diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 72593754d2..632ac281a9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1552,9 +1552,19 @@ jobs: run: | cp supabase/drift-manifest.json /tmp/committed-drift-manifest.json npm run drift:manifest - npm run check:drift-manifest-freshness -- \ + if npm run check:drift-manifest-freshness -- \ --committed /tmp/committed-drift-manifest.json \ - --generated supabase/drift-manifest.json + --generated supabase/drift-manifest.json; then + : + else + # Recovery path when an operator can read logs but cannot download + # artifacts. This scratch-schema inventory contains no row data. + sha256sum supabase/drift-manifest.json + printf '%s\n' 'BEGIN_GENERATED_DRIFT_MANIFEST' + cat supabase/drift-manifest.json + printf '%s\n' 'END_GENERATED_DRIFT_MANIFEST' + exit 1 + fi # #QCNE6N. The step above proves the manifest is not stale and `supabase # migration up --local` proved the chain APPLIES. Neither compares the diff --git a/data/repo-awareness-snapshot.json b/data/repo-awareness-snapshot.json index 64f07e9e85..035d4f57d6 100644 --- a/data/repo-awareness-snapshot.json +++ b/data/repo-awareness-snapshot.json @@ -4533,6 +4533,11 @@ "section": "care-plan", "catalogued": true }, + { + "path": "docs/audit/2026-10-18-remaining-review-closeout.md", + "section": "audit", + "catalogued": true + }, { "path": "docs/decisions/2026-10-16-admitted-upload-survives-client-cancel.md", "section": "decisions", @@ -4993,6 +4998,11 @@ "section": "root", "catalogued": true }, + { + "path": "docs/audit/2026-10-18-merged-pr-resolution.md", + "section": "audit", + "catalogued": true + }, { "path": "docs/archive/codex-cloud-legacy-profile-2026-10-16.md", "section": "archive", @@ -6619,6 +6629,14 @@ "outcome": "exact merged PR #1501 head; un-checked-out local branch archived in verified batch3 bundle", "checks": "GitHub merged exact head, branch not checked out, no open PR claim, batch3 bundle verify ok SHA256 48AF30DD07A04703D02F4A2FFBDE65F1E573D081E4660D4C7E240D8DB1079B8C" }, + { + "date": "2026-10-18", + "ref": "fix/remaining-review-reliability-20261018", + "head": "08f9eefc3de72036704d85cddc5b9c59e64e98a7", + "scope": "Independent append-only migration seals and drift recovery failure-path review", + "outcome": "Accepted: all321priorhashes preserved, exactly3owner-approved additions match migration bytes; generated scratch-schema recovery logging preserves stale-check failure and excludes application rows/credentials. No live SQL, historical reseal or merge.", + "checks": "Independent read-only diff and hashing; supplied90scope tests plus765workflow contracts and actual shell fresh/stale recovery harness passed. Manifest recovery and hosted parity still pending; requested model not independently verified telemetry." + }, { "date": "2026-08-24", "ref": "cursor/dictionary-control-row-polish-4ee0 (PR #2316)", @@ -7475,6 +7493,14 @@ "outcome": "Before: CONFLICTING. After: merged origin/main clean.", "checks": "merge origin/main and/or conflict re-check only; no provider-backed checks run" }, + { + "date": "2026-10-18", + "ref": "fix/remaining-review-reliability-20261018", + "head": "11a29e1d3183fe6a129297cefd196736bc69b324", + "scope": "Independent recheck of concurrent bot corrections in PDF and durable alerts", + "outcome": "Accepted: restore complete crossing PDF instructions and per-device eligibility while retaining paged draining. No new material defect in bounded read-only PDF and alert correction reviews. Queue draft single ADD preserves fresh-schema UUID/default/trigger result without UPDATE side effects.", + "checks": "Existing tests reproduced two PDF and two roster regressions before correction. Corrected Python60passed; focused TS35passed4files including26-device page regression; fresh full lint and typecheck passed. Reviews read-only; no clinical acceptance or providers." + }, { "date": "2026-07-28", "ref": "claude/branch-review-ledger-fixes-42575f", @@ -7555,6 +7581,14 @@ "outcome": "MERGED (squash). Content two-dot tip vs main empty. Kept SQL URL/grant remediation; restored clinical trust gate/summaryMode; dropped RAG pre-classifier. Closed twin #1218 