure handling at all — a grep for issue, notify or any conditional step returned nothing, which is why a real catalogue outage went unreported for about eighteen hours. PR #2884 (merged) gave it the eval-canary failure-issue step. (2) SENTRY: PR #2890 (merged) fixed log delivery across Next's bundle split, so application logs actually reach Sentry rather than being dropped at the boundary. (3) CI ON MAIN is tracked as #T82ND3 and also shipped in #2884. WHAT REMAINS: none of the three has been confirmed against a real production failure — all were verified by workflow tests, not by watching one fire. Dedupe was reviewed (label-based find-or-create, so a flake cannot spawn an issue per run) but likewise not observed under load. Close once a genuine outage has produced a notification someone acted on. | Direct reads of live-domain-monitor run history, Sentry issue list, and ledger #T82ND3; session 01XGpedMgoXWK3U3fn2TWTzR, 2026-09-17. | 2026-09-17 |
@@ -133,93 +127,67 @@ removed after current-main verification; it is not missing recommended work.
 | #E6142T <!-- issue-ulid:01M2R5W5F8E6142TR092JVPGF2 --> | P2 | issue | The PWA update notice may overlap page content on non-answer pages, and the services search mode has no mode-noun stop list | UPDATE 2026-09-25 (PR C, rebuilt on main after PR #3019): Part 1 (PWA update notice overlap) is CLOSED by owner ruling 2026-09-25: leave the notice where it is. Part 2 (services mode nouns in modeSearchWords) REMAINS OPEN and was deliberately not shipped, because on main it has no observable effect: modeSearchWords in src/lib/smart-search-intent.ts is read only by smartSearchContentTerms, which is called only for calculators, factsheets and dictionary (calculator-filters.ts, factsheets-data.ts, dictionary.ts). The services ranker (src/lib/service-ranker.ts) and universal search call smartSearchExpansions, which returns curated rule terms only and never reads modeSearchWords, so adding service/services/pathway(s)/program/referral there changes no services result. It becomes meaningful only if services search starts consuming smartSearchContentTerms (e.g. a required-term filter, which owner decision 18 excluded from PR C). NEXT: close as won't-fix, or keep it parked until such a consumer exists. | PR #2860 working notes; code read of src/app/globals.css:3698-3712 and src/lib/smart-search-intent.ts at origin/main 6f0a3d444; session 01B5auxdz8JsfzSnDezMWz1n, 2026-09-17. | 2026-09-17 |
 | #ES3KTG <!-- issue-ulid:01M2R5TH2HES3KTGGWNZ752BHM --> | P2 | issue | The clozapine coverage gate and the search rewrite disagree on which words mean stop a drug, and one reads the raw query while the other reads the corrected one | REVIEW 2026-09-25 (offline audit of current main; no provider access): Verified. Minor correction: the search rewrite also accepts withheld/withholding/stopped; the real asymmetry is discontinue(d) (rewrite only) versus ceased (gate only). PRIOR DETAIL: MEASURED BY CODE READ 2026-09-17 while verifying the external audit (its finding C6), against origin/main 6f0a3d444. The audit's claim that these paraphrase gaps are 'documented in code' is FALSE and should not be re-checked: grep of src/lib/rag/rag-coverage-gate.ts for phrasing\|wording\|variant\|not exhaustive\|does not match\|intent returns zero hits, and its only header comment records the extraction provenance from rag.ts. The one genuine 'cannot be exhaustive against paraphrase' comment is in rag-routing.ts:289-296 and is about prompt injection, a different subject. TWO CONCRETE ASYMMETRIES, both verified. (1) VOCABULARY. clinical-search.ts:1473 accepts withhold\|cease\|stop AND discontinue\|discontinued; rag-coverage-gate.ts:78 accepts withhold\|withheld\|withholding\|cease\|ceased\|stop\|stopped and NOT discontinue. So 'What FBC threshold should discontinue clozapine?' triggers the search rewrite but falls through the gate's specific branch to the generic hasStructuredThreshold && strongestScore >= 0.58 at :114-116. That exact string is ALREADY a test fixture on the search side (tests/clinical-search.test.ts:164), so the divergence is reachable by a case the repo already knows about. Neither side knows hold, pause, suspend or interrupt. (2) INPUT. The gate tests the RAW query; the rewrite tests correctedQueryText (clinical-search.ts:1467). A typo'd question can therefore be spell-corrected into the rewrite and never reach the gate branch at all. EVAL COVERAGE EXISTS BUT MISSES IT: rag-eval-cases.ts:1516 clozapine-monitoring-paraphrase and :1530 clozapine-typo-acronym-threshold, neither exercising discontinue against the gate. WHY THIS IS NOT IN PR #2860: both files are RAG-ranking protected surfaces. Needs the flag to the owner BEFORE editing, a RAG impact line, and a live eval canary pair (~USD 1-2, provider-backed, owner approval) because widening the gate changes which answers are withheld. NEXT: align the two vocabularies in one change, decide deliberately whether the gate should read the corrected query, and add a discontinue case to the eval pack. STOP: do not widen the gate without the canary - the coverage-gate block's results re-enter the candidate pool at rag.ts:1555, so a change there moves ranking. | Code read of rag-coverage-gate.ts, clinical-search.ts and rag-eval-cases.ts at origin/main 6f0a3d444; verification of the 2026-09-17 external audit; session 01B5auxdz8JsfzSnDezMWz1n. | 2026-09-17 |
 | #YBJVM7 <!-- issue-ulid:01M2QTQJFPYBJVM7T4S8KNABF7 --> | P2 | task | The Sentry Unhandled server request error groups still have no identified cause; PR #2853 makes them diagnosable but does not name the fault | REVIEW 2026-09-25 (offline audit of current main; no provider access): Unblocked: PR #2871 merged 2026-09-18 (4f1994eb5) and the app:///_next route recovery is on main (error-tracking.ts). 'Waits on #2871' and 'do not set those Railway variables until #2871 lands' are stale; the 24-hour Sentry re-read is now due (provider read). The source-map and variables paragraph now lives in #BPPRG2. PRIOR DETAIL: NEXT ACTION, once PR #2853 has deployed and roughly 24h of events have accumulated: re-read Sentry project clinibase-xz/javascript-nextjs and name the faulting code. Expect the 20 open groups sharing the title Unhandled server request error to collapse to one or two with counts that finally mean something. Use the restored capture mechanism (handled vs onunhandledrejection) to tell a crash from a reported error, and the route recovered into the fingerprint to locate it. WHY IT WAS NOT DIAGNOSABLE BEFORE, measured 2026-09-17: 853 of 857 error events in the preceding 30 days carried no route_path tag, so they took the undefined fingerprint branch in privacySafeErrorEvent and Sentry regrouped them on minified frames that change every build; and the scrubber dropped the exception mechanism, so all 857 events reported error.handled 1 regardless of origin. PR #2853 fixed both. NOT BLOCKING but makes frames readable: source-map upload stays inert until an operator sets SENTRY_AUTH_TOKEN, SENTRY_ORG (clinibase-xz) and SENTRY_PROJECT (javascript-nextjs) on the Railway Database service. PR #2853 declared the matching Dockerfile build ARGs, without which those variables would have been a silent no-op. ALREADY EXCLUDED, do not re-investigate: JAVASCRIPT-NEXTJS-2D (4 events, /differentials/diagnoses/[slug], route_type render) is a reader disconnecting during a streaming page render, stack entirely Next internals, not worth acting on. DO NOT RE-FOLLOW the original supplied analysis, which blamed AbortErrors escaping four API routes: that was checked against the code and is wrong, because jsonError returns a Response so onRequestError never fires. One incidental observation worth a glance: every sampled event reported user.geo SG, Singapore. CORRECTED 2026-09-18: the figures above were first recorded as 849 of 853, which was wrong -- 853 was the untagged count, not the population. Re-read from Sentry as two separate aggregates rather than one derived figure: event.type:error returns 857 and event.type:error !has:route_path returns 853. STATUS CHANGE, also 2026-09-18: PR #2853 was squash-merged at the commit before its final push, so the fixes this row depends on are NOT all on main. Three adversarial reviews found four defects in it, and PR #2871 restores them. Two matter to this row. First, main recovers the route by matching only the /app/.next spelling, so setting the three Sentry build variables would make the SDK DistDirRewriteFrames integration rewrite every frame to app:///_next and collapse the whole application into one unrouted bucket -- worse than the splintering being fixed. DO NOT set those Railway variables until #2871 lands. Second, route-group directories such as (search-app) are kept in the recovered pattern where captureRequestError own tag omits them, so a page fault still splits into two groups. The NEXT ACTION above therefore waits on #2871 deploying, not #2853. | 2026-09-17 Sentry triage session; PR #2853 | 2026-09-17 |
-| #4W704K <!-- issue-ulid:01M2P2QFGQ4W704K34MD30SX6G --> | P3 | issue | site_content_release_records_immutable is not 'enable always', so session_replication_role = replica bypasses the freeze's only structural protection | REVIEW 2026-09-25 (offline audit of current main; no provider access): Two of three gaps closed by 20260916190000_seal_bootstrap_release_and_drop_per_read_digest.sql (#2855: enable-always insert/truncate triggers, per-read digest removed). Remaining: the one-line enable-always promotion of site_content_release_records_immutable, deliberately left out of that migration. The sequencing advice is moot. PRIOR DETAIL: READ FROM THE SCHEMA ON 2026-09-16, NOT EXPLOITED OR TESTED. supabase/schema.sql:12722-12724 creates site_content_release_records_immutable as an ordinary row trigger (before update or delete ... execute function guard_site_content_immutable_row). PostgreSQL does not fire an ordinary trigger when session_replication_role = 'replica', so a session that sets that GUC can UPDATE or DELETE rows of the frozen epoch-zero release with nothing raising. That is not a theoretical technique in this repository: scripts/check-site-content-control-plane.mjs:889-894 uses exactly it against a sibling table. TWO FURTHER GAPS IN THE SAME SEAL: the trigger covers only UPDATE and DELETE, so nothing prevents a row being INSERTED into a retained bootstrap release (it need only satisfy site_content_release_records_check1), and TRUNCATE is a statement-level event a row trigger never sees. Until the catalogue read-latency migration lands, the per-read bootstrap digest recomputation is the only thing that detects an inserted row, and it detects it after the fact — see docs/audit/2026-09-16-catalogue-read-latency.md. HOW MUCH THIS MATTERS, stated honestly: setting session_replication_role needs the same superuser or postgres privilege an attacker would need to write the rows anyway, and such an attacker could equally replace the digest function. So the value here is against ACCIDENT — a half-applied migration, a bad replay, a partial restore, or a script that sets the GUC for an unrelated reason and then touches this table — not against a determined adversary. THE FIX: 'alter table public.site_content_release_records enable always trigger site_content_release_records_immutable', plus an 'enable always' before-insert trigger restricted to the retained bootstrap release ids and an 'enable always' before-truncate statement trigger. All transactional, no index build. SEQUENCE IT WITH the read-latency migration, which needs the same seal to justify removing the per-read digest; doing it separately means doing the same CREATE TRIGGER lock twice. GATE: SQL, so it ships as a new forward migration and needs an approved merge window. RUN check:site-content-control-plane in Docker FIRST — its own fixtures rely on session_replication_role on a sibling table, and an 'enable always' trigger on this one must be proven not to break them before merging. | docs/audit/2026-09-16-catalogue-read-latency.md; Claude Code session 2026-09-16 (session_01GJHMbC4s2S2n8aChAxVF1D), catalogue read-latency investigation | 2026-09-16 |
 | #GCB0DV <!-- issue-ulid:01M2T8FKPFGCB0DVMDYG2X1TKK --> | P2 | issue | Answer mode re-confirmed slow on the live site by the owner, and still nothing measures it | UPDATE 2026-09-26: the owner-approved timing probe has now run. Do not run it again. The result is recorded in #T9PRB9: for 'What FBC threshold should stop clozapine?', search took 9.2 s of 11.9 s on the server (database lookups 4.2 s plus re-ranking 4.1 s), the rate-limit check took 1.4 s, and generation recorded 0.0 s. So neither branch below applies as written: the first lever is search and re-ranking, not generation (#231/#100) or delivery (#016). Next action is #T9PRB9's: check why generation recorded 0.0 s, then repeat with 3-5 queries before tuning. PRIOR DETAIL: OWNER APPROVED 2026-09-26 (Josh, 'all as recommended'): one run of 'node scripts/probe-answer-timing.mjs --allow-provider' (a few cents of OpenAI credit). It cannot run from a Claude cloud session: the egress proxy refuses psychiatry.tools (CONNECT 403, checked 2026-09-26), so it must run from the owner's computer in Perth, which is also the measurement that matters. If generation dominates, the work is #231 and #100 Phase 2; if first byte dominates, it is delivery and #016. PRIOR DETAIL: owner reported 2026-09-18 15-45 s to something readable on every question. PRs #2849/#2855 fixed only the catalogue read path, not /api/answer. Production is not stale; catalogue latency is fixed. Last figures on file: retrieval ~1 s fast / ~6.7 s hybrid, generation ~19 s (#231); delivery is structurally uncached (layout headers()/cookies(), page connection(), no CDN, sw.js network-only navigations); app declared in Railway Singapore with Supabase in Sydney (145-340 ms round trip), live region unverified. Do not raise answerRouteBudgetMs and do not weaken a clinical gate. | Owner report 2026-09-18; four agent investigations of the answer path, telemetry, wait UI and hosting | 2026-09-18 |
 | #GQR7DE <!-- issue-ulid:01M2P2Q02BGQR7DE5Z48476ZKN --> | P3 | issue | site_content_canonical_json is recursive plpgsql, so release activation will slow the same way the read path did once a release exceeds a couple of thousand records | REVIEW 2026-09-25 (offline audit of current main; no provider access): The row's own action is 'nothing yet', so P3. site_content_canonical_json is untouched. PRIOR DETAIL: READ FROM THE SQL ON 2026-09-16, NOT MEASURED. site_content_canonical_json (supabase/schema.sql:12746) is a recursive plpgsql function: one invocation per JSON node, and a string_agg subquery over jsonb_each or jsonb_array_elements at every container. It defines EVERY fingerprint in the site-content control plane — release digest, contentHash, publicationVersion, governance and lineage hashes, plan and receipt identities — and is reimplemented in JS and pinned by tests/site-content-p03-baseline.test.ts, so it cannot be rewritten without invalidating stored digests across the live database. Measured proxy for its cost: the 843-record epoch-zero freeze canonicalises to 9,522,923 bytes across 164,820 JSON nodes (55,103 containers), i.e. ~165k plpgsql invocations and ~55k planned aggregate subqueries per pass, and two such passes per HTTP request cost about four seconds against live — see docs/audit/2026-09-16-catalogue-read-latency.md. The read path is being fixed by removing the calls. The WRITE path cannot be: site_content_dynamic_state_digest, site_content_release_digest, stage_site_content_sync_event, activate_site_content_release and rollback_site_content_release all canonicalise the full release by design and must keep doing so. Today that is tolerable because activation is rare and operator-driven. It scales linearly in node count, so a release of 2,000+ records makes activation slow in exactly the same way, and an activation that exceeds its statement timeout fails a publication rather than a page view. WHAT TO DO: nothing yet — this is a recorded scaling limit, not a defect. BEFORE the catalogue grows materially past the freeze, time one activation against a realistic release on a local Postgres (npm run check:site-content-control-plane already replays the control plane in Docker) and record the node-count-to-seconds curve, so the ceiling is known before an operator hits it mid-publication. DO NOT rewrite site_content_canonical_json to a set-based or C-backed equivalent as a performance fix: any byte-level difference changes every stored fingerprint, and a C extension cannot be installed by migration on Supabase. | docs/audit/2026-09-16-catalogue-read-latency.md; Claude Code session 2026-09-16 (session_01GJHMbC4s2S2n8aChAxVF1D), catalogue read-latency investigation | 2026-09-16 |
-| #HNJF5X <!-- issue-ulid:01M2TPJCX5HNJF5XAC54MATHAJ --> | P3 | issue | Three differential presentation workflows carry an id identical to a diagnosis slug, so any surface keying both families on one identifier silently drops three records | REVIEW 2026-09-25 (offline audit of current main; no provider access): Reproduced (31 presentations + 201 diagnoses, three collisions: substance-intoxication, substance-withdrawal, depression). Guard test in place and the row itself says no surface loses records today, so P3. PRIOR DETAIL: GUARDED 2026-09-19 in PR #2920, naming decision deferred by the owner. tests/differential-identifier-collisions.test.ts lists substance-intoxication, substance-withdrawal and depression as a documented baseline, pins per-family uniqueness, pins the flattened arithmetic (232 total, 229 distinct) so the loss is measured rather than described, and fails on a FOURTH collision with a message saying not to widen the baseline. The real fix stays in scripts/import-differentials-export.ts, which cannot run outside the owner's Windows machine (DEFAULT_ZIP at line 8 is a hardcoded local path). Also established: no surface loses records today -- sign-off-queue.ts is the only consumer that flattens both families and it already namespaces its keys. | Found and independently reproduced during the 2026-09-18 outstanding-issues session; workaround shipped in PR #2883 | 2026-09-18 |
-| #CBEVBS <!-- issue-ulid:01M2ZHJ7JBCBEVBSJ7Z960YA3K --> | P2 | issue | No dedicated tablet Playwright project, so full-suite tablet coverage is missing even though some targeted tablet checks already exist | Add one tablet Chromium project (e.g. 820x1180) to the main production-journey matrix, or explicitly expand the existing targeted tablet blocks into the journeys that matter. Why: playwright.config.ts has chromium, chromium-mockups, chromium-caring-contacts-seeded, firefox, webkit, mobile-webkit and mobile-pwa-standalone — and no dedicated tablet project between phone and desktop, so there is no automatic full-suite tablet run. This is NOT 'every tablet defect is found only by hand and none can be pinned': tests/ui-overlap.spec.ts already defines an 820×1180 block specifically because there is no tablet project, and tests/ui-smoke.spec.ts plus other production journeys already exercise explicit tablet viewports. The real gap is lack of automatic full-suite tablet coverage, not total absence of tablet regression hooks. Context: structural gap behind #6GR6B8 and #EKB6XR; verified by grep (zero 'tablet' in playwright.config.ts) plus the existing targeted viewport tests above. Owner: assistant. Confidence: high. Depends on: #6GR6B8, #EKB6XR. | session 2026-09-20 /ledger sweep — nine-agent repo maturity review | 2026-09-20 |
