Fix confirmed merged-PR review findings and stage atomic milestone repair

data/repo-awareness-snapshot.json

@@ -4973,6 +4973,11 @@
         "section": "root",
         "catalogued": true
       },
+      {
+        "path": "docs/audit/2026-10-18-merged-pr-resolution.md",
+        "section": "audit",
+        "catalogued": true
+      },
       {
         "path": "docs/archive/codex-cloud-legacy-profile-2026-10-16.md",
         "section": "archive",
@@ -13263,6 +13268,14 @@
         "outcome": "Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip.",
         "checks": "Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks."
       },
+      {
+        "date": "2026-10-18",
+        "ref": "fix/merged-pr-review-20261018",
+        "head": "5acc2553e1df16c57bf7b47dd2ccc0a29575284c",
+        "scope": "Bounded correction review of full-suite fixture and metadata-budget findings",
+        "outcome": "Two independent reviewers accepted the corrections; no remaining actionable source finding. Three draft database assertions remain blocked; no clinical or production acceptance.",
+        "checks": "Fresh lint/typecheck and production build passed; Teaching/current-manifest scope 2169 passed in77files; corrected budget scope10passed. Prior full run32330passed24failed2skipped;21nonDBfailures addressed by focused evidence, no green full rerun claimed."
+      },
       {
         "date": "2026-08-19",
         "ref": "gemini/safe-workflow-guards-and-motion-contracts",
@@ -21311,6 +21324,14 @@
         "outcome": "No remaining high-confidence P0–P2. PR description sync + `verify:ui` evidence keep PR policy green; hosted Production UI / PR required green on exact head.",
         "checks": "Local: align Vitest 5/5; ui-overlap 12/12; differentials fold Playwright 1/1. Hosted: Production UI, Advisory UI, Static, Unit, Build, PR policy, PR required, Sync PR policy body all pass."
       },
+      {
+        "date": "2026-10-18",
+        "ref": "fix/merged-pr-review-20261018",
+        "head": "b6419f98f826170993a4f2f7dc0b2efec8747179",
+        "scope": "Independent adversarial review of merged-PR remediation; bounded correction verification",
+        "outcome": "Confirmed Teaching stale GET and metadata pagination defects corrected; obsolete scope suites and CET claims repaired. No remaining actionable source finding; draft only, migration/browser/live acceptance blocked.",
+        "checks": "Read-only source review by two independent reviewers; focused correction suite 61 passed in eight files; newer main worker and schema integration checked. Full handoff gate in progress; no production acceptance."
+      },
       {
         "date": "2026-08-18",
         "ref": "claude/development-index-page (PR #2135)",
@@ -27287,6 +27308,14 @@
         "outcome": "PR #3570 squash-merged as fa526775c6; stable patch-id 87375f76eaf matches branch tip d8eefbb91e with zero orphaned commits",
         "checks": "gh pr view 3570 MERGED; 1-parent squash; git patch-id --stable match"
       },
+      {
+        "date": "2026-10-18",
+        "ref": "claude/reconcile-ledger-20261016",
+        "head": "fa526775c6ca0751f9609e4fc5133190efa19c16",
+        "scope": "PS-044 provenance correction for PR #3570",
+        "outcome": "Corrects the branch label in a7be2760026da4bc040fa90bf847382bdcded2a8a7510ceaf7be4ac49c042211.record.md: the supplied review identifies claude/reconcile-ledger-20261016, final head d8eefbb91e9e623fcdb9029fade9f3eda661091e and merge fa526775c6ca0751f9609e4fc5133190efa19c16. Original immutable record retained. This correction does not re-run or extend its landed proof.",
+        "checks": "Compared supplied PS-044 correction with the local immutable receipt; no new GitHub request, patch-id execution, CI or deployment verification."
+      },
       {
         "date": "2026-08-05",
         "ref": "cursor/soft-mark-ungrounded-copy-ec26",

docs/branch-review-records/837eb3931dd62dd05a2ac276fb997a16d9d73ce4ed7bada001cb3bef680a2632.record.md