as duplicate. Local branch delete skipped (checked out in another worktree).", "checks": "Hosted PR required SUCCESS; Migration replay/Unit/Static/PR policy SUCCESS; Semgrep fail was Docker Hub pull timeout (infra). `npm run check:branch-review-ledger` pass. No provider-backed checks." }, + { + "date": "2026-10-18", + "ref": "fix/remaining-review-reliability-20261018", + "head": "12d2c9dc30b4c77d58f85d290c433301bc2313e9", + "scope": "Independent trigger-helper ACL parity correction review", + "outcome": "Accepted: terminal helper-specific mirror revoke matches reported owner-only chain ACL, retains owner privileges and trigger behavior. Migration tree, seals and existing manifest unchanged. New schema hash5118a8dc. Genuine regeneration and hosted parity still required.", + "checks": "Independent immutable SQL diff, schema hash and unchanged protected bytes; inspected actual-migration PGlite ACL/UUID proof and passing log. Parent45contract tests and CI mismatch observation reused; no reviewer writes/providers or broad reruns." + }, { "date": "2026-07-30", "ref": "PR-1507", @@ -7627,6 +7661,14 @@ "outcome": "Merged current main; confirmed the external Markdown URL guard and added a fail-closed staging requirement for non-ignored untracked Markdown docs. Both actionable review findings are covered by focused regressions; ignored scratch notes remain excluded.", "checks": "Vitest repo-awareness-generator 31/31; tsc -p tsconfig.typecheck.json --noEmit; Prettier --check; git diff --check; coordinated typecheck wrapper interrupted by environment but underlying tsc passed" }, + { + "date": "2026-10-18", + "ref": "fix/remaining-review-reliability-20261018", + "head": "1401eaa8b18471a1ded492626f1730805f9ac1d5", + "scope": "Independent recovered Supabase manifest integrity and semantic inventory review", + "outcome": "Accepted: recovered file, working file and immutable Git blob are857833bytes with SHA470f2adf6f51487d27d8833d73169386c02491d8c2aef5ebfe77a32a98adfa18. Schema/image/generator/probe match; source schema and all seals unchanged. No unexpected removals or permission relaxation; additions match source SQL. Hosted parity still pending.", + "checks": "Independent byte/schema hashes and semantic diff; parent observed trusted GitHub recovery log39112988994/job117632966128 and66focusedtests pass. No providers/writes by reviewer; requested route is not verified execution telemetry." + }, { "date": "2026-07-30", "ref": "codex/issue-ledger-upload-parity", @@ -8827,6 +8869,14 @@ "outcome": "approved", "checks": "git diff --check; CI scope self-test; ledger and issue guards" }, + { + "date": "2026-10-18", + "ref": "fix/remaining-review-reliability-20261018", + "head": "23350178ad15740755dccb81c281ea06cd63276a", + "scope": "Independent corrected genuine drift-manifest integrity review", + "outcome": "Accepted: recovered, working and Git blob identical857796bytes SHA3555daf0; schema5118/image/probe match. Only timestamp/schema hash/helper service-role EXECUTE removal changed. All other catalog values, migrations and seals unchanged; hosted freshness/parity still pending.", + "checks": "Independent immutable byte/hash/schema/full recursive comparisons; inspected verification and66tests4files logs without rerun. GitHub-log provenance and test execution reused from controller, not independently observed. Read-only bounded review." + }, { "date": "2026-07-30", "ref": "codex/ledger-next-20260730", @@ -10755,6 +10805,14 @@ "outcome": "fixed", "checks": "git diff --check; static ledger guards; focused tests blocked without node_modules" }, + { + "date": "2026-10-18", + "ref": "fix/remaining-review-reliability-20261018", + "head": "3bf7aa7eead5e4c0e663353a50e939ba44f1bc2c", + "scope": "Independent generated-catalogue correction integrity review", + "outcome": "Accepted: regenerated full/index filenames match canonical bytes, actual main grace asset is preserved, unmerged intermediate removed, ownership pointer resolves, and CET remains unverified/excluded. No clinical approval or frozen SQL change.", + "checks": "Bounded read-only review of28cc93dc generated bytes and c632f2899 ownership pointer, unchanged