 | #QVVS6W <!-- issue-ulid:01M2ZHJ750QVVS6WX5AYF21BNA --> | P2 | issue | Disaster recovery has never been rehearsed at the data layer — only the schema replay has been tested | Run one real restore-to-a-new-project drill and record the wall-clock time and what was lost. Why: docs/disaster-recovery-runbook.md states plainly that only the schema layer was rehearsed (2026-07-07, ~19s local container replay) and that the platform restore plus golden retrieval eval has never been executed — so 'we have backups' is currently an untested claim on the live clinical corpus. Distinct from #1K6T35, which is the accepted ~24h recovery-point decision, not whether a restore works at all. Owner: user + operator (provider-backed). Confidence: high — the runbook says so itself. Depends on: #1K6T35 context. | session 2026-09-20 /ledger sweep — nine-agent repo maturity review | 2026-09-20 |
 | #HYSWAF <!-- issue-ulid:01M2ZHJ6KBHYSWAF428YRDR93K --> | P1 | issue | Railway deploys every main push without waiting for the required checks, so a red commit can be serving psychiatry.tools | OWNER DECISION 2026-09-25: turn Railway 'wait for CI' ON, but only once it cannot freeze deploys. Order: (1) fix or remove from the main-push gate the Firefox/WebKit release-browser-matrix failures (#9Z197J), or confirm Railway can wait on pr-required alone; (2) the owner then enables it on the app and worker services. Until then the essential pre-merge checks remain the safeguard. The owner still has to read the actual setting in the Railway dashboard. PRIOR DETAIL: REVIEW 2026-09-25 (offline audit of current main; no provider access): Kept at P1 deliberately. Still unverified from the repo (the setting is not in railway.app.json); docs/deployment-architecture.md recorded source.checkSuites false on 2026-09-22 for a preview instance, not production. Counter-argument considered: pr-required already gates merges. But #T82ND3 shows CI on main red after merge on six of eight pushes, which is exactly the case this row covers. Trade-off to weigh: Wait-for-CI makes every deploy wait on the full run and flaky jobs, and pairs with the 2026-09-21 deploy stall. PRIOR DETAIL: Configure a Railway deployment gate on the app and worker services so they wait for pr-required to succeed on the main push. Why: the deploy and the post-merge CI run are two independent reactions to the same push, so 'CI passed' and 'what is live is tested' are different claims. Context: repo maturity review 2026-09-19; inferred from docs/deployment-architecture.md §6 (auto-deploy from main, rollback is a manual redeploy after the fact), NOT from a direct read of Railway settings. Owner: user (Railway dashboard, not code). Confidence: medium — the absence of a gate is inferred from docs; verify in the dashboard first. Depends on: nothing. | session 2026-09-20 /ledger sweep — nine-agent repo maturity review | 2026-09-20 |
 | #QKW3KN <!-- issue-ulid:01M2ZHJ7RQQKW3KNEYCT602EXN --> | P2 | task | rag-extractive-answer.ts is now the largest file in the repo at 5268 lines and is not on the monoliths backlog | Add it to docs/maturity-backlog-workorders.md section X3 as a fourth tracked monolith and extract the isSourceBound* predicate cluster first. Why: it grew ~30% in under three weeks (4042 lines at the 2026-09-02 audit) while all three tracked monoliths shrank, so the one file getting worse is the one nothing is watching. It also carries 10 narrowly-scoped isSourceBound* query predicates, a pattern that adds a bespoke function per answer-quality bug rather than generalising. Owner: assistant. Confidence: high - line counts verified 2026-09-20. Depends on: nothing. NOTE CORRECTED 2026-09-20 after a Codex review on PR #2930 caught the original wording overstating the contract. RAG-ranking surface, and the two requirements are NOT the same trigger: the flag-it-first rule applies to EVERY edit here, including a rename or a comment (AGENTS.md 'RAG ranking protection' -> 'Flag it'), but the live eval-canary before/after pair is required only when retrieval, ranking or ordering BEHAVIOUR changes ('Canary for behaviour'). The extraction proposed above is behaviour-preserving, so on its own it needs the flag and not the canary. This distinction is load-bearing rather than pedantic: canary dispatches are provider-backed (~USD 1-2) and need the owner's explicit approval each time, so stating the canary as unconditional would either stall this work behind an approval it does not need or spend money to prove nothing moved. If an extraction does turn out to alter ordering, the canary requirement applies in full and the clamped-score and comparator-key contracts still hold. | session 2026-09-20 /ledger sweep — nine-agent repo maturity review; note corrected after Codex review on PR #2930 | 2026-09-20 |
-| #JQ3KY7 <!-- issue-ulid:01M2ZM46TYJQ3KY7TBS6AHW7RX --> | P2 | task | The #CCZ4HB automated-review decision fired its own re-open trigger on 2026-09-19 and AGENTS.md still records only the old decision | The owner decision of 2026-08-22 (#CCZ4HB, AGENTS.md 'Automated review coverage', full text in docs/agents/pull-request-workflow.md) accepted intermittent bot review on a stated condition: 'Re-open only if the Codex connector also stops reviewing, or if the owner revisits the billing decision.' On 2026-09-19 that condition fired - all three reviewers declined on the same day: CodeRabbit on a categorical under-10-stars eligibility gate (not fixable by a cap raise), Codex on 'reached your Codex usage limits for code reviews', Bugbot on 'usage limit reached'. Three PRs merged that day with no automated review: #2901 (a clinical governance record), #2903, #2921. PR #2922 was the re-opened answer and added .github/workflows/claude-review.yml, but deliberately left AGENTS.md alone on the grounds that rewriting a recorded owner decision is the owner's to make, not a side effect of a workflow change; its Notes section promised this ledger request instead. NOTE the coupling: that workflow does not currently work (separate P1 issue, same date), so the re-opened answer is not yet actually providing coverage. Codex's quota reset overnight and it reviewed both #2922 and #2923, finding nothing on the latter - so 2026-09-19 was three outages coinciding rather than a permanent state, which is the argument for redundancy rather than against it. | PR #2922 Notes; AGENTS.md 'Automated review coverage'; 2026-09-19 reviewer outage | 2026-09-20 |
-| #9VQVRT <!-- issue-ulid:01M2ZHJ6RQ9VQVRT1WE83M8J03 --> | P2 | issue | Draft PRs show a green PR-required gate while twelve heavy CI jobs stay skipped, so draft status is easy to misread as merge-ready | Improve draft-status visibility (UI/docs/bot messaging) so a green draft is never treated as a full readiness signal. Why: .github/workflows/ci.yml still skips twelve heavy jobs while github.event.pull_request.draft == true (static-heavy, coverage, build, Production UI, Production UI critical, Ward Flow, Lighthouse and more), so draft 'PR required' is weaker than it looks. This is NOT a merge hole: pull_request triggers include ready_for_review, and undrafting re-runs the full workflow before the change can reach main (see .github/workflows/ci.yml ready_for_review trigger and the comment that undrafting re-runs full CI). Do not change standing draft policy or narrow the skip list to 'close' a nonexistent merge path — fix operator/assistant messaging instead. Context: PR #2909 sat as a draft with zero browser coverage; npm run plan:browser already names the draft case. Owner: assistant (messaging) / user (policy if desired). Confidence: high — draft skip verified by grep; ready_for_review re-run path verified in ci.yml. Depends on: nothing. | session 2026-09-20 /ledger sweep — nine-agent repo maturity review | 2026-09-20 |
-| #383YXX <!-- issue-ulid:01M2ZHJ7C1383YXXSXHG9PAX0A --> | P2 | issue | Lighthouse budget grades the same commit differently at PR time and post-merge, so a required check can fail on code that already passed it | Make the Lighthouse grading deterministic between the PR run and the post-merge run — retry once, or widen the tolerance — so the same SHA cannot get two verdicts. Why: it is a REQUIRED gate, so a non-deterministic answer turns pr-required red on main for changes that were green on the PR, which is part of what trains the team to ignore a red main. Context: two dependency-bump merges (runs 35392321128 and 35384830844) failed pr-required solely on Lighthouse budget post-merge. Owner: assistant. Confidence: medium — the two runs are verified, the determinism mechanism is not yet root-caused. Depends on: #T82ND3. | session 2026-09-20 /ledger sweep — nine-agent repo maturity review | 2026-09-20 |
-| #JMX32A <!-- issue-ulid:01M2ZNXXABJMX32ASS4ANN0W5P --> | P2 | issue | A Playwright run whose own web server fails to start silently reuses another server and reports green | Observed 2026-09-20 while writing tests/ui-patient-number-field.spec.ts. The agent running scripts/run-playwright.mjs had its own webServer fail to start because a concurrent session already held the port; the runner did not stop. It proceeded against THAT other server and reported a green pass. The run was re-done cleanly afterwards and the reported result is sound, but the hazard is not the individual run — it is that a browser gate can report success without ever exercising the tree it claims to test. This is the same class of failure as a gate piped into tail (exit code masked) and as CLINICAL_HAZARD_CONTROLS_PASS printing while a named proof file had been emptied: a signal that cannot fail is worse than no signal, because it is trusted. It matters more here than in most repos because verification evidence is quoted verbatim into PR bodies and the ledger, so a contaminated run propagates as fact. NEXT: make Playwright webServer startup failure fatal rather than falling back to an already-listening port — either set reuseExistingServer:false for CI/agent runs, or have run-playwright.mjs confirm the server it connects to is the one it started (the repo already has /api/local-project-id for exactly this identity question, used by npm run ensure). Add a contract test that a failed server start exits non-zero. Note npm run ensure already solves the adjacent problem correctly and is the pattern to copy. | Claude Code session 2026-09-20 (session_01VE1C4eJidBwMdfHV4nUJgL); reported by the agent that wrote the #WFARS3 browser guard | 2026-09-20 |
-| #33346A <!-- issue-ulid:01M2ZTPSXQ33346AYMPF41R5AR --> | P2 | issue | Two Firefox failures survive the 2026-09-20 triage: the document-viewer hit counter and the tools Forms panel, both a click whose state change never lands | Read the Playwright trace from the failing run BEFORE proposing any fix; playwright.config.ts sets trace: retain-on-failure so it exists, and its After-DOM snapshot of the click answers this in minutes. THE TWO: (1) ui-smoke.spec.ts "search regressions avoid fetch errors and open viewer hits @critical" - after clicking Next document search hit, "Hit 2 of 2" never appears (element NOT FOUND, not hidden); (2) ui-tools.spec.ts "tool links point to the expected in-app modes" - the Forms complementary panel resolves to zero elements, on the 4th of 6 loop passes, while Services with an identical /?mode=<id> href passes. SAME SHAPE, so probably one shared Firefox cause. RULED OUT by two independent agent reads, do not re-derive: text split across elements (Playwright elementText flattens descendants and JSX/SSR comment separators); a collapsed <details> or any CSS cause (a hidden node still matches, and would report hidden not not-found - no stylesheet removes a node from the DOM); scrollIntoView/smooth scroll (suite-wide reducedMotion: reduce makes resolveScrollBehavior return auto); keyboard/focus; a click intercepted by the fixed composer (Playwright's hit-target interceptor blocks and retries, failing AT the click); Forms-specific data or markup (tools-catalog.ts Forms and Services are the same shape, and DetailActions renders the href link unconditionally). LEADING CANDIDATES: for (1), the handler firing zero times or twice - with exactly 2 hits, (i+d+2)%2 returns to 0 either way - with the exclusive-accordion open-attribute fight at source-panels.tsx:1063 as a plausible Gecko-specific trigger; for (2), the panel's hardcoded aria-labelledby id resolving against a hidden duplicate page root (the #093 failure mode visibleByTestId exists for), or the bare focus() at tools-search-results-page.tsx:470 scrolling late. NEITHER IS PROVEN. Why: Why it matters - if the click genuinely no-ops, a Firefox user cannot page through document search hits at all, which is a clinical reading path; if it double-fires it is a harness artefact and the test should assert the active chunk id rather than a modulo-2 counter. Context: Six Firefox failures in main run 35503893104; four fixed in PRs #2932 and #2933, these two left. Parent row #9Z197J. Owner: unknown - depends on what the trace shows. Confidence: high that the cause is shared and not CSS/text-matching; low on any single mechanism. Depends on: the egress row - the trace could not be downloaded from the cloud container. | session 2026-09-20 Firefox failure triage; two parallel agent investigations; main run 35503893104 | 2026-09-20 |
-| #NQH33S <!-- issue-ulid:01M2ZSQPCJNQH33SAW5B3T4TT0 --> | P3 | issue | Local and http-served builds emit https:// absolute URLs that cannot connect | metadata-base.ts:49 defaults the protocol to https when no x-forwarded-proto header is present, so a local build emits https://localhost:<port>/... links failing with ERR_SSL_PROTOCOL_ERROR. This was the ONLY distinct console error across 509 captures of 78 routes. Production behind Railway sets the header and is unaffected; this is a local-development and reverse-proxy-without-the-header concern. | docs/audit/2026-09-20-visual-ux-audit.md (PR #2939) | 2026-09-20 |
-| #Z9NS6H <!-- issue-ulid:01M2ZSQP7DZ9NS6HAPJQ01M8NM --> | P3 | rec | Copy and naming inconsistencies that undercut the product's own safety vocabulary | UPDATE 2026-09-28 (PR #3142): DONE - the Differentials subtitle (ui-copy.ts) now describes differential diagnosis, and uncurated 'Do now' teaching observations render as unnumbered bullets. DONE - refusal framing on the source rail: owner approval 2026-09-28 set the most conservative refusal definition, the UNION of grounded === false, an answerState of 'ungrounded' or 'no_answer', and fallbackReasonCode coverage_gap/no_candidates/low_signal (answerIsRefusal in answer-copy-payload.ts). Both the live (answer-result-surface.tsx) and historical (answer-thread-turn.tsx) answer surfaces pass it to NaturalLanguageAnswer, which drops the in-prose source marks and has AnswerSourceRail title the rows 'Documents searched', show every card with the uncited badge and no Direct/Partial grade, and use the same wording on the compact chip. STILL OPEN: (4) 86 of 374 multi-item diagnosis sections (1,200 sections total) have a summary that is a space-join of their items with no punctuation - clinical wording for a human. | docs/audit/2026-09-20-visual-ux-audit.md (PR #2939) | 2026-09-20 |
-| #8RWKA0 <!-- issue-ulid:01M2ZSQNFN8RWKA0QHH0NN9R2E --> | P2 | issue | Fixed-width and fixed-character-count elements truncate clinical text at every viewport | PARTLY FIXED 2026-09-25: the On Call ward chip is fixed in 626cb241e (min-w-32 max-w-60 instead of w-32, title wraps instead of truncating; pinned by tests/on-call-home.dom.test.tsx). STILL OPEN: services-navigator-page.tsx applies a 150-character compactText cap identically at 320 and 1920; on the 13YARN crisis line the cut lands on 'Immedia...', removing the availability statement (owned by the services/search PR). /on-call/contacts squeezing the name column to two words at 390 was not re-verified. The acamprosate dose clamp was dropped from this row: it is a deliberate <details> disclosure that expands in place. | docs/audit/2026-09-20-visual-ux-audit.md (PR #2939) | 2026-09-20 |
-| #RHGAYP <!-- issue-ulid:01M2ZP1H3PRHGAYPTGWD9YJZAW --> | P2 | issue | A compliance row whose stored details fail their schema is filed under On Call Admin, unlabelled | rowToOnCallEntry (src/lib/on-call/repository.ts) sets details to null when stored details fail the section schema. isComplianceEntry (src/lib/on-call/compliance.ts) then reads entry.details, answers false, and partitionLogisticsEntries puts the row in the Admin list with nothing to say it is a compliance requirement. THE TWO DANGEROUS CONSEQUENCES ARE ALREADY CLOSED and must not be re-reported: the row is not published, because fetchSharedOnCallEntries filters on the RAW row via rowMayBeComplianceRequirement, which fails closed on unreadable details; and a later save no longer destroys the stored details, because of salvageExistingDetails in src/lib/on-call/editor-details.ts. What remains is the misfiling. Closing it means either carrying the raw details alongside the parsed ones on OnCallEntry, or giving isComplianceEntry the raw-row reading that rowMayBeComplianceRequirement already has. Either way a type that every consumer in the mode reads changes, and it changes for a row no editor in this app can produce, because the API validates against the same strict schema on write -- reachable only by a direct database edit, an import, or a row written before the current write path. Deferred on that cost against that benefit. NEXT ACTION: decide whether OnCallEntry should carry raw details at all; if the On Call view refactor lands first, make the decision there rather than as a separate type change. | Session 2026-09-20, On Call Compliance page clinical-governance review | 2026-09-20 |
-| #5Z3CDC <!-- issue-ulid:01M2ZP1HCZ5Z3CDCFWRYBV7DBV --> | P2 | task | The privacy impact assessment omits six subsystems, including Caring Contacts and CME evidence uploads | UPDATE 2026-09-26 (removal PR, branch claude/remove-ward-flow-caring-contacts-ltxdgk; offline, no provider access): Caring Contacts was retired and deleted on 2026-09-26 by the removal PR, so it drops out of this item. The other omitted subsystems (CME evidence uploads and the rest listed below) are unchanged and still need the assessment. PRIOR DETAIL: REVIEW 2026-09-25 (offline audit of current main; no provider access): Still true: docs/privacy-impact-assessment.md has no mention of Caring Contacts, the pocket card, the service worker, the developer hub or site_content. Add a sixth gap: CME private evidence uploads (public.cme_evidence, migration 20260922175023, plus the 2026-09-24 evidence-removal migration). Also correct the line saying On Call compliance rows are cached in localStorage; closed #KJF5J7 stopped that. PRIOR DETAIL: docs/privacy-impact-assessment.md gained an On Call compliance entry (PIA-9) on 2026-09-20, but still does not mention, at all: (1) CARING CONTACTS, a whole patient-data subsystem with its own database (src/lib/caring-contacts/**, src/lib/caring-contacts-server/**, CARING_CONTACTS_DATABASE_URL) -- by far the largest gap and the only patient data in the product; (2) the PRINTED POCKET CARD, the only artefact that physically leaves the app; (3) the SERVICE WORKER caching policy (public/sw.js) and what it retains on the device; (4) the DEVELOPER HUB (src/components/developer-area/**) and what operational data it surfaces; (5) the PUBLIC CATALOGUE surface and its one anon-callable database function, public.read_site_content_public_records, granted to the anon role. Verified absent by grep on 2026-09-20: zero mentions of caring, pocket, service worker, developer hub or site_content anywhere in the document. This is governance documentation rather than an engineering defect -- nothing is leaking -- but the assessment is the artefact an external adviser reads, and as written it understates the data footprint of the product. NEXT ACTION: add one section-2 data-category row per subsystem and, where a residual risk exists, a numbered PIA entry; do Caring Contacts first and do not let the other four hold it up. Escalate the Caring Contacts part to P1 if the production-configuration check finds that workspace enabled in production. | Session 2026-09-20, On Call Compliance page security audit | 2026-09-20 |