@@ -0,0 +1 @@
+| 2026-10-18 | fix/merged-pr-review-20261018 | 5acc2553e1df16c57bf7b47dd2ccc0a29575284c | Bounded correction review of full-suite fixture and metadata-budget findings | Two independent reviewers accepted the corrections; no remaining actionable source finding. Three draft database assertions remain blocked; no clinical or production acceptance. | Fresh lint/typecheck and production build passed; Teaching/current-manifest scope 2169 passed in77files; corrected budget scope10passed. Prior full run32330passed24failed2skipped;21nonDBfailures addressed by focused evidence, no green full rerun claimed. |

docs/branch-review-records/8ab59556f1b1143dbcea904e06017be7f65d6937573e0412b1d874a1744360c2.record.md

@@ -0,0 +1 @@
+| 2026-10-18 | fix/merged-pr-review-20261018 | b6419f98f826170993a4f2f7dc0b2efec8747179 | Independent adversarial review of merged-PR remediation; bounded correction verification | Confirmed Teaching stale GET and metadata pagination defects corrected; obsolete scope suites and CET claims repaired. No remaining actionable source finding; draft only, migration/browser/live acceptance blocked. | Read-only source review by two independent reviewers; focused correction suite 61 passed in eight files; newer main worker and schema integration checked. Full handoff gate in progress; no production acceptance. |

docs/branch-review-records/e2c104cc7dff402a6ff932a489e08f2d3f2bb4f33a3a4af98f30357f5e95995e.record.md

@@ -0,0 +1 @@
+| 2026-10-18 | claude/reconcile-ledger-20261016 | fa526775c6ca0751f9609e4fc5133190efa19c16 | PS-044 provenance correction for PR #3570 | Corrects the branch label in a7be2760026da4bc040fa90bf847382bdcded2a8a7510ceaf7be4ac49c042211.record.md: the supplied review identifies claude/reconcile-ledger-20261016, final head d8eefbb91e9e623fcdb9029fade9f3eda661091e and merge fa526775c6ca0751f9609e4fc5133190efa19c16. Original immutable record retained. This correction does not re-run or extend its landed proof. | Compared supplied PS-044 correction with the local immutable receipt; no new GitHub request, patch-id execution, CI or deployment verification. |

docs/branch-review-records/ef28f82b25701938b2b595accd50c2ded8f678a535b6aa9e9ea92d1630a1189a.record.md

@@ -0,0 +1 @@
+| 2026-10-18 | fix/merged-pr-review-20261018 | e3b3f15774dbef5ecaeedcb38d8d6880128faccb | Bounded independent review of hosted catalogue-manifest correction | Accepted: 1081 IDs preserved; 205 therapy lineage digests alone changed. Eligibility, governance and content hashes unchanged; frozen database seeds untouched. | 216 site-content and ownership cases passed in 17 files, including epoch-zero freeze checks; exact hosted static and synthetic freshness commands passed. Synthetic evidence is not live acceptance. |

docs/decisions/2026-10-17-wfydv6-stays-open-until-sign-off.md

@@ -7,9 +7,10 @@ PR #3609 archived ledger issue #WFYDV6 (the unwired `src/components/forms/wa-mha
 unverified statutory text) without the legal and clinical sign-off the issue required. The owner decided on
 17 Oct 2026 at 21:37 AWST that the issue stays open and the form stays unwired until that sign-off is
 recorded. The Form 6A/6B wording still needs owner, legal and clinical sign-off; nothing in this decision signs it off. At first the ledger tooling had no reopen action, so the issue was tracked again as a new open P1 row
-(#Z12CBC). Once the reopen action landed (#3627), a ledger inbox `reopen` request moved #WFYDV6 itself back to the
-open table as a P1 with its original ID and ULID. #Z12CBC, and the duplicate sign-off tracker #BDFFYF, were closed as
-folded into it, so the issue keeps one identity. A reconciliation must not archive #WFYDV6 again without the recorded owner, legal and clinical sign-off, or the deletion of the file after the
+(#Z12CBC). Once the reopen action landed (#3627), inbox requests were queued to reopen #WFYDV6 as a P1
+with its original ID and ULID and fold #Z12CBC and #BDFFYF back into it. These requests have not
+yet been reconciled: the canonical ledger still archives #WFYDV6 and keeps the duplicate trackers open.
+The queued fold-back is a pending transaction, not completed work. A reconciliation must not archive #WFYDV6 again without the recorded owner, legal and clinical sign-off, or the deletion of the file after the
 30-day dead-code window (13 Nov 2026).
 