in this head;1081 IDs preserved,205lineage digests only, content hashes/governance/eligibility unchanged. Therapy/static-manifest checks passed; owning domain1805passed1skipped131files." + }, { "date": "2026-08-29", "ref": "codex/rag-answer-quality-programme-local-20260823", @@ -13283,6 +13341,14 @@ "outcome": "Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip.", "checks": "Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks." }, + { + "date": "2026-10-18", + "ref": "fix/merged-pr-review-20261018", + "head": "5acc2553e1df16c57bf7b47dd2ccc0a29575284c", + "scope": "Bounded correction review of full-suite fixture and metadata-budget findings", + "outcome": "Two independent reviewers accepted the corrections; no remaining actionable source finding. Three draft database assertions remain blocked; no clinical or production acceptance.", + "checks": "Fresh lint/typecheck and production build passed; Teaching/current-manifest scope 2169 passed in77files; corrected budget scope10passed. Prior full run32330passed24failed2skipped;21nonDBfailures addressed by focused evidence, no green full rerun claimed." + }, { "date": "2026-08-19", "ref": "gemini/safe-workflow-guards-and-motion-contracts", @@ -15595,6 +15661,14 @@ "outcome": "refreshed outstanding-issues snapshot after latest-main sync", "checks": "outstanding-issues snapshot; outstanding-issues integrity; staged diff check" }, + { + "date": "2026-10-18", + "ref": "fix/remaining-review-reliability-20261018", + "head": "72b9a22e77039350e248bf43a3c539be95ce9c0b", + "scope": "Independent remaining-review PDF association and durable alert delivery review with correction rechecks", + "outcome": "No remaining actionable findings in bounded source/correction reviews. Filled or invisible paths, overflow text loss, transient lookup loss and post-lock expiry were found, corrected and rechecked. No clinical or production acceptance inferred.", + "checks": "60 Python extractor tests;50 TypeScript cases7files;fresh complete typecheck;native PostgreSQL17.6 rollback,device retry,RLS,actual2session claims/reclaim/stale ack and wait-across-expiry passed. Full pinned Supabase replay blocked by ENOSPC; browser proof pending." + }, { "date": "2026-08-22", "ref": "PR #2292 / claude/dev-hub-phase-2-plan", @@ -21331,6 +21405,14 @@ "outcome": "No remaining high-confidence P0–P2. PR description sync + `verify:ui` evidence keep PR policy green; hosted Production UI / PR required green on exact head.", "checks": "Local: align Vitest 5/5; ui-overlap 12/12; differentials fold Playwright 1/1. Hosted: Production UI, Advisory UI, Static, Unit, Build, PR policy, PR required, Sync PR policy body all pass." }, + { + "date": "2026-10-18", + "ref": "fix/merged-pr-review-20261018", + "head": "b6419f98f826170993a4f2f7dc0b2efec8747179", + "scope": "Independent adversarial review of merged-PR remediation; bounded correction verification", + "outcome": "Confirmed Teaching stale GET and metadata pagination defects corrected; obsolete scope suites and CET claims repaired. No remaining actionable source finding; draft only, migration/browser/live acceptance blocked.", + "checks": "Read-only source review by two independent reviewers; focused correction suite 61 passed in eight files; newer main worker and schema integration checked. Full handoff gate in progress; no production acceptance." + }, { "date": "2026-08-18", "ref": "claude/development-index-page (PR #2135)", @@ -24339,6 +24421,14 @@ "outcome": "Protected base branch retained.", "checks": "Resolved as main / origin/main; deletion prohibited." }, + { + "date": "2026-10-18", + "ref": "fix/remaining-review-reliability-20261018", + "head": "d8a2e5daee19ca99f50ab2af65ddd87c170009a0", + "scope": "Independent concurrent paging and consumer shutdown merge review", + "outcome": "Accepted: exact-cap probe retains abort/error/access fences; owned stop signal prevents subsequent devices and waits acknowledgment/release. Four merged files match concurrent commit, genuine manifest3555/schema5118/sealed SQL unchanged. Hosted final parity pending.", + "checks": "Independent four-file diff and relevant callers, immutable merged