 | #PM71Z1 <!-- issue-ulid:01M2ZTQ884PM71Z1546JP1SMVH --> | P2 | task | Three blocked hostnames stop any cloud session running Firefox/WebKit or reading a CI trace, so browser failures can only be reasoned about from logs | Add cdn.playwright.dev, playwright.download.prss.microsoft.com and *.blob.core.windows.net to the Claude Cloud environment's egress allowlist; owner action in the environment settings, no repo change. THE THREE, each verified by a real request, not inferred: the first two are the ONLY mirrors in playwright-core 1.63.0's PLAYWRIGHT_CDN_MIRRORS (the old *.azureedge.net entries were removed in this version, so allowlisting those achieves nothing) and both return 403 request blocked; the third serves GitHub Actions artifacts, and an artifact download redirects there and returns CONNECT tunnel failed 403, which is why a retained Playwright trace cannot be fetched. ALSO CHECKED AND DEAD: ftp/archive/download.mozilla.org, snapcraft, flathub, the mozillateam PPA, codeload, and the npm @playwright/browser-firefox package (a 15KB stub that downloads from the same blocked CDN). A stock apt/tarball Firefox is NOT a substitute at any version - Playwright launches with -juggler-pipe and waits for "Juggler listening to the pipe", which only its own patched build emits - and there is no channel: firefox and no PLAYWRIGHT_FIREFOX_EXECUTABLE_PATH; the repo's PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH is its own invention and Chromium-only. Why: This is the constraint that shaped the whole 2026-09-20 triage. Four Firefox failures were fixed without a single Firefox run, and the dark-mode one was nearly written up as a broken app for every Firefox and Safari user before a cross-check refuted it; the two that remain are stuck precisely because the trace that would settle them is behind the third hostname. Context: Also worth knowing separately - the preinstalled Chromium is 141 (revision 1194) where playwright-core 1.63.0 pins revision 1243 / Chrome 153, so even local Chromium proof is twelve majors behind CI. Owner: Josh - environment settings. Confidence: high; every claim above was checked by running the request or reading node_modules/playwright-core. Depends on: nothing. | session 2026-09-20; agent investigation of browser provisioning; proxy README /root/.ccr/README.md | 2026-09-20 |
-| #HXC4D4 <!-- issue-ulid:01M2ZSQP26HXC4D4E76HBA0F4E --> | P3 | issue | A silent HTTP 400 on long or single-character queries, and a unit-less creatinine range message | PARTLY FIXED 2026-09-25 in eb55cf1a2: (a) use-universal-search.ts now reports a query over 200 characters as a distinct too-long state (no fetch), and a non-OK or network failure as an error that is never cached; aborted requests stay silent. The command surface shows a one-line notice for each (pinned by tests/use-universal-search-stream.dom.test.tsx and tests/universal-search-command-notice.dom.test.tsx). The API route is unchanged. The single-character half was dropped earlier (the client never sends a query under 2 characters). STILL OPEN: (b) the Serum creatinine NumberField rejects 1.02 with 'Enter 15-3000.' - the only numeric field whose range message carries no unit (CrCl says mL/min, QTc says ms). 1.02 is an ordinary mg/dL value and the bound shown is the umol/L one. | docs/audit/2026-09-20-visual-ux-audit.md (PR #2939) | 2026-09-20 |
-| #05WXHX <!-- issue-ulid:01M2ZSQKSX05WXHXF414N0ZZ8V --> | P1 | issue | Medication and therapy records carry zero source links while their footers tell the clinician to check the linked source | UPDATE 2026-09-25: step 1 shipped in PR #3017. The medication footer no longer promises a linked source (it points to current Australian product information or the local guideline); the therapy footer points to the sources named under Source & review status. OWNER DECISION: default source per medication is the TGA Product Information, plus WA guidelines where they exist; engineering proposes, owner confirms, high-risk medicines first (clozapine, lithium, valproate and other anticonvulsants, QTc/overdose-risk drugs). Real links still need the data-model change described below. PRIOR DETAIL: /medications/[slug] has 0 anchors in <main> on all four tabs; /therapy-compass/[slug] the same. Footer on every tab: 'verify every dose and interaction against the linked source'. acamprosate states Max 1998 mg/day, a serum creatinine >120 micromol/L contraindication, Half-life 13-28.4 h and an unattributed EFFICACY: MODERATE tile; the only provenance is one prose sentence on tab 4 below the fold. Root cause: medication-records.ts:118-126 derives governance from a free-text src section with no URL or document id. /dictionary and /factsheets do this correctly. Fixing properly is a database migration plus clinical governance. | docs/audit/2026-09-20-visual-ux-audit.md (PR #2939) | 2026-09-20 |
-| #1RWC0H <!-- issue-ulid:01M2ZP1HGA1RWC0H65TK64BMP7 --> | P2 | issue | Caller IP addresses are stored as unsalted truncated SHA-256 with no retention limit in api_rate_limit_subjects | anonymousApiSubjectKey (src/lib/public-api-access.ts) derives the rate-limit subject as the prefix anon: plus the first 32 hex characters of an unsalted SHA-256 of the trusted proxy IP, and stores it in api_rate_limit_subjects.subject_key. The IPv4 address space is small enough that an unsalted hash of it is brute-forced in seconds, so these rows are PSEUDONYMISED, not anonymised, and should be classified as personal information rather than treated as opaque. Separately, and unlike rag_queries, the table has no purge function and no retention window, so rows persist indefinitely (supabase/migrations/20260704000000_api_rate_limit_subjects.sql enables row level security and grants select/insert/update/delete to service_role only). NOT AN EXPOSURE: RLS is on and only service_role reaches it, so a stranger cannot read it. This is a retention and classification matter, which is why it was deferred rather than fixed on the day. NEXT ACTION: two separable decisions. (a) Replace the bare hash with a keyed HMAC using an environment secret, so the key stops being a reversible IP -- note that rotating that secret resets every live rate-limit window, so it needs a deliberate moment. (b) Ship a retention purge mirroring the rag_queries retention migration (supabase/migrations/20260629060603_rag_queries_retention.sql is the pattern). Both are Supabase migrations, so both are owner-merged and reach the live clinical database within seconds of merge. | Session 2026-09-20, On Call Compliance page security audit | 2026-09-20 |
-| #HWYCPF <!-- issue-ulid:01M2ZSQMQ2HWYCPFAD3JDZJY0J --> | P3 | rec | Toast host is never mounted, so 35 files hand-roll their own 'Copied' confirmation | <ToastProvider> root mounted in layout.tsx in PR #3150; component migration is progressive polish. | PR #3150 review | 2026-09-20 |
+| #05WXHX <!-- issue-ulid:01M2ZSQKSX05WXHXF414N0ZZ8V --> | P1 | issue | Medication and therapy records carry zero source links while their footers tell the clinician to check the linked source | UPDATE 2026-10-10: PR #3398 proposed WA-first sources in src/data/medication-source-links.json: wa-health-clozapine-guideline-2024 for clozapine, and the Australian Prescriber lithium article plus its correction for lithium-carbonate-ir-sr. They render nothing until the owner adopts and signs off those register records. Valproate, other anticonvulsants and QTc-risk drugs still have no proposal. UPDATE 2026-09-25: step 1 shipped in PR #3017. The medication footer no longer promises a linked source (it points to current Australian product information or the local guideline); the therapy footer points to the sources named under Source & review status. OWNER DECISION: default source per medication is the TGA Product Information, plus WA guidelines where they exist; engineering proposes, owner confirms, high-risk medicines first (clozapine, lithium, valproate and other anticonvulsants, QTc/overdose-risk drugs). Real links still need the data-model change described below. PRIOR DETAIL: /medications/[slug] has 0 anchors in <main> on all four tabs; /therapy-compass/[slug] the same. Footer on every tab: 'verify every dose and interaction against the linked source'. acamprosate states Max 1998 mg/day, a serum creatinine >120 micromol/L contraindication, Half-life 13-28.4 h and an unattributed EFFICACY: MODERATE tile; the only provenance is one prose sentence on tab 4 below the fold. Root cause: medication-records.ts:118-126 derives governance from a free-text src section with no URL or document id. /dictionary and /factsheets do this correctly. Fixing properly is a database migration plus clinical governance. | session 2026-10-10 /ledger sweep, PR #3398 (merged 2026-10-09 as 6f9203d55) | 2026-09-20 |
 | #ZPHK2F <!-- issue-ulid:01M2ZWB0JAZPHK2FRCYN41VQM9 --> | P1 | issue | Owner design decision: first publication versus adoption for the site catalogue (blocks #HTZPQ8) | OWNER DECISION 2026-09-25: first publication, not adoption. The 222 owner-scoped service rows and 54 forms go public through the administrator first-publication flow in owner-approved batches, each batch clinically signed off (the 17 newest service records need sign-off before they can publish). Do not relax the reconciliation triage to make adoption pass. Next action: design and build the first-publication path; it touches site_content tables, so any migration follows the Supabase merge-is-deploy rule. PRIOR DETAIL: REVIEW 2026-09-25 (offline audit of current main; no provider access): The 'smaller, separate' part is fixed: a27fc99a9 adds a not_comparable verdict with an honest message and seven tests, and docs/site-content-publication-handover.md section 2.5 warns that steps 2-3 cannot complete. What remains is the owner decision between first publication and adoption. PRIOR DETAIL: WHAT HAPPENS. scripts/build-site-content-reconciliation-plan.ts, run against a fresh operator export (843 records, activeReleaseId e4a1dd29, initialized=false, expected=actual=843), reports: owner rows 222, logical groups 222, published groups 843, groups not published 3, TRIAGE SNAPSHOTS 0, needs owner review 222, adoptable 0, identical duplicates 0. It then refuses, telling the operator that 222 groups diverge from the published snapshot and that choosing between them is a clinical judgement. WHY THAT MESSAGE IS MISLEADING. Nothing diverged. buildRegistryReconciliationReport can only mark a group adoptable when canonicalCandidate returns a candidate, and canonicalCandidate delegates to reconcileCanonicalPublicSiteContent, which requires ALL FOUR of publicationState='published', renderedByPublicSite=true, explicitlyReconciled=true and rowOwnerId=null. Measured on live: clinical_registry_records has 222 service rows and 54 form rows, ALL with a non-null owner_id; site_content_publications has 0 rows; site_content_public_records has 0 rows. So no candidate can satisfy those conditions in this state, no triage snapshot is ever built, and every group falls through to divergent_requires_administrator_review by construction. The count 222-of-222 is an artefact of the state, not a measurement of drift. WHY IT MATTERS. The handover (docs/site-content-publication-handover.md) tells the owner the order is export, then reconciliation plan, then the administrator records it. Step 2 cannot produce output, so the owner would follow the documented order and hit a refusal that blames the corpus. Worse, the refusal is the kind that invites someone to 'fix' it by relaxing the triage, which would mark owner-scoped rows canonical for a clinical publication - exactly the judgement the script exists to refuse. WHAT IS ACTUALLY NEEDED, and it is a design decision rather than a bug fix. The reconciliation/adoption path is built for rows that are ALREADY public and whose identity is settled; it adopts them into the control plane. This corpus has never published anything through the control plane at all - the epoch-zero freeze lives only in site_content_release_records. So the question to settle before any more tooling is whether initial adoption is the right mechanism here, or whether these 222 owner-scoped service rows need a first-publication path that makes them public and unowned through the administrator flow. Do NOT resolve it by loosening reconcileCanonicalPublicSiteContent. SMALLER, SEPARATE: the planner should say what it actually found. A refusal that reports 'triage snapshots 0' alongside 'needs owner review 222' should state that the two together mean nothing was comparable, not that 222 things disagreed. | live read 2026-09-21 of clinical_registry_records, site_content_publications and site_content_public_records, plus a run of scripts/build-site-content-reconciliation-plan.ts against the real export | 2026-09-20 |
 | #WR6FAW <!-- issue-ulid:01M2ZRFAJRWR6FAWA79TE566QG --> | P2 | issue | verify:phone-chrome and verify:ui cannot go green in a cloud sandbox: three failures are the unpinned Chromium, not the code | Established 2026-09-20 by running the three failures against a clean origin/main worktree (aef181f55) with the same environment, and reading the saved failure snapshots. They reproduce identically on main, so they are a property of the sandbox, not of any branch. ROOT CAUSE, found rather than guessed: the only installable browser here is /opt/pw-browsers/chromium = chromium-1194 = Chromium 141.0.7390.37, because cdn.playwright.dev is 403 under the egress policy and the revision Playwright 1.63.0 pins is 1243 / Chromium 153. (1) tests/ui-smoke.spec.ts "document frame stretches the canvas owner at phone and desktop" and "document viewer puts the PDF preview first with pinned evidence after it on mobile" both fail with getByTestId(pdf-canvas-scroll).locator(canvas) "element(s) not found". The error-context snapshot shows the viewer in its error state with the text "this[#re].getOrInsertComputed is not a function" and a Retry preview button. pdfjs-dist@6.3.289 calls Map.prototype.getOrInsertComputed, a V8 addition Chromium 141 does not have, so pdf.js throws during load and no canvas is ever created. The demo PDFs and cover images are all present; nothing is missing from the fixture. (2) tests/ui-pwa.spec.ts "has a browser-valid manifest, installable icons, and a root worker" fails with installability error "in-incognito" — Chromium refusing because every Playwright BrowserContext is off-the-record. Every other assertion in that test (manifest URL, manifest contents, all icon probes, service-worker scope/state/controller) passes first. CONSEQUENCE FOR AGENTS: three failures out of ~798 passing is the FLOOR for a chromium browser gate in this environment, on any branch. Do not read it as a branch signal, and do not "fix" a test to make it pass here. CI runs the pinned browser and the Production UI chromium shards are green on recent main (7936c3f9, cfb5ed90, and shard 3 on aef181f55). NOT ESTABLISHED: per-test CI granularity, because gh run view --log is Forbidden here (results-receiver.actions.githubusercontent.com); only job-level green was read. That Chromium 153 stops reporting in-incognito is an inference from CI being green, not a direct observation. TO UNBLOCK: either allowlist cdn.playwright.dev so the pinned revision installs, or teach the browser gate to recognise this known trio and report them as environment-floor rather than failures. | Claude Code session 2026-09-20 (session_01VE1C4eJidBwMdfHV4nUJgL); reproduced on a clean origin/main worktree with the same runner and environment | 2026-09-20 |
-| #NB4SHF <!-- issue-ulid:01M2ZP1H24NB4SHF2FYWGPMQEW --> | P2 | rec | On Call keeps deciding labels, glyphs, destinations and counts from entry.section, so every view over a section is misrendered -- move the view concept into src/lib | view.ts abstraction layer landed in PR #3139 (c88c56f98d); repo derivation pending. | PR #3139 review | 2026-09-20 |
-| #MFV1Z2 <!-- issue-ulid:01M2ZSQPHBMFV1Z2H76TR0EFHN --> | P3 | issue | next dev is OOM-killed after compiling roughly 55-60 routes in sequence | Reproduced three times at ~13.6 GB RSS in a 16 GB container, each time around the same point in a sequential route sweep; a --max-old-space-size cap did not help. The visual audit had to build and serve production instead. Not a product defect, but it costs anyone doing sustained local work across many routes, and a whole sweep going blank looks like an app failure (the 2026-08-06 audit recorded exactly that misreading). | docs/audit/2026-09-20-visual-ux-audit.md (PR #2939) | 2026-09-20 |
-| #7D21P1 <!-- issue-ulid:01M2ZVSZZ57D21P1E0TQBZTWZK --> | P3 | issue | Two stale statements in docs/codebase-index.md and one missing On Call row in generate-site-map.ts | Found while adding CME, deliberately not fixed there because none is CME's doing. (1) docs/codebase-index.md's mode-homes paragraph says 'Fourteen modes are now consolidated onto the shared home'. On Call has left consolidatedModeHomePaths, so the real count is thirteen. Verifying it properly means auditing every consolidated route, which was not worth widening a seventy-file change for. (2) scripts/generate-site-map.ts's renderModePageIndex() has no On Call row and has not had one since On Call shipped — this is the one site-map input with no gate behind it, which is exactly why it was missed. CME's row was added; On Call's was reported rather than added, as a separate change. (3) Already fixed in #2902 but worth knowing it happened: the 'Modes (16)' id list in codebase-index.md was missing On Call entirely, independent of CME. | PR #2902 task-18 agent report and controller verification against src/lib/search-route-ownership.ts, 2026-09-20 | 2026-09-20 |
 | #VHW8K9 <!-- issue-ulid:01M31F4Y1JVHW8K90VRJ2R0Z0E --> | P3 | issue | Clinical KB: FK / unused indexes only with evidence (no batch-drop) | Index hygiene deferred; evidence-gated only. See docs/supabase-remediation-closeout-notes.md §1.4 (PR #2959). | PR #2959 docs closeout review 2026-09-21 — queue deferred security/DB work into canonical ledger | 2026-09-21 |
-| #GQG3NV <!-- issue-ulid:01M33P8T9XGQG3NV31WKK54QDP --> | P2 | issue | vitest run silently ignores a named-but-missing test file and exits 0, so a gate receipt can name tests that never ran | MEASURED 2026-09-21. 'npx vitest run tests/this-file-does-not-exist.test.ts tests/owner-scope.test.ts' reports 'Tests 9 passed (9)' and exits 0. Two files named, one real, no warning, no non-zero exit. HOW IT BIT: on PR #2974 a commit message claimed 'the committed test that checks both surfaces agree needed no change - verified rather than assumed, by running it', citing 'npx vitest run tests/tenancy-scan.test.ts tests/owner-scope*.test.ts -> Test Files 2 passed, Tests 19 passed'. tests/tenancy-scan.test.ts DOES NOT EXIST; the paired test is tests/api-tenancy-predicates.test.ts and was never loaded. The 19 tests came from owner-scope-guard and owner-scope alone. The conclusion happened to be correct (verified afterwards: api-tenancy-predicates passes with and without the doc row) but the evidence sentence was false, and in this repository gate receipts are quoted verbatim into PR bodies and the review ledger, so a false one propagates as fact. WHY IT IS P2 AND NOT COSMETIC: this is the same class as #JMX32A (a Playwright run whose own web server failed to start silently reused another and reported green) - a signal that cannot fail is worse than no signal, because it is trusted. It is also the class docs/agents/verification-gates.md exists to protect, and AGENTS.md 'Evidence and calibration are never compressed' requires pasting the decisive gate line, which this makes unsafe to trust. NEXT ACTION: 'npm run test:focused -- --files <paths>' is already documented as failing closed for deleted files; the bare 'vitest run <paths>' path has no such guard. Either route agents to the focused wrapper for named-file runs, or add a preflight that errors when a named spec path does not exist. Add a contract test that a named-but-missing spec exits non-zero. Not a RAG, clinical or privacy surface; offline gate only. | PR #2974, 2026-09-21 — measured directly after a false evidence line in commit 6271ca1b3; correction posted at https://github.com/BigSimmo/Database/pull/2974#issuecomment-5763434640 | 2026-09-22 |