 If this summary and the source ever differ, the source wins.

docs/governance-incident-runbooks.md

@@ -1,6 +1,6 @@
 # Clinical governance incident runbooks
 
-Last reviewed: 2026-10-16
+Last reviewed: 2026-10-18 (repository contracts; not live execution)
 
 These are short operator checklists. Preserve evidence and identifiers, but do not copy patient-identifying question or answer prose into tickets or chat.
 
@@ -14,23 +14,28 @@ These are short operator checklists. Preserve evidence and identifiers, but do n
 
 1. Record the answer interaction ID, feedback category, cited source IDs, time, and affected workflow:
    ```sql
-   SELECT id, created_at, feedback_category, cited_document_ids, config_posture_version
-   FROM public.rag_query_feedback
-   WHERE id = '<interaction-or-feedback-id>';
+   SELECT id, interaction_id, created_at, feedback_category, cited_source_ids, source_ids
+   FROM public.rag_answer_feedback
+   WHERE interaction_id = '<interaction-uuid>'::uuid;
    ```
 2. If harm is plausible, disable the affected answer mode or narrow its source scope; keep direct source browsing available:
    ```bash
    # Switch answer generation to deterministic offline/source-only mode immediately
-   railway variables --service clinical-kb-app --set "RAG_PROVIDER_MODE=offline"
+   railway variables --service PsychSift --set "RAG_PROVIDER_MODE=offline"
    # Pause background worker ingestion/enrichment claims if source mutation is in flight
-   railway variables --service clinical-kb-worker --set "WORKER_PAUSED=true"
+   railway variables --service worker --set "WORKER_PAUSED=true"
    ```
 3. Quarantine an implicated source through a `decommissioned` or `superseded` source-review event when appropriate:
    ```sql
-   UPDATE public.documents
-   SET source_review_status = 'decommissioned',
-       updated_at = timezone('utc', now())
-   WHERE id = '<document-uuid>';
+   -- The reviewer must own the document. This existing RPC locks the row,
+   -- appends source_review_events, and updates its governance metadata atomically.
+   SELECT public.record_source_review(
+     p_document_id => '<document-uuid>'::uuid,
+     p_reviewer_id => '<document-owner-reviewer-uuid>'::uuid,
+     p_decision => 'decommissioned',
+     p_reason => '<ticket-or-incident-ref>',
+     p_evidence_references => ARRAY['<evidence-reference>']
+   );
    ```
 4. Reproduce with a synthetic or minimised fixture, add a regression test, and identify whether retrieval, generation, rendering, or copy caused the defect:
    ```bash
@@ -45,50 +50,40 @@ These are short operator checklists. Preserve evidence and identifiers, but do n
    ```sql
    BEGIN;
 