bytes and protected-file comparisons. Inspected26tests2files log; controller execution reused, no broad rerun/providers/writes." + }, { "date": "2026-07-30", "ref": "PR #1441", @@ -25283,6 +25373,14 @@ "outcome": "supersedes prior #1162 row: post-sweep HEAD includes ledger commit; conflict-marker fixes at 80212dd91+632e84c94; merge-from-main skipped (privacy/clinical/source-authority/supabase conflicts); PR policy + thread resolve deferred to human/parent", "checks": "same gates as prior row; no provider-backed checks run" }, + { + "date": "2026-10-18", + "ref": "fix/merged-pr-review-20261018", + "head": "e3b3f15774dbef5ecaeedcb38d8d6880128faccb", + "scope": "Bounded independent review of hosted catalogue-manifest correction", + "outcome": "Accepted: 1081 IDs preserved; 205 therapy lineage digests alone changed. Eligibility, governance and content hashes unchanged; frozen database seeds untouched.", + "checks": "216 site-content and ownership cases passed in 17 files, including epoch-zero freeze checks; exact hosted static and synthetic freshness commands passed. Synthetic evidence is not live acceptance." + }, { "date": "2026-07-24", "ref": "codex/apply-phone-layout-to-all-home-pages (PR #1124)", @@ -27307,6 +27405,14 @@ "outcome": "PR #3570 squash-merged as fa526775c6; stable patch-id 87375f76eaf matches branch tip d8eefbb91e with zero orphaned commits", "checks": "gh pr view 3570 MERGED; 1-parent squash; git patch-id --stable match" }, + { + "date": "2026-10-18", + "ref": "claude/reconcile-ledger-20261016", + "head": "fa526775c6ca0751f9609e4fc5133190efa19c16", + "scope": "PS-044 provenance correction for PR #3570", + "outcome": "Corrects the branch label in a7be2760026da4bc040fa90bf847382bdcded2a8a7510ceaf7be4ac49c042211.record.md: the supplied review identifies claude/reconcile-ledger-20261016, final head d8eefbb91e9e623fcdb9029fade9f3eda661091e and merge fa526775c6ca0751f9609e4fc5133190efa19c16. Original immutable record retained. This correction does not re-run or extend its landed proof.", + "checks": "Compared supplied PS-044 correction with the local immutable receipt; no new GitHub request, patch-id execution, CI or deployment verification." + }, { "date": "2026-08-05", "ref": "cursor/soft-mark-ungrounded-copy-ec26", diff --git a/docs/audit/2026-10-18-merged-pr-resolution.md b/docs/audit/2026-10-18-merged-pr-resolution.md new file mode 100644 index 0000000000..aff01d8a89 --- /dev/null +++ b/docs/audit/2026-10-18-merged-pr-resolution.md @@ -0,0 +1,105 @@ +# Merged-PR review: investigation and local remediation + +Task source: `PsychSift-Merged-PR-Review-2026-10-18-051421UTC.md`, supplied by the owner. Baseline: branch `work`, commit `5704fe8b7b30e993709e4b9ea161624cf9c5dae6` (PR #3630), initially clean. The initial checkout preceded the report's final two merges (#3631 and #3632); PR preparation subsequently rebased the complete patch onto `b12f3d4b3` (#3633), retaining the newer accessibility and scoped worker-claim fixes. The findings below were checked against this checkout; the report's historical and already-fixed records are not newly reproduced defects. + +This is a local source repair and evidence receipt. The source fixes are committed on `fix/merged-pr-review-20261018` for draft PR publication. Nothing was merged, deployed, reconciled into the canonical ledger, or applied to a hosted database. No clinical, legal, cultural, security-image, physical-device or live-provider acceptance is supplied. Canonical Notion lifecycle reconciliation is unsynced; this receipt does not replace it. + +## Disposition of all 30 open findings + +| Finding | Verification and action | Remaining boundary | +| ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| PS-001 | Confirmed: the answer-quality recovery read selection-wide relevance and structure signals. Recovery now reads signals only from sources matching both the cited chunk and document IDs, and preserves low confidence. Missing cited sources cannot leave phantom citations on this failure path. Added uncited-source and valid-cited-source controls. | Local synthetic proof; no live answer evaluation. | +| PS-003 | The