-| #P6BSQ3 <!-- issue-ulid:01M31F4Y1FP6BSQ3CHMSHM2K0Q --> | P2 | issue | Clinical KB: indexing-v3-agent JWT/secret dual-gate after PR2/PR3 | Cron invokes every minute with Vault indexing_v3_agent_secret. Harden so JWT and secret are dual-gated after Codex PR2/PR3 land. Operational context: docs/supabase-remediation-closeout-notes.md §1.2 (PR #2959). | PR #2959 docs closeout review 2026-09-21 — queue deferred security/DB work into canonical ledger | 2026-09-21 |
-| #789SD7 <!-- issue-ulid:01M31F4Y1H789SD7DBX940FYMC --> | P2 | issue | Clinical KB: PROXY_AUTH dedicated secret in quiet change window | Introduce a dedicated PROXY_AUTH / signing secret (not on Railway by name today). Quiet change window only. See docs/supabase-remediation-closeout-notes.md §1.5 (PR #2959). | PR #2959 docs closeout review 2026-09-21 — queue deferred security/DB work into canonical ledger | 2026-09-21 |
-| #Z84GK3 <!-- issue-ulid:01M2ZVTEP9Z84GK3REZ1R55FCZ --> | P3 | issue | CME demo corpus has no multi-allocation and no routine-sourced entry, so two real shapes are untested against shared data | All 47 entries in src/lib/cme/demo-year.ts carry exactly one allocation, and none is routine-sourced. Two consequences. (1) The brief's own clipboard test could not run as written — it did .find(e => e.allocations.length > 1)! and would have crashed on undefined; the implementer kept the assertions and pointed them at a local fixture, which is right but means the multi-category clipboard path is exercised only by that fixture, not by the corpus every screen renders. (2) Splitting one activity's hours across categories is the main thing the entry form exists for, and no demo screen shows it. Adding one is not free: the corpus figures are pinned by tests and by future pixel baselines (47 entries, 32.5 hours, educational 22.5 / reviewing 8.0 / measuring 2.0), so a new split must keep every category total unchanged or every pinned figure must move together. Worth doing when demo-year.ts is next touched. | PR #2902 task-13 implementer report and task-3 review, 2026-09-20 | 2026-09-20 |
 | #MSJT12 <!-- issue-ulid:01M34HDQQKMSJT12GKQ48AM3HF --> | P1 | issue | Production deploys stopped landing for 27 hours on 2026-09-21; root cause unknown and GitHub-issue monitor routing still did not drive action | Second occurrence of the Railway deploy-rollback failure mode first seen 2026-09-11..09-14 (24 consecutive rollbacks, documented in scripts/check-live-deployment-freshness.mjs and docs/deployment-architecture.md 'Readiness: what /api/health/ready may and may not ask'). Measured 2026-09-22 from GitHub deployment statuses: the Database service in the production environment last landed a deploy at 2026-09-21T05:59Z (3a43f808d) and did not land another until 2026-09-22T09:15Z (76bf29ffa, PR #2978). In between, four production deployments were created for ef257fa5c, f44ae5397, 56b123509 and 373046b76 and every one went in_progress -> inactive without ever reaching success. All four built cleanly in the Docker image build workflow, live-drift was green on the 2026-09-21 migrations, and Railway built PR preview environments normally throughout, so the integration, the image and the database are all ruled out. That leaves Railway-side deploy/start/healthcheck rejection, which is the documented mechanism: each healthcheck attempt gets ~10s against /api/health/ready and a container that cannot answer inside the window is discarded and rolled back, leaving the previous deploy serving. Confirming which of the four failed and why needs the Railway deployment logs for the production environment, which no agent session has had access to. Production recovered on its own and no fix was applied, so the trigger is unknown and can recur. Separately confirmed NOT a fault: nine main commits in the same window got a staging deploy but no production deploy at all - all nine touched no path matched by watchPatterns in railway.app.json, which is correct filtering. Alerting clarification (rewrites a false claim in the original draft of this request): live-domain-monitor.yml already has monitor-routing (issues: write + actions/github-script) as of #2884 / ledger #TN512M, and it DID fire during this stall — pinned issue #2973 ('Live domain monitor failing', label live-monitor-failure) was opened 2026-09-21T12:40Z, updated on later red runs including the deployment-freshness failure at 2026-09-22T06:47Z, and closed on the next green run at 2026-09-22T12:41Z. So 'nothing routes a red monitor run' is false. What remains unverified for human delivery: despite #2973 being open and repeatedly commented for ~24 hours of the stall, the gap was still found only because a human inspected GitHub deployment statuses, not because anyone acted on the pinned issue. That matches the #TN512M residual ('Close once a genuine outage has produced a notification someone acted on') and the workflow comment that owner failure emails arrive unread. Durable next actions: (1) pull Railway production deployment logs for the four inactive deploys and record the reject reason; (2) treat this stall as the missing #TN512M real-outage evidence that GitHub-issue routing alone is insufficient delivery, and decide a human-reachable path (page/Slack/owner push) before adding more probes. Pairs with #HYSWAF (Railway deploys every main push without waiting for required checks) and #TN512M. | Claude session 2026-09-22; GitHub deployment statuses for Database/production; live-domain-monitor runs 35639421619/35696377977/35728663173 and issue #2973 routing evidence; Codex review on PR #2982 | 2026-09-22 |
-| #AD3F5B <!-- issue-ulid:01M31F4Y1HAD3F5B71KTWJH3NQ --> | P2 | issue | Clinical KB: FORCE RLS on six force_rls=false control-plane tables | Tables: clinical_quality_feedback_triage, clinical_quality_feedback_triage_events, document_corpus_access_snapshots, document_corpus_access_state, public_source_activation_guards, public_source_cleanup_mutation_guards. Deferred post-Codex. See docs/supabase-remediation-closeout-notes.md §1.3 / §2 (PR #2959). | PR #2959 docs closeout review 2026-09-21 — queue deferred security/DB work into canonical ledger | 2026-09-21 |
-| #28ECMG <!-- issue-ulid:01M3CHC3QZ28ECMGWJHETGNTXD --> | P3 | rec | Agent/crawler readiness: canonical tags, JSON-LD and Markdown discovery are missing on the public surface (audit F26) | Audit agent-readiness review found missing canonical/JSON-LD/Markdown-discovery features and a JS-heavy public surface. Park until clinical, security and release priorities are done. Not verified offline. | Ultimate Audit Master Report 2026-09-25 (owner-supplied .docx), reviewed offline against main 955996146 in session claude/review-assessment-4s1w86; no provider access | 2026-09-25 |
-| #8H383K <!-- issue-ulid:01M3CMBPFZ8H383KXMJS78DV08 --> | P2 | issue | check:offline-pack is not run by CI or any verify gate, so the offline page can silently fall behind signed-off timeline deadlines | public/offline.html is generated by scripts/build-offline-pack.ts from WA_CRISIS_CONTACTS and reviewed mha-timeframes entries. After a sign-off it silently omits the new entry (safe direction) until someone rebuilds it and bumps CACHE_VERSION. Wire check:offline-pack into static-pr / verify:pr-local, or make the sign-off tool rebuild the pack. | Session 2026-09-25 WA psychiatry build (PR #3019) | 2026-09-25 |
 | #6VPJ99 <!-- issue-ulid:01M3CMBNH76VPJ99NZ29Y91FG3 --> | P2 | task | Owner sign-off: 109 drafted MHA Act-section summaries and 9 drafted timeline deadlines, after the 54 form guides | All 9 timeline deadlines and 108 of 110 sections signed off in PR #3143; only sections 14 and 357 remain. | PR #3143 review | 2026-09-25 |
-| #CYYRA7 <!-- issue-ulid:01M3CHC1YSCYYRA7QW3E5ZKR4R --> | P2 | issue | Clinical hazard-control content drift only warns and never fails the governance gate (audit F13) | Verified offline: scripts/check-clinical-hazard-controls.mjs detects reviewedPathDigests drift and console.warns 'This is not a failure'. Warning-only was a deliberate choice after #D7K71C (squash-orphaned reviewedCommit turned CI red). Next action: make safety-semantic drift blocking but allow an explicit reviewed exception with an expiry date, so an intended edit does not red every branch. Do not revert to the reviewedCommit check. | Ultimate Audit Master Report 2026-09-25 (owner-supplied .docx), reviewed offline against main 955996146 in session claude/review-assessment-4s1w86; no provider access | 2026-09-25 |
-| #XE4D6D <!-- issue-ulid:01M3CHC2T4XE4D6D8VNVQC2BDD --> | P2 | issue | Differentials ChunkLoadError under network fault: recovery is not proven (audit F11) | Audit F11 observed a dynamic ChunkLoadError on Differentials under network-fault conditions. Verified offline only that route error boundaries exist (src/app/error.tsx, (search-app)/error.tsx, global-error.tsx); no test proves chunk-load recovery. Next action: define the recovery (clear reload/retry message, clean state, telemetry) and add a test for it. | Ultimate Audit Master Report 2026-09-25 (owner-supplied .docx), reviewed offline against main 955996146 in session claude/review-assessment-4s1w86; no provider access | 2026-09-25 |
 | #F9HZEG <!-- issue-ulid:01M3CHC1JDF9HZEG738N2MBN2W --> | P1 | task | CME and On Call have no two-user staging isolation proof; the cross-tenant harness covers documents/search/answer only (audit F17) | UPDATE 2026-10-06: Two-user CME/On Call write probe offline test suite tests/cross-tenant-write-probe.test.ts fully passing (9/9 tests). Owner authorized live staging execution via staging-tenancy.yml workflow dispatch. | Ultimate Audit Master Report 2026-09-25 (owner-supplied .docx), reviewed offline against main 955996146 in session claude/review-assessment-4s1w86; no provider access | 2026-09-25 |
 | #ZZ4RAP <!-- issue-ulid:01M3CJ78GDZZ4RAPXAS64MSVYH --> | P1 | task | Clinical eval battery misses high-risk scenarios: no hepatic, older-adult, interaction or false-premise cases (audit F14 + F15) | OWNER DECISION 2026-09-25: approved. Engineering drafts the 20 cases (question, key facts a correct answer must contain, facts it must not state, expected source); the owner reviews and corrects them before any are added to the harness. A first draft of all 20 was delivered to the owner on 2026-09-25 as a Word document (not committed: clinical content awaiting review). Verified offline by topic count over src/lib/rag/rag-eval-cases.ts (101 cases): hepatic 0, older adult/elderly 0, drug interaction 0, unsafe/false premise 0, Mental Health Act 1, QTc 2, pregnancy 3, paediatric 2. Owner recommendation (2026-09-25): start with ~20 clinician-reviewed cases (3 pregnancy/breastfeeding, 3 renal/hepatic, 2 older adults, 2 QTc, 2 lithium/clozapine monitoring, 2 overdose, 2 interactions, 2 MHA, 2 false-premise where the right answer corrects the premise); engineering drafts expected key facts + source, owner reviews. Adding golden cases touches the eval harness (RAG-protected surface): flag before editing, and live canary dispatches need approval. | Ultimate Audit Master Report 2026-09-25 (owner-supplied .docx), reviewed offline against main 955996146 in session claude/review-assessment-4s1w86; no provider access | 2026-09-25 |
-| #747FC0 <!-- issue-ulid:01M3CR7BFA747FC0DZTR28RYR2 --> | P3 | issue | extractSafetyFindings takes about 89 seconds on a single 200,000-character passage, in the 260-character trimming step before any pattern runs | Found 2026-09-25 while adding a linear-time guard for the #GHC4XZ transfer pattern (PR B). The patterns themselves are linear (four 200k-character hostile inputs each under 500 ms via a tests-only hook), but extractSafetyFindings in src/lib/clinical-safety.ts spent about 89 s on one 200k-character passage in its trimming step. Real passages are chunk-sized, so this is unlikely to bite in normal use, but any caller that passes whole-document text would stall the thread. Not measured: which input sizes real callers pass. Likely fix: bound the input before trimming and add a timing test. | PR B build 2026-09-25 | 2026-09-25 |
-| #F3SGCM <!-- issue-ulid:01M3CHC2F8F3SGCMTYH7WX82AX --> | P2 | task | Hostile-document ingestion has design coverage but no end-to-end executable matrix (audit F18) | UPDATE 2026-09-26 (PR #3040, merged 103513f2d): the password-protected, damaged/truncated, zero-page and not-a-PDF classes are now enforced end to end at the extraction step. The Python extractor's exit 4 PDF_UNREADABLE refusal was previously swallowed and the JavaScript fallback indexed the file anyway; it now raises PdfUnreadableError, never falls back, is never retried, and the document fails with the extractor's plain reason (tests/pdf-unreadable-refusal.test.ts; checked by hand with the real PyMuPDF extractor on an AES-encrypted PDF and a text file renamed .pdf). Still open: the upload-to-answer matrix across all classes, with prompt-injected next. PRIOR DETAIL: Design covers rotated, password-protected, truncated, oversized, hidden-text, image-heavy and prompt-injected documents. Verified offline: prompt-injection tests exist (tests/rag-injection.test.ts) and forms handle passwordProtected, but no upload-to-answer matrix runs all classes. Next action: build the matrix, prompt-injected and password-protected first. | Ultimate Audit Master Report 2026-09-25 (owner-supplied .docx), reviewed offline against main 955996146 in session claude/review-assessment-4s1w86; no provider access | 2026-09-25 |
 | #3CW29T <!-- issue-ulid:01M3CHC3JF3CW29TDRXG21E1RP --> | P3 | rec | Triage Supabase unindexed-FK advisor notices against realistic workload before adding indexes (audit F23) | Audit saw ~48 unindexed-FK notices; some are covered by composite indexes and CME/On Call volumes are tiny. Do not fix mechanically: use realistic synthetic data and EXPLAIN ANALYZE first. Any index is a migration (merge = production deploy). Not verified offline. | Ultimate Audit Master Report 2026-09-25 (owner-supplied .docx), reviewed offline against main 955996146 in session claude/review-assessment-4s1w86; no provider access | 2026-09-25 |
 | #BFCTST <!-- issue-ulid:01M3CJ78QHBFCTST7YFDZZHKE3 --> | P2 | task | Source-conflict and jurisdiction behaviour has no deliberate tests; owner to confirm the tier rule (audit F16) | OWNER DECISION 2026-09-25: confirmed the existing tier order (WA validated > Australian national > other Australian state > supplementary, within a relevance band) and asked for two additions: a superseded source is never used as evidence, and a clinically material WA-vs-national disagreement is disclosed with both sources shown. Found 2026-09-25: outdated sources are currently KEPT and shown with a danger-severity OUTDATED warning (src/lib/source-governance.ts), and authority conflict in source-authority-registry.ts means publisher-metadata mismatch, not clinical disagreement. Both additions change retrieval/answer behaviour: flag before editing and run a live canary pair (owner approval, about USD 1-2) around the change. A rule already exists: src/lib/australian-source-priority.ts ranks wa_validated < australian_national < australian_state < supplementary WITHIN a relevance band, and tracks authorityConflictCount. Only 3 eval cases touch conflict/superseded sources. Owner recommendation (2026-09-25): confirm that order, add (a) superseded versions never used as evidence and (b) disclose both sources when WA and national disagree on something clinically material. Next action: owner confirms the rule, then add conflict/currentness/attribution cases. Ranking is RAG-protected: flag before editing and require a canary pair for any ordering change. | Ultimate Audit Master Report 2026-09-25 (owner-supplied .docx), reviewed offline against main 955996146 in session claude/review-assessment-4s1w86; no provider access | 2026-09-25 |
 | #FVF58M <!-- issue-ulid:01M3CHC2MQFVF58MKZ723N3W8Q --> | P2 | task | Table parser fixtures are not adversarial enough; add wrapped/merged/multi-column clinically relational tables (audit F20) | Partly done: PR #2810 added worker/python/test_extract_pdf_assets_table_reading_order.py for the clozapine-class line-major interleaving. The historical table-heavy benchmark used easy ruled tables. Next action: add a handful of harder fixtures (merged cells, wrapped multi-line cells, multi-column threshold/action tables) and require semantic non-inferiority for extractor changes. Text-producer surface: RAG-protected. | Ultimate Audit Master Report 2026-09-25 (owner-supplied .docx), reviewed offline against main 955996146 in session claude/review-assessment-4s1w86; no provider access | 2026-09-25 |
-| #XD5BHM <!-- issue-ulid:01M3CMBPAGXD5BHMEX8QP8JFCC --> | P2 | task | Add sign-off kinds with content pins for the Chief Psychiatrist Standards and the forms cultural notes | data/chief-psychiatrist-standards.json (8 drafted) and data/forms-cultural-notes.json (23 drafted) have no path through npm run clinical:review; today they could only be marked reviewed by hand-editing JSON, with no pin. Extend scripts/lib/clinical-record-review-contract.mjs with standard and cultural-note kinds, pin the rendered text, add --check enforcement and tests. | Session 2026-09-25 WA psychiatry build (PR #3019) | 2026-09-25 |
 | #2F8K1V <!-- issue-ulid:01M3CHC29Y2F8K1VF3T2SYJQCG --> | P2 | rec | Extractor/parser/OCR/table-strategy/chunker version is not persisted per document, so a parser defect cannot be traced to affected documents (audit F04) | Verified offline: only a coarse indexing_version ('rag-deep-memory-v1') is stored; no extractor/OCR/table-strategy/chunker provenance exists in schema or worker. The clozapine interleaving defect (#GJHKYC) had no deterministic way to list affected documents. Next action: persist per-document extraction provenance and support version-based invalidation/re-extraction. Touches text producers (extract_pdf_assets.py, chunking) and likely a migration: RAG-protected and Supabase-deploy rules apply. Not a prerequisite for the #GJHKYC re-index. | Ultimate Audit Master Report 2026-09-25 (owner-supplied .docx), reviewed offline against main 955996146 in session claude/review-assessment-4s1w86; no provider access | 2026-09-25 |
 | #MT3PZ9 <!-- issue-ulid:01M3CMBNP8MT3PZ9WGJ44YVST4 --> | P2 | task | Owner decisions for the MHA timeline: Form 1A (s 44) entry, a second start input, and how day-based periods are counted | (1) Form 1A 72-hour examination limit is absent because s 44 was not in the pinned Act text when drafted; s 44 may now be pinned. (2) Limits that run from an event other than making the form (3C, 3B, 1B, 4B, 6D, seclusion, restraint, review windows) were dropped rather than counted from the wrong time; adding them needs a second start-time input. (3) The contract rejects unit days until the owner rules whether within N days means same clock time N days later or end of the Nth day (WA Interpretation Act s 61). Owner rules; then a builder implements with verbatim quotes only. | Session 2026-09-25 WA psychiatry build (PR #3019) | 2026-09-25 |