-   INSERT INTO public.document_governance_events (
-     document_id,
-     event_type,
-     review_status,
-     reason,
-     replacement_document_id
-   ) VALUES (
-     '<document-uuid>',
-     'quarantine',
-     'decommissioned',
-     '<ticket-or-incident-ref>',
-     NULLIF('<replacement-document-uuid>', '')
+   -- The reviewer must own the document. This existing RPC locks the row,
+   -- appends source_review_events, and updates its governance metadata atomically.
+   SELECT public.record_source_review(
+     p_document_id => '<document-uuid>'::uuid,
+     p_reviewer_id => '<document-owner-reviewer-uuid>'::uuid,
+     p_decision => 'decommissioned',
+     p_reason => '<ticket-or-incident-ref>',
+     p_evidence_references => ARRAY['<evidence-reference>']
    );
-
-   UPDATE public.documents
-   SET source_review_status = 'decommissioned',
-       updated_at = timezone('utc', now())
-   WHERE id = '<document-uuid>';
-
    COMMIT;
    ```
 2. If immediate containment is required, disable the affected answer mode or narrow its source scope; do not treat review status alone as a retrieval exclusion:
    ```bash
-   railway variables --service clinical-kb-app --set "RAG_PROVIDER_MODE=offline"
-   railway variables --service clinical-kb-worker --set "WORKER_PAUSED=true"
+   railway variables --service PsychSift --set "RAG_PROVIDER_MODE=offline"
+   railway variables --service worker --set "WORKER_PAUSED=true"
    ```
 3. Confirm answer caches for the owner are invalidated after the transaction commits:
    ```sql
    DELETE FROM public.rag_response_cache
    WHERE owner_id = '<owner-uuid>'
       OR payload::text LIKE '%<document-uuid>%';
    ```
-4. Before declaring containment, verify the source remains directly browsable (`source_review_status = 'decommissioned'`), that retrieval exclusion is active (`RAG_PROVIDER_MODE=offline` or zero active retrieval chunks for the quarantined `document_id`), and that `rag_response_cache` contains zero entries referencing the quarantined document:
+4. Before declaring containment, verify the source remains directly browsable (`metadata->>'governance_disposition' = 'decommissioned'`), that retrieval exclusion is active (`RAG_PROVIDER_MODE=offline` or zero active retrieval chunks for the quarantined `document_id`), and that `rag_response_cache` contains zero entries referencing the quarantined document:
    ```sql
    SELECT d.id,
           d.title,
-          d.source_review_status,
+          d.metadata->>'governance_disposition' AS governance_disposition,
           d.metadata->>'rag_indexed' AS rag_indexed,
           (SELECT count(*) FROM public.document_chunks c WHERE c.document_id = d.id) AS chunk_count,
           (SELECT count(*) FROM public.rag_response_cache r WHERE r.payload::text LIKE '%' || d.id::text || '%') AS cached_answer_count
    FROM public.documents d
    WHERE d.id = '<document-uuid>';
    ```
-   Confirm via `railway variables --service clinical-kb-app` (or a probe query against `/api/ask`) that the quarantined `document_id` is not returned in retrieval citations before lifting `RAG_PROVIDER_MODE=offline`.
+   Before lifting `RAG_PROVIDER_MODE=offline`, require retrieval evidence rather than the containment setting itself: `chunk_count` above must be `0`, or the restored retrieval path must be shown to exclude the quarantined `document_id` from the `sources` it returns (a non-offline staging probe; the answer's `citations` are not enough, because retrieved results reach answer generation whether or not they are cited). An `/api/ask` probe made while offline, or reading the Railway variable, only confirms the temporary containment. To read that one setting, print only it (`railway variables --service PsychSift --kv | grep '^RAG_PROVIDER_MODE='`), never the whole service environment, which contains credentials.
 5. Re-run source-governance and focused answer tests. Live data repair or migration requires explicit approval (if the primary owner is unavailable, the backup operator must leave the source quarantined and `rag_response_cache` purged until explicit approval is obtained):
    ```bash
    npm run audit:source-governance
@@ -106,12 +101,12 @@ These are short operator checklists. Preserve evidence and identifiers, but do n
    ```
 2. Disable provider generation or switch to the source-only path if external processing must stop:
    ```bash
-   railway variables --service clinical-kb-app --set "RAG_PROVIDER_MODE=offline"
-   railway variables --service clinical-kb-worker --set "WORKER_PAUSED=true"
+   railway variables --service PsychSift --set "RAG_PROVIDER_MODE=offline"
+   railway variables --service worker --set "WORKER_PAUSED=true"
    ```
 3. If raw query persistence, answer persistence, or provider response storage is enabled, disable the affected path. Verify all three controls are off before proceeding:
    ```bash
-   railway variables --service clinical-kb-app \
+   railway variables --service PsychSift \
      --set "RAG_PERSIST_RAW_QUERY_TEXT=false" \
      --set "RAG_PERSIST_ANSWER_TEXT=false" \
      --set "OPENAI_STORE_RESPONSES=false"
@@ -130,8 +125,8 @@ These are short operator checklists. Preserve evidence and identifiers, but do n
 