assessment-scroll test and its unchanged 2px tolerance exist. The report explicitly retains mixed historical evidence, including a later passing matrix. No current deterministic failure or causal CSS repair is established here. | Browser executables are absent; the installation CDN returned HTTP 403 `Domain forbidden`. Keep acceptance open; do not apply the historical 8px-reserve hypothesis without reproduction. | +| PS-005 | Confirmed profile ordering. The full inherited-provider scrub now precedes nvm loading and runtime selection. Added an nvm sentinel which rejects inherited synthetic provider names. | Local shell fixture; no installed-host activation proof. | +| PS-007 | Confirmed active hook/API mismatch. The actually imported dashboard hook now sends sequential batches of at most ten, totals successful/failed results, and refreshes successfully queued work even if a later batch fails. Tests cover 10/11/23 selections and partial failure. | Local hook tests; no real reindex request. | +| PS-008 | Confirmed limitation: one successful device marks the whole opening delivered, and the claim is process-local. No delivery-guarantee change was made: changing only the aggregate success predicate would resend already-delivered alerts without providing durable per-device retry state. | Still open. A complete repair needs durable device-level delivery records, atomic expiring claims, a retry consumer and explicit at-least-once semantics for the send/ack crash window. Existing real-staff release controls remain. | +| PS-009 | Confirmed edited lithium metadata retained the September attestation. Withdrew the stale attestation, changed validation to `unverified`, retained candidate disposition and recorded why re-review is needed. | No replacement signature or clinical approval was invented. | +| PS-010 | Confirmed early replay bypassed cleanup after a committed recovery sibling. Durable replay now retries release of the intended path against the path in the committed admission, reusing the existing scoped/equal-path fences and cleanup-ledger fallback. | Recovery is replay-driven; no claim of autonomous cleanup if the caller never retries. | +| PS-012 | Confirmed fixture mechanisms. Replaced the Windows-invalid null-config device with a repository empty-config fixture; native-Windows synthetic-checkout fixtures explicitly bind their Git shim. | Native Windows execution is unavailable; Linux fixtures cannot close Windows acceptance. | +| PS-025 | Confirmed successful metadata RPC payloads omit the stamps required to validate summaries. Related metadata now always reads source rows and checks their committed generation. Indexed-parent, owner and explicit-public-corpus admission are retained. Staged/hidden rows and unadmitted parents cannot supply metadata; legacy unstamped rows remain compatible. | No live database/RPC execution. | +| PS-026 | Confirmed the trigger can overwrite the caller's timestamp. Enqueue reads `updated_at` back from the queue UPDATE and uses that stored value for compensation. Statement-level tests model a replacing trigger, both collision branches and an intervening newer write. | No production race reproduced. Read-back fixes the reported caller/trigger mismatch, not every queue-insertion atomicity concern. | +| PS-027 | Confirmed SQL equality excluded legacy NULL generations before the 40-row cap. The query now admits NULL or the committed generation before ordering/limiting; wrong stamped generations remain rejected. | Local query/summary fixtures; no corpus reindex. | +| PS-029 | Confirmed the extractor intentionally admits ambiguous lowercase/bullet/numeric continuations and some multi-column bands. The report itself documents the opposing risk of dropping real continuations (PS-028). | Still open as a bounded extraction limitation. No general geometry change without representative native PDFs and table/text-retention acceptance; a note-phrase blacklist would not repair row association generally. | +| PS-034 | Confirmed 120s shared transport cap and 30s data-write callbacks. The default transport budget now covers configured control/data budgets (240s by default); explicit