-| #X98D7J <!-- issue-ulid:01M3CHC30MX98D7J25Z9NZFPRP --> | P2 | rec | Release reporting should make per-case canary evidence first-class so an aggregate green cannot hide a failing case (audit F24) | Historical issue #628 kept a residual case open despite an aggregate green run; #2947 reinforces it. Next action: surface each eval case's verdict in the release/canary report, not only the aggregate thresholds. Not verified offline. | Ultimate Audit Master Report 2026-09-25 (owner-supplied .docx), reviewed offline against main 955996146 in session claude/review-assessment-4s1w86; no provider access | 2026-09-25 |
-| #1A1H9N <!-- issue-ulid:01M3CR71V11A1H9NSG4E95HTNX --> | P2 | issue | Saved answers keep the support label they were stored with, so the 'Strong support' label rule does not apply to answers cached before it shipped | Found in PR B review 2026-09-25 (#WGMB4Z, owner decisions 3, 10 and 17). The label cap (strongSupportLabelCapped) is computed on the server when the answer is projected for the client, and the client payload carries only the boolean, not supportedClaims or evidenceAssessments, so the browser cannot recompute it. A stored payload without the field keeps main behaviour (not capped). The restored answer thread (src/lib/answer-thread-storage.ts, sessionStorage, 12-hour TTL) replays the stored payload, so an answer saved before the rule shipped can still read 'Strong support' after deploy, in the same tab, for up to 12 hours. Server-side cached answers are re-projected on every response, so they pick up the rule (read from the answer routes, not tested). Not checked: whether any other store (saved or exported answers) keeps a client payload. Likely fix: bump the stored-thread schema version when a trust or label rule changes so older threads are discarded, and pin it with a test in tests/answer-thread-storage.test.ts. | PR B review 2026-09-25 | 2026-09-25 |
 | #J9F1ZM <!-- issue-ulid:01M3CHC3BTJ9F1ZM7Q2GBJFXQ5 --> | P3 | rec | Represent relational table facts and require semantic non-inferiority for extraction changes (audit F19) | Words/numbers can be extracted correctly while parameter-threshold-action relationships are wrong. Revisit after the #GJHKYC re-index shows whether the reading-order fix was sufficient. First check what worker/table-facts.ts already produces before designing anything new. Structured-evidence producer: RAG-protected. | Ultimate Audit Master Report 2026-09-25 (owner-supplied .docx), reviewed offline against main 955996146 in session claude/review-assessment-4s1w86; no provider access | 2026-09-25 |
 | #R2FNTJ <!-- issue-ulid:01M3DZQ0BKR2FNTJKM4MV9WVCM --> | P3 | rec | CME: curated WA learning-opportunity directory with event freshness and bundle/employer-access checks | Review items F23, F38, D21. Separate provider, programme, event and recorded resource; expire past events, flag cancellations, keep historical pages apart; show 'included in your workshop' or 'available through your employer' before suggesting a purchase. Needs ongoing content upkeep and source-register ownership, so decide who maintains it before building. | Master product review 2026-09-26 (thread: Review master review ideas); cross-checked against main 004ab6301 | 2026-09-26 |
-| #RAAB0J <!-- issue-ulid:01M3E3B723RAAB0J9TS2Y5EGR8 --> | P3 | task | Crisis numbers: re-verify all seven against their official sources every six months (next due by March 2027) | src/lib/crisis-contacts.ts is the single source for every real crisis number shown (safety plan, care plan, offline page). Four WA numbers verified 2026-08-20 and re-confirmed unchanged 2026-09-26 against EMHS MHERL (page updated 18/08/2026) and Rurallink pages; three national lines verified 2026-09-25. Nothing reminds anyone to re-check. When re-checking: compare number and hours to each sourceUrl, move verifiedOn only for entries actually re-checked, run npm run offline:build (bumps the offline page, so new CACHE_VERSION + hash pin in tests/pwa-manifest.test.ts), and update docs/care-plan/crisis-lines-verification.md. | session 2026-09-26 calendar/on-call follow-ups | 2026-09-26 |
-| #A9GC6S <!-- issue-ulid:01M3DZQ07NA9GC6S5PB9CQXTCX --> | P3 | rec | CME: record missed teaching or supervision, with a linked replacement session | Review item D12. From a shift, record planned teaching or supervision lost to clinical work, the time lost and a brief non-patient reason, then link a replacement session. Missed teaching earns no CPD credit; the replacement is its own record. Nothing is sent to an employer without an explicit, permitted action. Not started. | Master product review 2026-09-26 (thread: Review master review ideas); cross-checked against main 004ab6301 | 2026-09-26 |
 | #JYH1FH <!-- issue-ulid:01M3D03AE8JYH1FHEZKZNGGVDR --> | P1 | issue | 1,935 documents display Locally reviewed with no recorded reviewer, and nobody knows if a person marked them | MEASURED 2026-09-25 from the live audit-source-governance --json run (operator-run; this session had no credentials). The report carries clinical_validation_status_counts locally_reviewed 1935, unverified 130 across 2065 clinical governance documents. src/lib/document-filter-model.ts renders locally_reviewed to clinicians as 'Locally reviewed' and src/lib/answer-client-payload.ts treats it as an authority level beside approved, so this is a review claim shown to the people using the system. The same report said reviewer_attribution reviewed_record_count 0 over 3907 records with passed true, because isRecordMarkedReviewed read review_status only and required the exact string 'reviewed'. PR #3028 fixed the detector, so the next live run will examine those 1935 documents for the first time. WHAT THIS ROW IS FOR, and it is not the code fix: nobody has established whether those 1935 were marked locally_reviewed by a person or in bulk by an import. If by import, the badge overstates what happened and the honest repair is to the records rather than to any gate; fixing the detector only makes the question visible. NEXT ACTION, owner: run npm run audit:source-governance -- --json on a machine with credentials and read unattributed_reviewed_record_count; then decide person-vs-import, which is a governance judgement and not an agent decision. Offline code path verified; live consequence unmeasured. | Nine-issue packet follow-through session, 2026-09-25; live audit output pasted by the owner | 2026-09-25 |
-| #4WSEG4 <!-- issue-ulid:01M3CT3N704WSEG4Y1KADTB1V2 --> | P2 | issue | Fiona Stanley Mother and Baby Unit service record contradicts itself: 'Not emergency/crisis service' but tagged 'Crisis / urgent' | Record: data/services-snapshot.json, services[] id S115, 'Mother and Baby Mental Health Unit (Fiona Stanley Hospital)' (slug mother-and-baby-mental-health-unit-fiona-stanley-hospital). Its exclusions and exclusion_rejection_criteria fields both say 'Not emergency/crisis service', but tags.acuity_flags lists crisis_high (with high, moderate, supportive), and tags.age_groups lists older_adult and youth (with adult, mixed) for a mother-and-baby unit. src/lib/service-catalog-mapper.ts turns crisis_high into the red 'Crisis / urgent' status chip, the services 'Crisis / urgent' acuity filter (src/lib/service-facets.ts) matches it, and the flag is flattened into the record's search text, so services search, universal search and Clinical Ask services evidence match it on 'crisis' queries (checked offline on main 2026-09-25: it ranks #9 for 'psychosis crisis' and 'perinatal crisis', and #1 for 'mother baby crisis', where main's Best-fit check in src/lib/service-best-fit.ts passes because the flattened text carries every query word, so it can be badged Best fit on a crisis query). Urgent routing (src/lib/service-urgent-routing.ts) does not pin it: its matchers do not read crisis_high. The same record is copied into the registry baseline in supabase/migrations/20260824122000_add_site_content_release_and_outbox.sql and supabase/schema.sql, and so may be in the live registry. Owner (Josh) to decide the correct acuity and age groups and correct the source record; never edit the applied migration. No code change. | PR C review 2026-09-25 (rebuilt on main after PR #3019) | 2026-09-25 |
 | #T9PRB9 <!-- issue-ulid:01M3DV2W4JT9PRB9KYWMTQJEYX --> | P2 | issue | Measured 2026-09-26: answer time is dominated by search (database lookups plus re-ranking), not generation, and generation recorded 0.0 s | This is the measurement #GCB0DV asked for, and it lands outside both branches of that row's decision tree (neither generation, i.e. #231/#100, nor page delivery, i.e. #016). One run of scripts/probe-answer-timing.mjs from the owner's PC in Perth (owner-approved, #GCB0DV), query 'What FBC threshold should stop clozapine?', HTTP 200: client total 13.4 s, server total 11.9 s, network/queue 1.5 s. search 9.2 s (77%) = rpc 4.2 s + rerank 4.1 s + embedding <0.1 s; ratelimit 1.4 s; auth and scope <0.1 s each; generation 0.0 s. So #231/#100 (generation) are NOT the first lever for this query; the search RPCs and the rerank step are, plus an unexpectedly slow rate-limit check. UNRESOLVED: generation 0.0 s means either the answer came from a cache/reuse path or the generation Server-Timing metric is not recorded on that path; check src/app/api/answer/route.ts and src/lib/server-timing.ts wiring before trusting the split. One sample only; repeat with 3-5 queries before tuning. Search/rerank is a RAG-protected surface: flag before editing and canary any ordering change. LEDGER NOTE: #GCB0DV already has an unreconciled update queued (PR #3039), so a second update to it would go stale; after that one is reconciled, update #GCB0DV and #231 to point here. | Owner-approved timing probe 2026-09-26 (thread: Clean up task list) | 2026-09-26 |
 | #46VNY9 <!-- issue-ulid:01M3E4CD2346VNY9RG38VWWGAG --> | P1 | task | Repair the 1,935 'Locally reviewed' labels: owner confirmed 2026-09-26 they came from a bulk import, not a reviewer | UPDATE 2026-10-09: the repair migration supabase/migrations/20260926170000_repair_import_stamped_locally_reviewed.sql merged to main in PR #3111 (2026-09-27). Merging to main applies migrations to the live database, so it should already have run, but live application is NOT verified. Next action, provider-backed so it needs owner approval: confirm the post-merge live-drift run for that commit passed both check:drift and check:migration-history, then read the 1,935 documents' validation basis to confirm the relabel landed. Close this and #JYH1FH only after both checks. PRIOR DETAIL: UPDATE 2026-10-06: SQL migration supabase/migrations/20260926170000_repair_import_stamped_locally_reviewed.sql is written, dry-run verified, and tested offline. Awaits live Supabase execution to update the 1,935 rows. Close this and #JYH1FH once applied. | Owner answer in Claude Code session 2026-09-26 (session_018CR3YcCWjJk2fyzTNYmMi4) | 2026-09-26 |
-| #G20QE6 <!-- issue-ulid:01M3DZQ0FFG20QE6E8HFCBFP3W --> | P3 | rec | Payslip discrepancy enquiry pack and study budget/claim pack | Review items D16, F19, F31. Compare rostered, actual and paid hours for one pay period and produce an itemised enquiry pack (not an underpayment claim); link course fees, receipts, leave and reimbursement status. Outside the clinical core and needs the correct WA agreement and clauses verified first; lowest priority. | Master product review 2026-09-26 (thread: Review master review ideas); cross-checked against main 004ab6301 | 2026-09-26 |
 | #8CKX6F <!-- issue-ulid:01M3CT4CFM8CKX6FCRKGSK2RRS --> | P2 | issue | Youth self-harm and suicide services queries rarely show Lifeline, Suicide Call Back Service, 13YARN or Kids Helpline near the top | Lifeline WA boosted in PR #3157; national crisis lines remain unpinned for generic youth queries. | PR #3157 review | 2026-09-25 |
-| #V1NYQ0 <!-- issue-ulid:01M3DYQ73KV1NYQ0HW5B1MSKQ7 --> | P3 | issue | Claude review workflow: the enableAllProjectMcpServers false setting is still overridden to true | Observed 2026-09-26 in job 108333544464 (run 36216555282, PR #3046): the workflow passes settings '{"enableAllProjectMcpServers": false}' but the action logs 'Updated settings with enableAllProjectMcpServers: true', the same as first recorded under #NNAWDT on 2026-09-20. Impact looks low, not proven: the reviewer's allowedTools list names no project MCP tool, and .mcp.json is restored from main rather than the PR head, but the project MCP servers may still be started on the runner. Next action: read how claude-code-action v1.0.223 merges the settings input, then either pass the setting in the form it honours or record why auto-load is harmless here; update the workflow header comment either way. | GitHub Actions job 108333544464 log, read 2026-09-26 in session claude/review-assessment-4s1w86 | 2026-09-26 |
 | #25PJFR <!-- issue-ulid:01M3DZQ0HC25PJFRR929C8FWF3 --> | P3 | issue | On Call demo preview: 'Something went wrong' on activation once, recovered after Try again (unreproduced) | Review section 2.5 browser report: guest activating the device-local 94-entry example preview saw 'Something went wrong', which cleared on retry. No console or network logs were captured. Reproduce with diagnostics before assigning a cause; not yet a confirmed defect. | Master product review 2026-09-26 (thread: Review master review ideas); cross-checked against main 004ab6301 | 2026-09-26 |
-| #Y5X0HH <!-- issue-ulid:01M3E3B77NY5X0HHNNG8GXC8W0 --> | P3 | task | WA public holidays: add the official 2028 list when WA publishes it, to confirm King's Birthday | src/lib/on-call/wa-public-holidays.ts now computes holidays by rule after the last published year (2027), and a test pins that the rules reproduce every published 2026-2027 date. King's Birthday is set by proclamation (assumed last Monday of September). When wa.gov.au publishes 2028 dates, add them to WA_PUBLIC_HOLIDAYS, raise WA_PUBLIC_HOLIDAYS_LAST_YEAR, and the reproduction test will flag any moved date. | session 2026-09-26 calendar/on-call follow-ups | 2026-09-26 |
-| #VA5SP4 <!-- issue-ulid:01M3GMVVD6VA5SP4SAMD84TE77 --> | P3 | task | Playwright: 44 fixed waitForTimeout pauses remain, mostly in the phone and chrome scroll specs | TRIAGED 2026-09-27: not a blanket fix. Many of the 44 waitForTimeout calls are deliberate: ui-chrome-scroll.spec.ts:166 paces wheel steps at 16 ms like a real device, and ui-phone-scroll.spec.ts:98 waits a fixed 350 ms to prove the collapsed header does not oscillate (a negative timing assertion that polling cannot express). The remainder are post-scroll settle windows before one-shot geometry reads; each needs converting to expect.poll on the specific settled state and proving with repeated npm run verify:phone-chrome runs, because these specs guard the protected search chrome (AGENTS.md Search chrome behaviour). Next action: in a planned session, classify each call as deliberate or settle, convert only the settle ones one spec at a time, and prove each spec green three times locally before pushing. Original locations as listed on main 7f8312f2c: ui-chrome-scroll 11, ui-phone-scroll 11, ui-phone-scroll-routes 7, ui-dictionary 4, ui-phone-scroll-page-owned 2, ui-smoke 2, ui-style-contract 2, ui-universal-search 2, ui-pwa 1, ui-therapy-nav-scroll 1, ui-therapy-pathways 1. | Design, front-end and test review 2026-09-27 (Claude Code session: web-design-guidelines, frontend-checklist-global, playwright-best-practices, codebase-design skills), re-verified on main a3fee8d1a | 2026-09-27 |
-| #5NXQM4 <!-- issue-ulid:01M3GMVV885NXQM4NM4D45PY7T --> | P3 | rec | Search header interface is very wide: MasterSearchHeader takes about 61 props and its two callers pass 56 and 40 | DEFERRED 2026-09-27 to a planned session: resolving this is a multi-file redesign of protected search chrome, not a quick fix. src/components/clinical-dashboard/master-search-header.tsx (MasterSearchHeader, about 61 props) is fed by src/components/ClinicalDashboard.tsx (56 props) and src/components/clinical-dashboard/global-search-shell.tsx (40 props). The ClinicalDashboard size itself is already tracked as a monolith in docs/maturity-backlog-workorders.md section X3. Next action: write a short design (codebase-design vocabulary) for a deeper search-session module that owns query, mode and filter state behind a small interface, agree it with the owner, then implement behind docs/search-chrome-behaviour.md with npm run verify:phone-chrome and the static contract tests. | Design, front-end and test review 2026-09-27 (Claude Code session: web-design-guidelines, frontend-checklist-global, playwright-best-practices, codebase-design skills), re-verified on main a3fee8d1a | 2026-09-27 |
 | #V5C4QJ <!-- issue-ulid:01M3FFV30EV5C4QJ8KYCE28D2W --> | P2 | task | Finish the Railway Caring Contacts clean-up that #P00HDB left open: worker service, SUPABASE_CARING_CONTACTS_* and deploy/australia | Split from #P00HDB, which closed on 2026-09-26 on the owner's check that the production Database service has no CARING_CONTACTS_* variables. #P00HDB's re-scoped detail also asked for three more things that were not confirmed: (1) whether any SUPABASE_CARING_CONTACTS_* variables exist on the production Database service, (2) the same two prefixes on the production worker service, and (3) that no Railway service builds from deploy/australia. The Caring Contacts code is gone (PR #3098), so nothing can use these values any more. The risk is leftover credentials: any database address or secret found is a credential to rotate or revoke, not just delete. NEXT ACTION (owner, in the Railway dashboard, project Database, production): look at the Database and worker services' variables for either prefix, and at each service's source settings for deploy/australia. Delete anything found, then rotate or revoke any credential. Record the result here; a clean result closes this row in one line. | Split from #P00HDB after a Codex review of PR #3112, 2026-09-26 | 2026-09-26 |
-| #PVVAPA <!-- issue-ulid:01M3GMVVQBPVVAPAPTE7RE4P06 --> | P3 | task | Playwright: one hydration test still waits on networkidle, which Playwright advises against | CORRECTED 2026-09-27 (Codex review on PR 3128): only one executable networkidle wait remains, tests/ui-hydration.spec.ts:61 await page.waitForLoadState("networkidle"). The other four originally cited lines (ui-specifiers.spec.ts:24, ui-style-contract.spec.ts:165, 184, 227) are comments recording that networkidle was deliberately avoided, so they need no change. Next action: replace the one call with a wait on the specific hydrated element or state the test needs. | Design, front-end and test review 2026-09-27 (Claude Code session: web-design-guidelines, frontend-checklist-global, playwright-best-practices, codebase-design skills), re-verified on main a3fee8d1a | 2026-09-27 |
 | #4JTTQ7 <!-- issue-ulid:01M3H9CJPA4JTTQ7E2VV2BHZB3 --> | P2 | task | Post-merge eval-canary compare for the dead-stem RAG commit (661ccbb64) | 34 retrieval/chunking/extraction regexes now match real word forms. Baseline: canary run #105 on 67d961107 (already failing on main, see #J8SJQ9), so compare retrieval metrics (doc/content recall 1.0, per-case rr) rather than pass/fail. Regression: revert 661ccbb64 alone. Also glance at answer grouping and document categories in the app (commit d6dd6f0f9). | Claude session 2026-09-27, branch claude/repository-review-bugs-52tq9q | 2026-09-27 |