 1. Revert or disable the smallest affected generation or ranking feature while retaining source browsing and deterministic source-only answers:
    ```bash
-   railway variables --service clinical-kb-app --set "RAG_PROVIDER_MODE=offline"
-   railway variables --service clinical-kb-worker --set "WORKER_PAUSED=true"
+   railway variables --service PsychSift --set "RAG_PROVIDER_MODE=offline"
+   railway variables --service worker --set "WORKER_PAUSED=true"
    ```
    Verify `/api/health` (`deploymentCommitSha`) and worker `/health` (`claimLoopPaused: true`, `deploymentCommitSha`) confirm the active release and paused worker loop:
    ```bash

docs/organisation/retired-rules.json

@@ -85,7 +85,7 @@
       "id": "wake-therapy-needs-review-hold",
       "retired": "2026-10-17",
       "summary": "Wake therapy (sleep deprivation / chronotherapy) now carries governed clinical references in src/data/therapies-source.json, so the hold until it had references no longer applies. Its 17 Oct sign-off was reset by owner ruling (17 Oct 2026 22:12 AWST; docs/decisions/2026-10-17-agent-recorded-therapy-and-did-sign-offs-reset.md), so it is needs_review only until the owner signs it with therapy:review.",
-      "pattern": "wake-therapy-sleep-deprivation-chronotherapy[^.\\n]{0,80}(must remain|stays|held in) `?needs_review`?",
+      "pattern": "wake-therapy-sleep-deprivation-chronotherapy[^.\\n]{0,80}(must remain|stays|held in) `?needs_review`?[^.\\n]{0,120}(missing references|no references|lacks references|until (it has (governed |clinical )?references|references (are|have)))",
       "allowedContext": "no longer|retir(ed|ement)|removed|formerly|previously|superseded|dropped|replaced|historical|rather than",
       "decision": "docs/decisions/2026-10-17-remaining-therapy-compass-sign-offs.md"
     },

docs/organisation/systems/knowledge.json

@@ -139,6 +139,7 @@
     "tests/cursor-mcp-contract.test.ts",
     "tests/database-skills.test.ts",
     "tests/docs-*",
+    "tests/fixtures/empty.gitconfig",
     "tests/github-shell-access.test.ts",
     "tests/instruction-continuation-guards.test.ts",
     "tests/issues-report.test.ts",

docs/organisation/systems/personal-practice.json

@@ -106,6 +106,7 @@
     "tests/ui-cme-phone.spec.ts",
     "tests/ui-on-*",
     "tests/ui-teaching.spec.ts",
+    "tests/work-bookings-concurrent-*",
     "tests/work-calendar-booking-feed.test.ts",
     "tests/work-calendar-entries.test.ts",
     "tests/work-page-favourite-visibility.dom.test.tsx",

docs/outstanding-issues-inbox/14e2a5cd-4d1e-4c1b-8b85-f5e573fb6be7.json

@@ -0,0 +1,10 @@
+{
+  "version": 2,
+  "id": "14e2a5cd-4d1e-4c1b-8b85-f5e573fb6be7",
+  "createdOn": "2026-10-18",
+  "action": "cancel",
+  "payload": {
+    "requestId": "2f15ec99-d824-4c5c-99e2-0801f58522d7",
+    "reason": "PS-062: superseded by a correction that includes the full prior worklist/detail as dated history, rather than replacing it with a short summary."
+  }
+}

docs/outstanding-issues-inbox/2f15ec99-d824-4c5c-99e2-0801f58522d7.json

@@ -0,0 +1,13 @@
+{
+  "version": 2,
+  "id": "2f15ec99-d824-4c5c-99e2-0801f58522d7",
+  "createdOn": "2026-10-18",
+  "action": "update",
+  "payload": {
+    "id": "#Z3GZ5P",
+    "summary": "DSM-5-TR specifier catalogue: 515 of 585 items await clinician review, including the reset DID possession-form item",
+    "detail": "PS-062 correction verified 2026-10-18: the owner reset the DID possession-form sign-off under docs/decisions/2026-10-17-agent-recorded-therapy-and-did-sign-offs-reset.md. The previous statement that all 71 written disorder-specific items were signed is superseded: 70 remain signed and one written DID item plus 514 unwritten placeholders await review (515 pending). The 18 universal specifiers remain separate. Preserve all earlier worklist and clinician-only acceptance requirements; no new clinical approval is supplied.",
+    "baseRowFingerprint": "4d06e751ebc35fa92082f662f62fdf7b5d000d3e6bacf75bce1ed246e93dc09b",
+    "targetUlid": "01M1XS1N1YZ3GZ5PDNEACPWDY8"
+  }
+}