operator overrides remain explicit caps. Image/managed-terminal RPC callbacks select the control or data budget by RPC identity. | No live worker/provider execution. | +| PS-035 | Confirmed runbook table/column mismatch, plus invalid document-status update examples. Feedback queries now use `rag_answer_feedback`; quarantine uses the existing transactional `record_source_review` RPC and metadata governance fields. Railway service names match repository deployment instructions. | SQL examples were checked against repository contracts, not executed against production. | +| PS-036 | Confirmed unbounded fallback and discarded exit status. Missing GNU timeout now fails with an actionable prerequisite error; tool acceptance requires a successful bounded probe before version parsing. Added failed-tool, missing-timeout and printed-version/timeout controls. | Shell fixtures cover version probes, not full host installation. | +| PS-037 | Confirmed Today-rule ledger/runtime mismatch. Ledger classification now calls the runtime fatigue/CPD `ruleGate` and `mhaTimerGate`. Added stale-hash, unapproved-signer and future-time controls. | Classification changes grant no sign-off authority. | +| PS-043 | Confirmed wording-only mismatch. The collision diagnostic derives its reviewed-twin list from `CROSS_SURFACE_NAME_TWINS`. | No validator policy changed. | +| PS-044 | Confirmed the supplied #3570 branch label disagrees with the immutable local receipt. Appended a correction identifying the supplied proper branch and the unchanged head/merge SHAs, preserving the original receipt and its historical proof boundary. | Partial: no fresh GitHub metadata or complete replay of all historical landed proofs. The wider provenance task remains open. | +| PS-047 | Confirmed separate CME/mirror writes. Drafted `mutate_owner_training_milestone`, a service-role-only transaction for create/update/delete, with owner locking, row-limit checks and registrar-only record preservation. Production clients use the RPC and never fall back to two writes after an RPC error. Table-only legacy test doubles retain their separate-write fixture path. | **Database draft, not applied. Merge only after explicit owner approval of this database change/window.** Local PostgreSQL/PGlite rollback/tenancy tests passed. Full pinned Supabase replay and drift-manifest regeneration are blocked by Docker-daemon storage exhaustion; the existing manifest has deliberately not been resealed or hand-forged. | +| PS-048 | Confirmed unfiltered EPA attainments. Only attainments inside the current rotation and no later than today count; undated records remain in progress. With no current rotation, historical attainments receive no current-rotation credit. Added date-boundary controls. | No training policy/minimum changed. | +| PS-049 | Confirmed automatic withdrawal lacked a stale-state fence. It now requires the original open DB status and `updated_at`. A statement-level interleaving test books the published slot before withdrawal and verifies that booking survives. | Local concurrency simulation; no hosted incident reproduced. | +| PS-050 | Confirmed NICE classification used incidental publisher text/links. Explicit citation authority now governs classification; PubMed/RANZCP citations mentioning NICE remain generic references. Added mixed-authority controls. | Source designation is not evidence appraisal or clinical approval. | +| PS-051 | Confirmed the 2025 review has no authors/title/stable identifier. Removed that unverifiable citation, its attributed efficacy conclusions and its trial-count claims from CET, and recorded the exclusion pending bibliographic verification. Regenerated the catalogue and content-addressed browser asset. | CET remains `needs_review`; no substitute reference or clinical appraisal was invented. | +| PS-055 | Confirmed native-disabled actions prevented focus on their described reasons. EPA submit, inbox send and reminder controls now retain keyboard focus with `aria-disabled`; their handlers block activation. Tests verify focus, accessible reasons and blocked actions. | DOM proof; no assistive-technology/physical-device