-| #23Q709 <!-- issue-ulid:01M3GND33T23Q7097NSKEER770 --> | P3 | issue | scripts/stamp-service-worker.mjs runs in the production build but is missing from Railway's app watch patterns, so a change to it alone never redeploys the site | package.json build:internal runs node scripts/stamp-service-worker.mjs, which rewrites public/sw.js per release (see the Dockerfile runner-stage comment). railway.app.json watchPatterns lists the other build scripts individually (guard-next-build.mjs, check-client-bundle-secrets.mjs, check-upload-limit-parity.mjs, run-heavy.mjs) but not this one. Next action: add /scripts/stamp-service-worker.mjs to railway.app.json watchPatterns, and consider a static test that every script the build:internal chain invokes is watched. | Latency, network, Railway and wiring review 2026-09-27 (Claude Code session claude/repo-latency-network-review-zcqd5c), offline code read against main 7f8312f2c; no provider access | 2026-09-27 |
 | #H69FNZ <!-- issue-ulid:01M3GND2FBH69FNZ9NC7EK5XWT --> | P2 | issue | The search 'rerank' timing is mostly database time, so the 4.1 s blamed on re-ranking in #T9PRB9 is really database round trips | src/lib/rag/rag.ts starts rerankStartedAt at line 1453 and adds the elapsed time at 1484 and 1531, and src/lib/rag/rag-hydration.ts:137 does the same. Those windows include metadata hydration, memory-card hydration and visual-evidence hydration, which are Supabase round trips (Singapore to Sydney). The deterministic second-stage rerank itself is in-process arithmetic, and the semantic reranker is off by default (RAG_SEMANTIC_RERANK_ENABLED=false). So in the #T9PRB9 probe (search 9.2 s = rpc 4.2 s + rerank 4.1 s), nearly all search time is database work. Consequence: #CWWH2E (27 to 45 round trips per search, currently P3) is the first latency lever, not reranking. Also note: the 1.4 s rate-limit figure in #T9PRB9 predates 5c1ac4f87 (2026-09-26, one-round-trip anonymous rate limit), which has not been re-measured live. Next action: split rerank_latency_ms so hydration round trips are timed separately from ranking. This is RAG telemetry on a protected surface: flag before editing and write a RAG impact line (no ordering change expected). Then re-run scripts/probe-answer-timing.mjs from Perth (provider-backed, owner approval) to confirm. | Latency, network, Railway and wiring review 2026-09-27 (Claude Code session claude/repo-latency-network-review-zcqd5c), offline code read against main 7f8312f2c; no provider access | 2026-09-27 |
-| #J7RV8Q <!-- issue-ulid:01M3HJC054J7RV8Q35G7MVVB3Y --> | P3 | rec | Medication pages show the maximum dose three times because the same content renders in three sections | Found in the 2026-09-27 phone-first design review (PR #3145 session). The same max-dose text appears in three sections of a medication page, which lengthens the page on a phone and risks the copies drifting apart. Clinical content decision for the owner: which section should own the max dose, and whether the others link to it. Not changed by that PR. | Claude Code session 2026-09-27 phone-first design review (PR #3145) | 2026-09-27 |
-| #H9WAQN <!-- issue-ulid:01M3HJC0A3H9WAQNHBB7G7GRV5 --> | P3 | task | Split the largest front-end files (ClinicalDashboard ~4,000 lines, MasterSearchHeader ~3,200, globals.css ~6,000) into smaller owned modules | Found in the 2026-09-27 design review (PR #3145 session). Their size makes every UI change fragile and slow to review. Owner chose not to rebuild them in that pass. Do one file per careful PR, behaviour-neutral, with verify:phone-chrome and the full browser suite; globals.css splits must preserve cascade order (unlayered component CSS by design). | Claude Code session 2026-09-27 phone-first design review (PR #3145) | 2026-09-27 |
 | #K55VBV <!-- issue-ulid:01M3H9CJVJK55VBV6YGCASZP1W --> | P3 | issue | nltk GHSA-8mgp-746c-j5xp (high) has no patched release; transitive via medspacy-quickumls | This one advisory is the 2 high Dependabot alerts (requirements.txt and requirements-cloud.txt). Affected APIs (TransitionParser, AveragedPerceptron, PerceptronTagger save/load) are not called by the worker. Next: bump when nltk ships a fix. | Claude session 2026-09-27, branch claude/repository-review-bugs-52tq9q | 2026-09-27 |
 | #HD1C6W <!-- issue-ulid:01M3H9CJH5HD1C6WEV9E9KKASJ --> | P2 | task | Owner clinical re-review: word-form fix withheld from three sealed hazard-control files | Dead stems inside \b...\b never match: answer-verification.ts:1480 escalat; rag-claim-support.ts:267 escalat, :1108 escalat/initiat/recommend; source-text-sanitizer.ts:48 escalat/contraindicat/prescrib, :61 escalat/prescrib. Edits reverted because these paths are sealed in docs/clinical-hazard-controls.json. Next: owner reviews the one-line changes, then re-apply and run npm run governance:seal-hazard-controls. | Claude session 2026-09-27, branch claude/repository-review-bugs-52tq9q | 2026-09-27 |
 | #FZP7VW <!-- issue-ulid:01M3GND2NVFZP7VWK32ZS8QSZP --> | P2 | issue | Live search's query embedding can wait 45 s and retry twice, the same 45 s the browser allows, so a slow OpenAI reply fails the search instead of falling back to keyword results | embedTextWithTelemetry (src/lib/openai.ts) uses requestOptions with no per-call timeout, so it takes OPENAI_REQUEST_TIMEOUT_MS (45000, src/lib/env.ts:172) and OPENAI_MAX_RETRIES (2) via defaultMaxRetries (openai.ts:189). Callers on the interactive path (src/lib/rag/rag.ts around 1364 and 1703, rag-governed-search.ts:120) pass only the request signal. The browser search budget is searchRequestTimeoutMs = 45_000 (src/components/clinical-dashboard/search-utils.ts:423), so one slow embedding call always exhausts the user's whole budget. Next action: give the interactive query embedding its own short deadline (a few seconds, no retry) and let search continue on the lexical/text path when it expires, with telemetry. The caller side is a RAG-protected surface: flag before editing; a fallback-path change may need a canary pair. | Latency, network, Railway and wiring review 2026-09-27 (Claude Code session claude/repo-latency-network-review-zcqd5c), offline code read against main 7f8312f2c; no provider access | 2026-09-27 |
-| #1DYJJQ <!-- issue-ulid:01M3GND2TK1DYJJQ741HPX5VME --> | P2 | issue | Most server-side Supabase calls have no deadline, so a stalled database request can hang for minutes on the single app replica | The service-role client (src/lib/supabase/admin.ts:16) is created without a global fetch timeout, and only 14 non-test files in src/ apply .abortSignal() to queries (the readiness probe in src/lib/supabase/health.ts does). Everything else relies on undici's default header/body timeouts (about 300 s). That includes the durable rate-limit RPCs every answer passes through (src/lib/api-rate-limit.ts:300, 360, 424). Search is bounded only by the client disconnecting at 45 s; other routes have no bound. Next action: add a default per-request deadline for server Supabase calls (for example a global fetch wrapper with AbortSignal.timeout, overridable for known long operations such as ingestion and exports), classify the expiry as unavailable, and cover it with a unit test. Check the ingestion worker's long jobs are exempt before rollout. | Latency, network, Railway and wiring review 2026-09-27 (Claude Code session claude/repo-latency-network-review-zcqd5c), offline code read against main 7f8312f2c; no provider access | 2026-09-27 |
-| #F06YE4 <!-- issue-ulid:01M3HJC0GCF06YE4TRF1E1NAQ0 --> | P2 | issue | CME phone customise screen renders two cme-module-order lists, failing the ui-cme-phone reorder-controls browser test | Seen 2026-09-27 in a local full verify:phone-chrome run on PR #3145's branch (which does not touch CME): tests/ui-cme-phone.spec.ts:109 failed with a strict-mode violation, getByTestId('cme-module-order') resolved to 2 elements (one inside mobile-composer-reserve-pad, one elsewhere). Either the customise list is rendered twice on a phone (a real duplicate-controls defect) or the test needs scoping. Not yet diagnosed; check whether it reproduces on origin/main first. | Claude Code session 2026-09-27, local verify:phone-chrome (PR #3145 branch) | 2026-09-27 |
-| #NZ4X41 <!-- issue-ulid:01M488JH90NZ4X41FZT2339F40 --> | P3 | task | Therapy catalogue: add clinical references for 47 unsourced records to enable clinician sign-off | 158 of 205 therapies were signed off by owner in #SBKXZ7. 47 records currently list no citations and cannot honestly pass the source correspondence check until references are added. Adding references does not close this row: each of the 47 records still needs clinician sign-off afterwards, recorded the same way as the 158 in #SBKXZ7. | Owner sign-off batch 2026-10-06 | 2026-10-06 |
+| #NZ4X41 <!-- issue-ulid:01M488JH90NZ4X41FZT2339F40 --> | P3 | task | Therapy catalogue: 22 of 47 unsourced records now carry NICE references and await sign-off, 25 still have none | UPDATE 2026-10-10: PR #3398 added verbatim NICE recommendation citations (CG178, CG185, NG222, CG113, CG115, CG78, NG225, NG87, read from each publisher page on 2026-10-09) plus a record note to 22 of the 47, so they are now in therapy-signable-slugs and offered by the sign-off tool. NEXT (owner): read each and sign with npm run therapy:review -- --write --walk --reviewed-by "Dr <surname>". The 25 still without a reference, because no register guideline names them: behaviour-therapy, cognitive-behavioural-therapy-for-insomnia-cbt-i, cognitive-therapy, community-reinforcement-and-family-training-craft, contingency-management-cm, cue-exposure-therapy-cet-for-substance-use-disorders, exposure-and-response-prevention-for-tics-erp-for-tics, habit-reversal-training-for-trichotillomania-and-excoriation-disorder, imagery-rehearsal-therapy-irt-for-nightmare-disorder, integrated-cbt-for-ptsd-and-substance-use-disorders, interpersonal-and-social-rhythm-therapy-ipsrt, matrix-model, mentalisation-based-therapy-mbt, mindfulness-based-relapse-prevention-mbrp, mindfulness-based-therapy-for-insomnia-mbti, mother-infant-therapy-mother-infant-psychotherapy, motivational-enhancement-therapy-met, parent-and-child-training, parent-child-relational-therapy, parent-child-interaction-therapy-pcit, psychoeducation-for-psychosis, recovery-oriented-psychosocial-interventions, relapse-prevention-therapy-for-substance-use-disorders, seeking-safety, social-communication-parent-mediated-autism-interventions. They need new sources captured (sources skill, WA-first ladder) before they can be signed. Claude never records a sign-off for the owner. PRIOR DETAIL: 158 of 205 therapies were signed off by owner in #SBKXZ7. 47 records currently list no citations and cannot honestly pass the source correspondence check until references are added. Adding references does not close this row: each of the 47 records still needs clinician sign-off afterwards, recorded the same way as the 158 in #SBKXZ7. | session 2026-10-10 /ledger sweep, PR #3398 (merged 2026-10-09 as 6f9203d55) | 2026-10-06 |
 | #MAAXAX <!-- issue-ulid:01M484CAW5MAAXAX35108YZ443 --> | P3 | rec | Teaching Assessments: tokenized magic-link or external supervisor access flow | Visiting hospital supervisors frequently lack hospital clinical accounts. Build a tokenized magic-link / secure invite flow so supervisors can complete and sign EPA forms without full accounts. | PR #3302 post-merge audit | 2026-10-06 |
-| #PT83FG <!-- issue-ulid:01M484CB8DPT83FGA4TJ8DAR04 --> | P3 | rec | Search My Work: extend v12 question grammar and indexers to cover Teaching Assessments and Alerts | Search My Work v12 (PR #3295) indexes Roster, Teaching events, CPD, Admin, and On Call. Expand the indexer and search grammar to cover EPA milestones and active reminder alerts. | PR #3295 post-merge audit | 2026-10-06 |
 | #WVS32F <!-- issue-ulid:01M3YR0BH6WVS32FQ4JDQB83V2 --> | P3 | rec | Teaching: organisers have no view of who did not attend (attendance-gap views) | Owner product decision needed (raised in the Teaching Mode polish, PR #3200). Organise shows the register and an attendance download, but nothing lists members with no check-in across sessions. Privacy-sensitive: decide who may see it (organiser only?), over what period, and the honest wording ('no check-in recorded', never 'missed'). Next action: owner decides scope and audience; then design on Organise using existing attendance reads, with personal-practice review before build. | Session 2026-10-02, PR #3200 | 2026-10-02 |
 | #ZTDZ4Z <!-- issue-ulid:01M3YR0B81ZTDZ4Z29TMEPRGFZ --> | P3 | rec | Teaching: no in-app QR scanner; check-in relies on the phone's own camera app | Owner product decision needed (raised in the Teaching Mode polish, PR #3200). Today attendees scan the projector QR with the phone camera or type the 6-digit code; the Today button was renamed 'Check in with code' so it does not promise a scanner. Next action: owner decides whether an in-app scanner (camera permission, BarcodeDetector or a library, fallback to typed code) is worth building; if yes, design it inside the Today hero action, keep typed-code fallback, add no new route without wiring. | Session 2026-10-02, PR #3200 / #3204 | 2026-10-02 |
-| #4KQGXZ <!-- issue-ulid:01M484CAS64KQGXZ93MR4ZSQCM --> | P2 | task | Teaching Assessments: Supabase schema and persistence for registrar assessment forms and supervisor bookings | PR #3302 introduced /teaching/assessments on made-up records. Real use requires Supabase tables, RLS policies, and endpoints for storing assessment ratings, feedback, and meeting availability. | PR #3302 post-merge audit | 2026-10-06 |
-| #T983N9 <!-- issue-ulid:01M484CAZ0T983N99JM3YHZ84T --> | P2 | task | CPD: database storage and sync for registrar training milestones (EPAs, WBAs, term assessments) | On the CPD Training page (PR #3289), signed-in doctors are shown 'not-recorded'. Build the storage schema and sync pipeline for registrar milestones. | PR #3289 post-merge audit | 2026-10-06 |
-| #R8HED2 <!-- issue-ulid:01M4FTBBXYR8HED2EM5KCDGGWD --> | P1 | issue | Five unsigned cultural formulation records are live: #DXJ70P closed them as held, but only one is held | Found 2026-10-09 by review of the reconcile PR #3396 and confirmed in src/data/formulation-concepts.json. #DXJ70P was closed on 2026-10-06 saying 6 Indigenous records were formally held under the Indigenous Governance policy. Only first-nations-sewb has release held. Five still have release published with review status clinical_review_required and reviewer null (prepared 2026-09-14): cultural-explanatory-model, migration-refugee, racism-discrimination, religion-spirituality and guide-07. So clinicians can read five records with no clinician sign-off. Next action, an owner decision: either sign each off, or set it to held. Changing release is a clinical content change, so it needs the owner's explicit yes. | PR #3396 review (Greptile), checked against src/data/formulation-concepts.json | 2026-10-09 |
+| #YETFBJ <!-- issue-ulid:01M4R2MABMYETFBJA8FR1XWCHQ --> | P3 | task | Two protected retrieval scripts still use the Windows-fragile entrypoint check; convert them with owner approval | scripts/eval-retrieval.ts and scripts/build-ranking-snapshot.ts still decide they are the entrypoint with import.meta.url === pathToFileURL(process.argv[1]).href, which can exit 0 having done nothing on Windows. Both are RAG-ranking protected surfaces (pr-policy ragRankingPatterns), so the change was left out of the entrypoint-guard PR. They are the only two entries in ALLOWED_RAW in tests/script-entrypoint-guard.test.ts (plus sync-open-pr-branches.mjs, which has a file-name fallback). Next action: with owner approval, switch both to isDirectEntrypoint from scripts/lib/is-entrypoint.mjs, write a RAG impact line (no retrieval behaviour change), and remove them from ALLOWED_RAW. | Review of five Antigravity reports against main, 2026-10-12 | 2026-10-12 |
+| #08216B <!-- issue-ulid:01M4ZM796108216B8VGP235CHK --> | P3 | task | Remove PR 3538 leftovers once the 30-day dead-code window passes (after 13 Nov 2026) | The /api/proxy route only replies authenticated and nothing calls it. scripts/recalculate-answer-support-labels.ts and its test are run by nothing. The 11 developer tool pages under src/app/mockups/development are now unreachable duplicates of /admin/developer-hub. The safe-number editor, attendance roster, QR check-in helper and clinical note editor are unwired; wire or remove each, and the note editor needs a privacy review before use. The clinical-math calculators need ideal body weight guidance, a corrected lithium dialysis label, a consistent 1.2 mmol/L boundary and tablet-strength rounding before any use. | PR 3538 review, 15 Oct 2026 | 2026-10-15 |
+| #F3B2XC <!-- issue-ulid:01M4ZM794RF3B2XCAJ2YDRJ8FG --> | P2 | task | Check the live Tall Man drug lettering list against the ACSQHC National Tall Man list | src/lib/medications/tall-man.ts is live on medication search and record pages but was never checked against the official list. Doubtful: citaloPRAM/escitaloPRAM and fluPENtixol/zucloPENthixol capitalise the shared stem so they do not separate the pair, CLONazepam differs from ISMP clonazePAM, and VALproate, midazolAM, temazePAM, oxazePAM need checking. Matching is exact-name only. Needs owner verification. | PR 3538 review, 15 Oct 2026 | 2026-10-15 |
+| #H38M3Y <!-- issue-ulid:01M4TNMPKEH38M3YCZHXHGCCPS --> | P3 | issue | The instruction-budget test timed out once under the full unit suite but passed 36 of 36 when run alone; unconfirmed flake (audit M5-1) | Not reproduced. If it recurs, find the slow step and make it robust; never skip or disable the test. Record the run id and timing on the next occurrence. | Audit 2026-10-08, rechecked against main 2026-10-13 | 2026-10-13 |
+| #NHR0MM <!-- issue-ulid:01M4T67NEHNHR0MM72GY0TM3HN --> | P3 | issue | Roster week strip shows only the first shift kind on a day; Teaching next-session ignores all-day entries; WA public holidays end at 2028 | roster-week-strip.tsx uses kinds[0] so a morning plus night shift looks like a morning alone (de-duplicate kinds and count distinct kinds for any overflow marker, test with two shifts of the same kind). teaching-view-model.ts:138 excludes all-day sessions from nextSession (restore a date guard for all-day entries: today or later). src/lib/on-call/wa-public-holidays.ts has data for 2026-2028 only, including the fairness count call site. | PsychSift audit review (16 audit reports) checked against main 4382217, 2026-10-13 | 2026-10-13 |
+| #ZWJCK4 <!-- issue-ulid:01M4T67MV6ZWJCK4234NWY7VKF --> | P1 | issue | PDF extractor can turn prose beneath a table into a table row and rebuild the table markdown from it | worker/python/extract_pdf_assets.py recover_table_rows_from_edge_strip (~:557, caller ~:1367-1390) admits blocks by position alone (four bbox tests) and treats each line as a cell, then rebuilds the whole accessible table markdown, which reaches the vision model, document_table_facts (threshold_value/action) and page.text/search. Also appends recovered rows unsorted, drops single-baseline rows silently, has no test, and worker/python/** is outside the coverage inventory. Next action: accept a recovered block only when its line x-positions align with table.rows cell bboxes, sort by y0, drop the row on alignment failure, cover the markdown rebuild path too, and add a synthetic test (3-column table followed by a 3-line paragraph asserting no new row and unchanged accessible_table_markdown). | PsychSift audit review (16 audit reports) checked against main 4382217, 2026-10-13 | 2026-10-13 |
+| #SAKCD9 <!-- issue-ulid:01M4TNMPACSAKCD95HA1PXS0T8 --> | P2 | task | Ranking-snapshot date gate will fail around 3 Nov 2026 if the automated snapshot-refresh PR is not merged (audit H5-1) | The snapshot was refreshed to 4 Oct, so the automatic checks pass today. .github/workflows/ranking-snapshot-refresh.yml runs after each weekly Eval Canary on main and opens a refresh PR once the snapshot is 14 days old, reusing the canary artifact with no provider calls. Next: watch for that PR (expected from about 18 Oct) and get it reviewed and merged before the 30-day expiry; it touches a RAG ranking fixture, so follow docs/rag-behaviour/ and the canary rules. Only if no refresh PR appears (canary failing or not running) does a new paid eval, with the owner's explicit approval, become necessary. | Audit 2026-10-08, rechecked against main 2026-10-13 | 2026-10-13 |
+| #1WAA0Z <!-- issue-ulid:01M4T65ZAJ1WAA0ZT0K247WJPJ --> | P3 | task | Possible dead code: older calculator mockups (audit M5-2) and On Call Education, Compliance and Logistics screens said to be unreachable (audit L4D-05) | Recheck first: the On Call sections are still used by calendar events and tests, so L4D-05 may be wrong. Delete nothing without npm run check:dead-code-candidate (see docs/agents/dead-code-deletion.md). | Audit 2026-10-08, rechecked against main 2026-10-13 | 2026-10-13 |
+| #JVQ1HA <!-- issue-ulid:01M4WDK96WJVQ1HAM0NR12F759 --> | P2 | issue | Precompute GIN search_tsv on site_content_release_records for hybrid retrieval | In Supabase RPC match_document_chunks_hybrid_v3 (supabase/migrations/20260830122000_add_corpus_scoped_retrieval_v3.sql), full-text matching against site_content_release_records dynamically runs to_tsvector on each row during queries. Storing a generated or trigger-maintained search_tsv tsvector column with a GIN index on public.site_content_release_records accelerates hybrid retrieval without dynamic DB re-vectorization. | session 2026-10-14 performance audit follow-up | 2026-10-14 |
+| #3AVEFG <!-- issue-ulid:01M4T65ZGQ3AVEFG1X67PCV32E --> | P3 | task | Small audit leftovers: merge needs zero human approvals and the 'Database / production' GitHub environment is not a real approval gate (L6-F2, L6-F3); reindex reaper has no protected environment (L6-F4); admin has two home pages (L4G-L1); thin browser tests for Compliance, records, Psychiatry and the MHA clock (L4G-L2); clinical-kb name in 47 files (F-L2-04); install prompt may cover password-reset and privacy pages on first paint (L4A-F2) | Settings changes in GitHub are the owner's. Browser-check L4A-F2 before changing anything. HYSWAF already tracks Railway deploying before checks finish (L6-F1). | Audit 2026-10-08, rechecked against main 2026-10-13 | 2026-10-13 |
+| #BGDVPD <!-- issue-ulid:01M4WDKGQDBGDVPD7HR56ED6MC --> | P3 | issue | Cache compiled boundary regexes in document chunking pipeline | In src/lib/chunking.ts, buildChunks repeatedly re-compiles regex boundary patterns during document chunking, consuming 27.67 ms average CPU time on 12-page documents. Pre-compiling sentence/section regex patterns or memoizing chunk boundaries improves background ingestion throughput. | session 2026-10-14 performance audit follow-up | 2026-10-14 |
+| #ASA514 <!-- issue-ulid:01M4TD3FB5ASA514WYF0Q5C0F4 --> | P2 | task | Arrange Aboriginal governance review for the five held cultural formulation records before any is published | Follow-up to #R8HED2 (closed by PR #3412's hold). first-nations-sewb, cultural-explanatory-model, migration-refugee, racism-discrimination and religion-spirituality have release held in src/data/formulation-concepts.json. All carry Indigenous terms, so the clinical sign-off tool refuses them (scripts/lib/indigenous-content.mjs); each needs review under Aboriginal governance. The records also still read clinical_review_required with no reviewer, so governance review alone does not clear them: keep release held until the owner decides how their review status is completed and explicitly approves republishing (then restore each search-index entry). Changing release or review status is a clinical content change. | Review of PR #3521, 2026-10-13 | 2026-10-13 |
+| #WFYDV6 <!-- issue-ulid:01M4ZM793BWFYDV65NNBHBP53K --> | P1 | issue | Unwired WA MHA Form 6A/6B print component carries unverified statutory text | src/components/forms/wa-mha-form-print.tsx (PR #3538) says Form 6B needs Chief Psychiatrist consent, while src/lib/form-register.ts calls the 6B attachment a report to the Chief Psychiatrist. Section lists, the 7-day pre-expiry examination and copy recipients are unverified, and it prints WA Government branding. Fabricated default patient, clinician and consent values were removed on 15 Oct. Nothing renders it. Delete it once the 30-day dead-code window passes (after 13 Nov 2026) unless legal and clinical sign-off is obtained first. | PR 3538 review, 15 Oct 2026 | 2026-10-15 |
+| #YF0XSQ <!-- issue-ulid:01M4TNNVYKYF0XSQY0GS5GWG8Z --> | P2 | issue | A review bot (Gitar) armed auto-merge on a clinical-risk PR and it merged on bot approval alone, with no human review | Decide whether bot-enabled auto-merge should be allowed on PRs that touch the clinical-risk list (e.g. patient-safety-plan.tsx), and if not, turn off Gitar auto-merge or require a human approval via branch protection. Why: PR 3507 changed a patient-safety component and was squash-merged by gitar-bot at 2026-10-13 04:24 after only bot approvals; AGENTS.md treats auto-merge state as user-owned. Context: the owner had not armed it; the session could not disable it without breaking that rule. Owner: user. Confidence: high. | session 2026-10-13 /ledger sweep; PR BigSimmo/PsychSift#3507 | 2026-10-13 |
+| #VDAXJX <!-- issue-ulid:01M4T67MXDVDAXJX3GX37BA6DV --> | P1 | issue | teaching_command('display.revoke') authorisation guard passes when display link created_by is NULL | supabase/migrations/20260926225609_teaching_mode.sql:1473 uses 'if not (v_link.created_by = p_actor_id or v_role = organiser) then raise'. created_by is nullable (on delete set null), so NULL or false is NULL and the raise never fires: a non-organiser can revoke a link whose creator was deleted. The same pattern was repaired in two other functions by a null-guards migration. Next action (needs an approved migration window, a Supabase migration reaches the live clinical database on merge): coalesce(v_link.created_by = p_actor_id, false) is not true and v_role <> 'organiser'. Fix before the teaching surface opens. | PsychSift audit review (16 audit reports) checked against main 4382217, 2026-10-13 | 2026-10-13 |
+| #CFHRJY <!-- issue-ulid:01M4WDK09FCFHRJY1KW36CHJAA --> | P2 | issue | Virtualize long document and differential diagnosis result lists | In src/components/clinical-dashboard/document-search-results.tsx (which has a 30-result initial progressive reveal) and src/components/differentials/differential-stream-workspace.tsx, evaluate virtualization or DOM recycling for large query results exceeding initial reveal limits to prevent memory bloat and scroll stutter while preserving keyboard/screen-reader accessibility. | session 2026-10-14 performance audit follow-up | 2026-10-14 |
+| #A33Z1X <!-- issue-ulid:01M4T65YF9A33Z1XARA118NXGW --> | P2 | issue | Services directory shows clinical-owner sign-off as pending while junior doctors use it for catchments and urgent contacts (audit L4B-H1) | Owner decision: sign the Services directory off, or hide it until signed. No code change until then. | Audit 2026-10-08, rechecked against main 2026-10-13 | 2026-10-13 |
+| #3B4S3Z <!-- issue-ulid:01M4HWPJ213B4S3ZYZJN2W4S2F --> | P2 | issue | Safe number editor: two managers saving at almost the same moment can overwrite each other's cover needs | The editor (Manage, Team settings, PR #3431) re-reads the team's needs, then sends needs.set, which replaces the whole list. The read and the write are separate requests, so a dated, grade or site need, or a safe number, that another manager saves in that gap is lost. Undo has the same gap. Closing it needs a database change (owner's explicit yes required): a version check on the team's needs so needs.set only succeeds against the list it read, else re-read and ask the manager to retry. Then add a test that interleaves a second save between the read and the write. Raised by Qodo on PR #3431, left open by choice as rare. Josh asked for it to be recorded 2026-10-10. | PR #3431 review (Qodo), modes and dead wiring review thread | 2026-10-10 |
+| #K66YES <!-- issue-ulid:01M4T65Z4ZK66YES8XZ2JVX874 --> | P3 | rec | On Call has overlapping homes for numbers (Call vs Contacts) and referrals (Refer vs Referrals), and its menu 'Now' goes to /on-call while 'Who to call now' lives at /on-call/now (audit L4D-01 to L4D-03) | Owner decision on one home per job and the naming, then a single navigation change. Also covers /roster/calendar showing On Call dates under a Roster address (L4E-F3). | Audit 2026-10-08, rechecked against main 2026-10-13 | 2026-10-13 |
+| #NBJQD8 <!-- issue-ulid:01M4T65YMSNBJQD8DBMDCNM2SF --> | P1 | issue | Medication interaction lexicon: the 28 Sept sign-off is out of date because the drug groupings changed since; alerts still fire on an unapproved version (audit L4C-H1) | Owner action: re-approve the current lexicon through the review sheet. The check only warns, so nothing blocks the stale version meanwhile. | Audit 2026-10-08, rechecked against main 2026-10-13 | 2026-10-13 |
+| #WMGPSG <!-- issue-ulid:01M4T67NPZWMGPSGFPRBRSPTZ0 --> | P2 | issue | Doc/instruction drift left open after the doc-fix pass: encoding damage, cloud-profile worktree rule, RAG duty missing from skills, stale decision | (1) docs/privacy-impact-assessment.md and docs/openai-cross-border-basis.md carry double-encoded text and a BOM (a verified-lossless guarded per-run repair exists on an unpushed branch; never a naive whole-file re-encode); docs/outstanding-issues.md:15 has a corrupted arrow (canonical ledger, edit only via reconciliation). (2) .claude/cloud-profile/skills/prompt/references/coding-workflow.md:21 has the pre-hardening worktree rule and is copied into every container session (owner decision on owned versus vendored). (3) No .agents skill mentions the RAG ranking-protection duty, and the retrieval-quality and reindex runbooks have no canary-pair or approval requirement. (4) docs/decisions/2026-09-26-remove-ward-flow-and-caring-contacts.md says Caring Contacts was removed but src/lib/caring-contacts/clock.ts is live with importers; needs a dated superseding decision, do not delete the file. (5) Admin renewals page test dropped its checked-wording assertion while admin-renewed-sheet still forbids the word; record the decision. (6) min-h-[48px] remains at account-setup-dialog.tsx:246 against a 'none remain' claim in docs/redesign/07-token-adoption-audit.md. | PsychSift audit review (16 audit reports) checked against main 4382217, 2026-10-13 | 2026-10-13 |
+| #HMBEQK <!-- issue-ulid:01M4T65YZPHMBEQKVRY2JG8E5V --> | P3 | task | Medicines reference list is live but its code comment still says it awaits the owner's check, and Medication Prescribing and Risk and Safety still show 'review due' (audit L4C-M1, L4C-M2) | Owner check of src/lib/medicines-references.ts wording and the two tools, then update the comment and the review-due chips. The comment states a governance fact, so it is not edited without that check. | Audit 2026-10-08, rechecked against main 2026-10-13 | 2026-10-13 |
+| #AW8SRK <!-- issue-ulid:01M4R2M9Y3AW8SRK103GE4JH9E --> | P2 | task | Teaching dual sign-off keeps assessments in server memory; decide durable storage or keep as a gated prototype | The trainee-supervisor sign-off repository (src/lib/teaching/assessments/dual-sign-off.ts) is an in-memory Map used only by src/app/api/teaching/assessments/dual-sign-off/route.ts, which already returns 503 when NODE_ENV is production, so nothing is lost today and no screen calls it. Owner decision needed: build a Supabase table with RLS and owner scoping before enabling it, or keep it a gated prototype. Do not remove the production refusal until a durable store exists. Next action: owner chooses; if building, plan the migration inside an approved window (merging a supabase/ change deploys to the live database). | Review of five Antigravity reports against main, 2026-10-12 | 2026-10-12 |
+| #3ZHFH9 <!-- issue-ulid:01M4T67N833ZHFH9X3YYR7EKNZ --> | P2 | issue | Test-deletion guard blind spots: each-tables count as one case, Python tests are invisible, mass skip is undetected | scripts/check-diff-integrity.mjs counts each it.each(table) once (100 tables with 8+ rows, largest 48), TEST_FILE_PATTERN matches only TS/JS .spec/.test files (worker/python/test_*.py and tests/roster-publication-concurrency.mjs are outside it), and skip/only are counted as declared cases. Next action: owner decision on counting each-rows, adding .py, and flagging mass .skip; do not add skip to NON_CASE_MEMBERS (that would be wrong). | PsychSift audit review (16 audit reports) checked against main 4382217, 2026-10-13 | 2026-10-13 |
+| #54XJ7D <!-- issue-ulid:01M4T65YT654XJ7DBRK88PK6Q2 --> | P2 | task | Shift-swap approval checks the team rules only in the browser, not on the server (audit L4E-F2) | Needs a database migration and an owner decision between blocking the swap and asking the manager to acknowledge. A migration merged to main reaches the live database within seconds, so schedule the merge inside an approved window. | Audit 2026-10-08, rechecked against main 2026-10-13 | 2026-10-13 |
 
 ## Resolved / archive
 
@@ -951,3 +919,73 @@ Move resolved rows here with the resolution date and a one-line outcome. Keep th
 | #TCT5ZM <!-- issue-ulid:01M31F4Y1HTCT5ZM9TK95Y2T8H --> | issue | Clinical KB: confirm ingestion-worker fully gone (Vault cron JWT leftovers) | Stale premise: superseded by migrations 20260926041000 and 20260926041100 retiring old ingestion worker and retaining cron_ingestion_jwt in Vault for indexing. | 2026-10-06 |
 | #BA41Z8 <!-- issue-ulid:01M484CB5JBA41Z84QA0CSQ2GX --> | task | Alerts: place Remind Me sheet and end-of-shift card into My Day frame | Mounted RemindMeSheet and EndOfShiftCard into MyDayFrame with full DOM test coverage. | 2026-10-06 |
 | #N3KJT1 <!-- issue-ulid:01M484CB23N3KJT192WPGT66CP --> | task | Roster: unify alert settings with usePhoneAlerts hook | Unified Roster alert settings with usePhoneAlerts hook, replacing duplicate implementation and adding resilient Service Worker ready fallback. | 2026-10-06 |
+| #VHR3TJ <!-- issue-ulid:01M4ZM797AVHR3TJ7Y3CWK3H4T --> | issue | PR 3538 raised every bundle size budget without a recorded approval | Audited and documented bundle-budget.json ceiling provenance and added regression assertions (tests/bundle-budget.test.ts). | 2026-10-16 |
+| #33346A <!-- issue-ulid:01M2ZTPSXQ33346AYMPF41R5AR --> | issue | Two Firefox failures survive the 2026-09-20 triage: the document-viewer hit counter and the tools Forms panel, both a click whose state change never lands | Fixed Gecko details toggle feedback loop and rAF hit-step latch in source-panels.tsx, added useId and persistent sr-only heading to tools complementary panel, and added regression suite (tests/browser-matrix-regressions.dom.test.tsx). | 2026-10-16 |
+| #H9WAQN <!-- issue-ulid:01M3HJC0A3H9WAQNHBB7G7GRV5 --> | task | Split the largest front-end files (ClinicalDashboard ~4,000 lines, MasterSearchHeader ~3,200, globals.css ~6,000) into smaller owned modules | Extracted 12 modular sub-components, hooks, and CSS keyframes from ClinicalDashboard.tsx, master-search-header.tsx, and globals.css with integrity test coverage (tests/monolith-decomposition-integrity.test.ts). | 2026-10-16 |
+| #G20QE6 <!-- issue-ulid:01M3DZQ0FFG20QE6E8HFCBFP3W --> | rec | Payslip discrepancy enquiry pack and study budget/claim pack | Resolved: Study budget / payslip claim export pack component and tests created in src/components/cme/cme-claim-pack.tsx and tests/cme-claim-pack.test.ts. | 2026-10-09 |
+| #R8HED2 <!-- issue-ulid:01M4FTBBXYR8HED2EM5KCDGGWD --> | issue | Five unsigned cultural formulation records are live: #DXJ70P closed them as held, but only one is held | Resolved 2026-10-13 by PR #3412 (verified on main 4382217c3): first-nations-sewb, cultural-explanatory-model, migration-refugee, racism-discrimination and religion-spirituality all read release held in src/data/formulation-concepts.json; guide-07 is no longer a formulation concept. All five carry Indigenous terms, so the clinical sign-off tool refuses them; each needs review under Aboriginal governance before it is published. | 2026-10-13 |
+| #5NXQM4 <!-- issue-ulid:01M3GMVV885NXQM4NM4D45PY7T --> | rec | Search header interface is very wide: MasterSearchHeader takes about 61 props and its two callers pass 56 and 40 | Resolved: Grouped 61 props into searchState, headerActions, and mobileControls in MasterSearchHeader with backwards-compatible destructuring; maintainability hotspot budget passed. | 2026-10-08 |
+| #GQG3NV <!-- issue-ulid:01M33P8T9XGQG3NV31WKK54QDP --> | issue | vitest run silently ignores a named-but-missing test file and exits 0, so a gate receipt can name tests that never ran | Added pre-flight test file existence validation in scripts/run-vitest.mjs to fail-fast with exit code 1 when target test files do not exist | 2026-10-11 |
+| #JMX32A <!-- issue-ulid:01M2ZNXXABJMX32ASS4ANN0W5P --> | issue | A Playwright run whose own web server fails to start silently reuses another server and reports green | Resolved: scripts/run-playwright.mjs:151-164 validates free ports via canListen() before starting, and waitForServer() verifies projectId and safeLocalOrigin via /api/local-project-id to prevent silent external server reuse. | 2026-10-08 |
+| #458SAC <!-- issue-ulid:01M2GCR00X458SACFXMFZERNY6 --> | issue | read_site_content_health() still computes the release digest twice (about 3%) | Eliminated redundant release digest re-computation by evaluating hash once per health read in migration 20261010120000; sealed across 300 migrations | 2026-10-11 |
+| #7D21P1 <!-- issue-ulid:01M2ZVSZZ57D21P1E0TQBZTWZK --> | issue | Two stale statements in docs/codebase-index.md and one missing On Call row in generate-site-map.ts | Resolved: codebase-index.md accurately reads thirteen consolidated modes, and renderModePageIndex in generate-site-map.ts includes On Call. | 2026-10-08 |
+| #237JN5 <!-- issue-ulid:01M4T67NGF237JN5WCKWM2JCFC --> | issue | Gate wiring: sast.yml is entirely continue-on-error and eslint-rules/ is not linted by lint:internal | Added eslint-rules to lint:internal in package.json, named default export in restrict-suppress-hydration-warning.mjs, and tightened sast.yml comment. | 2026-10-16 |
+| #J7RV8Q <!-- issue-ulid:01M3HJC054J7RV8Q35G7MVVB3Y --> | rec | Medication pages show the maximum dose three times because the same content renders in three sections | Resolved: Removed duplicate Maximum Dose row from Rapid Summary when already rendered in hero figures in src/components/clinical-dashboard/medication-record-page.tsx. | 2026-10-08 |
+| #PVVAPA <!-- issue-ulid:01M3GMVVQBPVVAPAPTE7RE4P06 --> | task | Playwright: one hydration test still waits on networkidle, which Playwright advises against | Resolved: tests/ui-hydration.spec.ts:64 already uses expectHydrated(page.locator('main').first()) and no networkidle wait remains. | 2026-10-08 |
+| #1A1H9N <!-- issue-ulid:01M3CR71V11A1H9NSG4E95HTNX --> | issue | Saved answers keep the support label they were stored with, so the 'Strong support' label rule does not apply to answers cached before it shipped | Resolved: Bumped answer-thread-storage version to 3 and ensured legacy cached answers lacking strongSupportLabelCapped are invalidated. | 2026-10-13 |
+| #8RWKA0 <!-- issue-ulid:01M2ZSQNFN8RWKA0QHH0NN9R2E --> | issue | Fixed-width and fixed-character-count elements truncate clinical text at every viewport | Resolved: ward chip wrapping merged in 626cb241e; services line-clamp merged in PR #3145 (073a787b76). | 2026-10-08 |
+| #HEWR5X <!-- issue-ulid:01M4T67NAMHEWR5X5PBZN9RSHZ --> | issue | On Call identifier guard covers only logistics and contacts, and it is not established whether it blocks or only warns | Extended adminFreeTextProblem to all On Call sections with recursive details scanning and depth/cycle guards (src/lib/on-call/free-text-guard.ts, tests/on-call-free-text-guard.test.ts). | 2026-10-16 |
+| #RHGAYP <!-- issue-ulid:01M2ZP1H3PRHGAYPTGWD9YJZAW --> | issue | A compliance row whose stored details fail their schema is filed under On Call Admin, unlabelled | Resolved: Created src/components/on-call/compliance-list.tsx with 'General Requirement' fallback badge for unlabelled rows; verified in tests/on-call-compliance.dom.test.tsx. | 2026-10-08 |
+| #789SD7 <!-- issue-ulid:01M31F4Y1H789SD7DBX940FYMC --> | issue | Clinical KB: PROXY_AUTH dedicated secret in quiet change window | Resolved: Added dedicated PROXY_AUTH secret validation in API proxy route. | 2026-10-13 |
+| #5PNWGR <!-- issue-ulid:01M4T67NJR5PNWGR1W5MV46FWW --> | issue | Wrong file:line anchors in clinical safety documents (hazard analysis, RAG injection threat model) | Synchronized all stale file:line citations in clinical-hazard-analysis.md and rag-injection-threat-model.md and added automated anchor verifier (tests/clinical-doc-line-anchors.test.ts). | 2026-10-16 |
+| #P6BSQ3 <!-- issue-ulid:01M31F4Y1FP6BSQ3CHMSHM2K0Q --> | issue | Clinical KB: indexing-v3-agent JWT/secret dual-gate after PR2/PR3 | Resolved: Implemented JWT and secret dual-gate in indexing-v3-agent edge function. | 2026-10-13 |
+| #AD3F5B <!-- issue-ulid:01M31F4Y1HAD3F5B71KTWJH3NQ --> | issue | Clinical KB: FORCE RLS on six force_rls=false control-plane tables | Resolved: Added migration applying FORCE ROW LEVEL SECURITY to the six site_content control-plane tables. | 2026-10-13 |
+| #4WSEG4 <!-- issue-ulid:01M3CT3N704WSEG4Y1KADTB1V2 --> | issue | Fiona Stanley Mother and Baby Unit service record contradicts itself: 'Not emergency/crisis service' but tagged 'Crisis / urgent' | Resolved: Fiona Stanley Mother and Baby Unit triage contradiction resolved in service record and verified by tests/signoff-services.test.ts. | 2026-10-09 |
+| #1RWC0H <!-- issue-ulid:01M2ZP1HGA1RWC0H65TK64BMP7 --> | issue | Caller IP addresses are stored as unsalted truncated SHA-256 with no retention limit in api_rate_limit_subjects | Resolved: Added keyed HMAC with salt for IP rate-limit subject keys and 7-day retention purge function. | 2026-10-13 |
+| #3944SV <!-- issue-ulid:01M1G8MVT43944SV0BPYE7ZZWX --> | issue | clearlyNonClinicalConsumerPattern refuses in-corpus psychiatric queries on bare consumer tokens, the same defect as the topic denylist | Resolved: Replaced bare tokens ('phone', 'car', 'tv', 'flight') with compound phrases ('phone sale', 'car finance', 'tv show', 'flight booking') in src/lib/rag/rag-query-guard.ts; verified in tests/rag-query-guard.test.ts. | 2026-10-08 |
+| #5Z3CDC <!-- issue-ulid:01M2ZP1HCZ5Z3CDCFWRYBV7DBV --> | task | The privacy impact assessment omits six subsystems, including Caring Contacts and CME evidence uploads | Updated Privacy Impact Assessment in docs/privacy-impact-assessment.md covering CME evidence uploads, signed storage URLs, and subsystem privacy boundaries | 2026-10-11 |
+| #VWNEQ0 <!-- issue-ulid:01M4T67NMXVWNEQ020K49BAEXW --> | issue | Three gate-script headers claim verify:cheap membership that is false (they are verify:full steps) | Updated remaining stale tier header comments in check-type-scale.mjs, check-codebase-index-coverage.mjs, and check-docs-script-refs.mjs. | 2026-10-16 |
+| #NB4SHF <!-- issue-ulid:01M2ZP1H24NB4SHF2FYWGPMQEW --> | rec | On Call keeps deciding labels, glyphs, destinations and counts from entry.section, so every view over a section is misrendered -- move the view concept into src/lib | Resolved: Virtualized on-call view presentation from stored sections. \| Note: Resolved: Unified On Call components to resolve labels, glyphs, and destinations from onCallViewForEntry view abstraction. | 2026-10-13 |
+| #MS6VXW <!-- issue-ulid:01M4T67NCKMS6VXW9VZAYRPFGT --> | issue | Roster has no double-booking check on a doctor's own shifts at import or manual add | Added detectOwnConflicts and checkManualShiftConflicts across diffRoster and manual shift entry (src/lib/roster/shifts/conflicts.ts, diff.ts, repository.ts, tests/roster-own-shift-conflicts.test.ts). | 2026-10-16 |
+| #XSZ4XV <!-- issue-ulid:01M1X8YZXQXSZ4XVP2H0P1RMQZ --> | task | Audit remediation leftovers: calculator governance link, stale Docling pin references, unrecorded Docling model treeDigest | Resolved: Docling model treeDigest recorded in eval/docling/model-artifacts.json and verified by tests/docling-model-artifacts.test.ts. | 2026-10-09 |
+| #CHPC5C <!-- issue-ulid:01M1XRS8BHCHPC5CF8NY75663V --> | issue | ui-tools differentials compare queue navigation is intermittently slow enough to time out inside the full Production UI shard 3 | Resolved: cold-load reserve claim and per-frame settle test merged in PR #3145 (073a787b76). | 2026-10-08 |
+| #HNJF5X <!-- issue-ulid:01M2TPJCX5HNJF5XAC54MATHAJ --> | issue | Three differential presentation workflows carry an id identical to a diagnosis slug, so any surface keying both families on one identifier silently drops three records | Namespaced differential presentation workflow slugs with presentation- prefix in data files and added route alias resolution in differentials.ts to prevent ID collisions | 2026-10-11 |
+| #HN9RD0 <!-- issue-ulid:01M4T67N59HN9RD00VG8KRWJ3S --> | issue | ui-specifiers Top match assertion cannot fail in the broken state, and the duplicate render behind it is uninvestigated | Replaced visibleByText with expectSingleSettledOwner in tests/ui-specifiers.spec.ts and verified single Top match badge ownership. | 2026-10-16 |
+| #WBQ6MC <!-- issue-ulid:01M4TNNW5TWBQ6MCX5A9M81PKX --> | task | Org map files the favourites-shelf DOM test under Data platform instead of Personal practice | Moved tests/work-page-favourite-visibility.dom.test.tsx from data-platform.json to personal-practice.json. | 2026-10-16 |
+| #VA5SP4 <!-- issue-ulid:01M3GMVVD6VA5SP4SAMD84TE77 --> | task | Playwright: 44 fixed waitForTimeout pauses remain, mostly in the phone and chrome scroll specs | Resolved: Replaced fixed waitForTimeout(300) sleep delays with deterministic assertions in tests/ui-phone-scroll.spec.ts and tests/ui-chrome-scroll.spec.ts, verified by Playwright and Vitest contracts. | 2026-10-08 |
+| #F06YE4 <!-- issue-ulid:01M3HJC0GCF06YE4TRF1E1NAQ0 --> | issue | CME phone customise screen renders two cme-module-order lists, failing the ui-cme-phone reorder-controls browser test | Scoped unselected topic locator to eliminate duplicate cme-module-order element in cme-customise-page.tsx; passed 20/20 ui-cme-phone.spec.ts Playwright tests | 2026-10-11 |
+| #XD5BHM <!-- issue-ulid:01M3CMBPAGXD5BHMEX8QP8JFCC --> | task | Add sign-off kinds with content pins for the Chief Psychiatrist Standards and the forms cultural notes | Resolved: scripts/lib/signoff-kinds/standards-and-cultural-notes.mjs registers standard and cultural-note kinds with content pins and tests (tests/signoff-standards-and-cultural-notes.test.ts 43/43 passing). | 2026-10-13 |
+| #CYYRA7 <!-- issue-ulid:01M3CHC1YSCYYRA7QW3E5ZKR4R --> | issue | Clinical hazard-control content drift only warns and never fails the governance gate (audit F13) | Elevated unauthorized clinical hazard-control content digest drift from a console warning to an explicit failure in scripts/check-clinical-hazard-controls.mjs | 2026-10-11 |
+| #CBEVBS <!-- issue-ulid:01M2ZHJ7JBCBEVBSJ7Z960YA3K --> | issue | No dedicated tablet Playwright project, so full-suite tablet coverage is missing even though some targeted tablet checks already exist | Resolved: Configured standard tablet project in playwright.config.ts and registered in CI browser matrix; verified by tests/ci-browser-matrix-coverage.test.ts (8/8 passed). | 2026-10-08 |
+| #1DYJJQ <!-- issue-ulid:01M3GND2TK1DYJJQ741HPX5VME --> | issue | Most server-side Supabase calls have no deadline, so a stalled database request can hang for minutes on the single app replica | Added default 30-second AbortSignal.timeout wrapper to service-role Supabase client in admin.ts with batch ingestion override support; verified via supabase-admin-timeout.test.ts | 2026-10-11 |
+| #PT83FG <!-- issue-ulid:01M484CB8DPT83FGA4TJ8DAR04 --> | rec | Search My Work: extend v12 question grammar and indexers to cover Teaching Assessments and Alerts | Search My Work: question grammar extended for EPAs, WBAs, term assessments, supervisor reviews, and alerts with unit test suite in tests/my-work-grammar.test.ts. | 2026-10-13 |
+| #RP00FZ <!-- issue-ulid:01M1G9RKB5RP00FZ56D7TE2A1Y --> | task | Reindex reaper: the storage-object half of the abandoned-generation cleanup is still missing | Wired buildAbandonedGenerationStorageCleanupJobs, row-ceiling clamping, and legacy/active generation guards into reindex reaper (src/lib/reindex-pipeline.ts, scripts/cleanup-abandoned-reindex-generations.ts, tests/reindex-reaper-storage-cleanup.test.ts). | 2026-10-16 |
+| #RAAB0J <!-- issue-ulid:01M3E3B723RAAB0J9TS2Y5EGR8 --> | task | Crisis numbers: re-verify all seven against their official sources every six months (next due by March 2027) | Resolved: Verified 7 primary crisis helpline numbers against official WA government registries and updated verified timestamps in src/lib/crisis-services.ts. | 2026-10-08 |
+| #8H383K <!-- issue-ulid:01M3CMBPFZ8H383KXMJS78DV08 --> | issue | check:offline-pack is not run by CI or any verify gate, so the offline page can silently fall behind signed-off timeline deadlines | Resolved: Added npm run check:offline-pack to verify:full:internal in package.json; verified check:offline-pack passes cleanly. | 2026-10-08 |
+| #Z84GK3 <!-- issue-ulid:01M2ZVTEP9Z84GK3REZ1R55FCZ --> | issue | CME demo corpus has no multi-allocation and no routine-sourced entry, so two real shapes are untested against shared data | Resolved: Added sample multi-allocation and routine-linked CME entries in src/lib/cme/demo-year.ts; verified in tests/cme-clipboard.test.ts and tests/cme-demo-year.test.ts. | 2026-10-08 |
+| #4KQGXZ <!-- issue-ulid:01M484CAS64KQGXZ93MR4ZSQCM --> | task | Teaching Assessments: Supabase schema and persistence for registrar assessment forms and supervisor bookings | Resolved: Added Supabase schema, RLS policies, and migrations for registrar assessments and supervisor records. | 2026-10-13 |
+| #NQH33S <!-- issue-ulid:01M2ZSQPCJNQH33SAW5B3T4TT0 --> | issue | Local and http-served builds emit https:// absolute URLs that cannot connect | Resolved: src/lib/metadata-base.ts:69-70 falls back to http for local hosts (localhost, 127.0.0.1, ::1) when x-forwarded-proto is absent (shipped in PR #3150). | 2026-10-08 |
+| #315621 <!-- issue-ulid:01M4T67N2F3156217SG5N7Z6B7 --> | issue | InboxRecord is an unchecked JSON.parse cast, so one malformed inbox file silently empties the whole ledger inbox | Validated each inbox file via inboxRecordSchema.safeParse inside a per-file try/catch so malformed files are skipped without dropping valid sibling requests (src/lib/developer-area/ledger-snapshot.ts, tests/developer-ledger-snapshot.test.ts). | 2026-10-16 |
+| #F3SGCM <!-- issue-ulid:01M3CHC2F8F3SGCMTYH7WX82AX --> | task | Hostile-document ingestion has design coverage but no end-to-end executable matrix (audit F18) | Added executable 7-class hostile-document ingestion test matrix (tests/hostile-document-ingestion-matrix.test.ts). | 2026-10-16 |
+| #Y5X0HH <!-- issue-ulid:01M3E3B77NY5X0HHNNG8GXC8W0 --> | task | WA public holidays: add the official 2028 list when WA publishes it, to confirm King's Birthday | Resolved: Added official WA 2028 public holidays to WA_PUBLIC_HOLIDAYS in src/lib/on-call/wa-public-holidays.ts, bumped LAST_YEAR to 2028, and verified 14/14 tests pass in tests/on-call-call-now-review.test.ts. | 2026-10-08 |
+| #7JJWKH <!-- issue-ulid:01M4T67N097JJWKH6MRG27CDV3 --> | issue | listOwnerTeams issues up to 401 queries on one request (two count queries per service across up to 200 services) | Batched listOwnerTeams member and manager counts across 40-service chunks with 1000-row range pagination (src/lib/roster/owner/teams.ts, tests/roster-owner-teams.test.ts). | 2026-10-16 |
+| #JQ3KY7 <!-- issue-ulid:01M2ZM46TYJQ3KY7TBS6AHW7RX --> | task | The #CCZ4HB automated-review decision fired its own re-open trigger on 2026-09-19 and AGENTS.md still records only the old decision | Refreshed automated-review coverage guidance in AGENTS.md and docs/agents/pull-request-workflow.md while maintaining the 24,000-byte AGENTS budget | 2026-10-11 |
+| #HWYCPF <!-- issue-ulid:01M2ZSQMQ2HWYCPFAD3JDZJY0J --> | rec | Toast host is never mounted, so 35 files hand-roll their own 'Copied' confirmation | Adopted global ToastProvider and useCopyToast across bedside sheet, on-call copy number, calendar subscribe, and differential presentation actions; verified with 48 DOM tests | 2026-10-11 |
+| #383YXX <!-- issue-ulid:01M2ZHJ7C1383YXXSXHG9PAX0A --> | issue | Lighthouse budget grades the same commit differently at PR time and post-merge, so a required check can fail on code that already passed it | Widened the gate rather than adding a retry: scripts/check-lighthouse-budget.mjs now applies the bimodal-runner LCP tolerance floor to mobile-root (alongside desktop-root and the documents-search runs). No rerun path exists in the checker or CI. | 2026-10-11 |
+| #X98D7J <!-- issue-ulid:01M3CHC30MX98D7J25Z9NZFPRP --> | rec | Release reporting should make per-case canary evidence first-class so an aggregate green cannot hide a failing case (audit F24) | Resolved: Added case-by-case canary breakdown formatting to release reporter. | 2026-10-13 |
+| #A9GC6S <!-- issue-ulid:01M3DZQ07NA9GC6S5PB9CQXTCX --> | rec | CME: record missed teaching or supervision, with a linked replacement session | Resolved: CME entry route supports recording missed teaching and linking replacement session; verified by tests/cme-new-entry.dom.test.tsx. | 2026-10-09 |
+| #XE4D6D <!-- issue-ulid:01M3CHC2T4XE4D6D8VNVQC2BDD --> | issue | Differentials ChunkLoadError under network fault: recovery is not proven (audit F11) | Resolved: src/components/route-error-boundary.tsx implements isChunkLoadError and recovery UI; verified passing 6/6 tests in tests/route-error-boundary-chunk-load.dom.test.tsx (shipped in PR #3021). | 2026-10-08 |
+| #4W704K <!-- issue-ulid:01M2P2QFGQ4W704K34MD30SX6G --> | issue | site_content_release_records_immutable is not 'enable always', so session_replication_role = replica bypasses the freeze's only structural protection | Resolved: Configured ENABLE ALWAYS on release records immutability trigger via migration. \| Note: Resolved: Set ENABLE ALWAYS on site_content_release_records_immutable trigger. | 2026-10-13 |
+| #KVYHWZ <!-- issue-ulid:01M2MSJK7HKVYHWZCYMXQT8FES --> | issue | Most of the legacy WA service catalogue carries no source URL or hours yet is marked high confidence | Resolved: Populated missing URLs and hours for legacy WA service records; verified by check:source-acquisitions and check:source-catalogue. | 2026-10-09 |
+| #SW6NN4 <!-- issue-ulid:01M4JGC3JXSW6NN45GNKV5T9DY --> | issue | Therapy NICE citations sit in the original uploaded-file source entry, so the catalogue may count them as part of the upload | Resolved: Decoupled later-added NICE guideline citations from original upload source in therapy provenance views. | 2026-10-13 |
+| #HXC4D4 <!-- issue-ulid:01M2ZSQP26HXC4D4E76HBA0F4E --> | issue | A silent HTTP 400 on long or single-character queries, and a unit-less creatinine range message | Resolved: query length notice shipped in eb55cf1a2d; creatinine unit label and range unit in patient-profile-panel shipped in 2bb565be3d. | 2026-10-08 |
+| #747FC0 <!-- issue-ulid:01M3CR7BFA747FC0DZTR28RYR2 --> | issue | extractSafetyFindings takes about 89 seconds on a single 200,000-character passage, in the 260-character trimming step before any pattern runs | Resolved: Bounded conciseSourceText input to 4,000 characters in src/lib/clinical-safety.ts; added performance test in tests/clinical-safety.test.ts verifying 200,000-character input finishes in 268ms. | 2026-10-08 |
+| #Z9NS6H <!-- issue-ulid:01M2ZSQP7DZ9NS6HAPJQ01M8NM --> | rec | Copy and naming inconsistencies that undercut the product's own safety vocabulary | Resolved: Formatted 86 section summaries with comma separation and terminal periods in cross-mode differentials index using format-differentials-summaries.mjs. | 2026-10-08 |
+| #MFV1Z2 <!-- issue-ulid:01M2ZSQPHBMFV1Z2H76TR0EFHN --> | issue | next dev is OOM-killed after compiling roughly 55-60 routes in sequence | Resolved: Set NODE_OPTIONS=--max-old-space-size=4096 in package.json dev scripts. \| Note: Resolved: Set NODE_OPTIONS=--max-old-space-size=4096 in package.json dev scripts and dev-free-port.mjs. | 2026-10-13 |
+| #V1NYQ0 <!-- issue-ulid:01M3DYQ73KV1NYQ0HW5B1MSKQ7 --> | issue | Claude review workflow: the enableAllProjectMcpServers false setting is still overridden to true | Resolved: Configured enableAllProjectMcpServers: false in settings and claude_args in .github/workflows/claude-review.yml; verified by tests/claude-review-workflow.test.ts. | 2026-10-08 |
+| #9VQVRT <!-- issue-ulid:01M2ZHJ6RQ9VQVRT1WE83M8J03 --> | issue | Draft PRs show a green PR-required gate while twelve heavy CI jobs stay skipped, so draft status is easy to misread as merge-ready | Resolved: Draft PRs in CI workflow explicitly track and label skipped status checks to prevent false green CI. | 2026-10-09 |
+| #T983N9 <!-- issue-ulid:01M484CAZ0T983N99JM3YHZ84T --> | task | CPD: database storage and sync for registrar training milestones (EPAs, WBAs, term assessments) | Resolved: Added database tables and RLS policies for registrar training milestones (EPAs, WBAs, term assessments). | 2026-10-13 |
+| #49Q5FB <!-- issue-ulid:01M4R2MAJY49Q5FBC16DPHA4A8 --> | issue | Unconfirmed claim: 808 D-band sources lack publisher, version and jurisdiction metadata; the cited debt acceptance expired 2026-08-31 | Refreshed docs/release-source-metadata-debt-2026-06-30.json with verified zero-debt status and added regression guard (tests/source-metadata-debt-waiver.test.ts). | 2026-10-16 |
+| #28ECMG <!-- issue-ulid:01M3CHC3QZ28ECMGWJHETGNTXD --> | rec | Agent/crawler readiness: canonical tags, JSON-LD and Markdown discovery are missing on the public surface (audit F26) | Resolved: Added canonical link and Schema.org MedicalWebPage JSON-LD structured metadata in src/app/(search-app)/layout.tsx. | 2026-10-08 |
+| #2S5NFB <!-- issue-ulid:01M4TNNWC62S5NFBQ3WQJ8Q26B --> | task | Two live-monitor scripts cannot use the shared entrypoint helper because the monitor workflow sparse-checks-out only those two files | Added scripts/lib/is-entrypoint.mjs to live-domain-monitor.yml sparse-checkout, converted both live monitor scripts to isDirectEntrypoint, and emptied ALLOWED_RAW (tests/script-entrypoint-guard.test.ts). | 2026-10-16 |
+| #23Q709 <!-- issue-ulid:01M3GND33T23Q7097NSKEER770 --> | issue | scripts/stamp-service-worker.mjs runs in the production build but is missing from Railway's app watch patterns, so a change to it alone never redeploys the site | Resolved: Added /scripts/stamp-service-worker.mjs to watchPatterns in railway.app.json so service worker changes trigger automated builds. | 2026-10-08 |