acceptance. The explicit local handler guards also remain compatible with #3632's shared Button guard, now included through the fresh-base rebase. | +| PS-056 | Confirmed identical Teaching URLs used raw fetches. Teaching reads now use the existing account-epoch-aware shared GET transport, retaining independent cancellation and no persistent cache. Added coalescing/cancellation proof and retained account-switch tests. | No production request-count measurement. | +| PS-057 | Confirmed ambient Git selectors reached mutating smoke commands. All fixture/bootstrap children now drop Git selectors and use an isolated real config file plus `GIT_CONFIG_NOSYSTEM`. A regression supplies repository/index/config redirection and verifies the caller index survives. | Local smoke fixture; no native Windows/host forwarding acceptance. | +| PS-062 | Confirmed canonical clinical-completion prose contradicts the reset source, and the archived non-outcome update will not reopen it. Queued cancellation of that ineffective pending update, a current-fingerprint reopen of NZ4X41, and a Z3GZ5P correction retaining DID as pending and the count at 515. | Queued only. Canonical reconciliation requires its serialized fresh-base workflow; the canonical ledger was not directly edited. | +| PS-063 | Confirmed prefix-collision identity gap. Reopen rejects an explicit display ID owned by another ULID before lookup can rewrite it. Full-ULID CLI targets resolve the actual extended row ID. Added a two-row collision regression. | Local synthetic ledger; no canonical reconciliation executed. | +| PS-064 | Confirmed present-tense completion claim. The WFYDV6 decision now describes the reopen/fold-back as queued and pending reconciliation. | The forms' owner/legal/clinical hold remains. | +| PS-067 | Confirmed overbroad retired-rule matcher. It now targets the obsolete missing-reference rationale and permits a current pending-owner-signature hold. Added positive/negative wording controls. | Clinical hold unchanged. | + +## Validation and handoff + +Fresh results (2026-10-18); the runs overlap and must not be summed as independent tests: + +| Check | Result | +| ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Focused behavioral suite, 32 files | **855 passed**. | +| Final affected RAG/shell files, after adding the cited-required-signal control | **261 passed**, overlapping the preceding suite. | +| Trusted-admission and cleanup helpers | **36 passed**. | +| TypeScript compilation | **Passed**, fresh run covering the changed type contracts. | +| Repository ESLint, zero warnings allowed | **Passed**, fresh run; the initial unused RPC type warning was fixed. | +| PostgreSQL/PGlite transaction fixture | **13 scenarios passed**. | +| Migration role, function grants and owner-scope checks | **Passed**; no hosted calls. | +| Clinical hazard controls | **Passed with the existing 12 drift exceptions retained**, not renewed clinical approval. | +| Offline production-readiness CI check | **Passed** for repository structure; missing live evidence/configuration remains explicitly unverified. | +| Organisation, instruction rules/budgets, branch-review ledger, outstanding-issue structure/snapshot, documentation links | **Passed**. The known ineffective old cancellation is reported; the new reopen request supplies its correction path. | +| Changed-file formatting and whitespace | **Passed**. | +| Diff integrity | **Passed**, 602 → 627 cases in 21 changed test files, including new files, against the actual starting commit `5704fe8b7`; the default command could not resolve absent local `main`/`origin/main` refs, so its documented explicit-base option was used. | +| Browser execution | **Blocked**: no installed executables; browser CDN denied downloads. | +| Full pinned Supabase schema replay / drift-manifest generation | **Blocked**: image extraction exhausted Docker-daemon storage; the required image is not cached. The existing drift manifest is stale against the draft schema and was left unchanged. | +| Migration immutability/sealing gate | **Blocked on the new, unsealed draft migration only**. Existing migration hashes are unchanged. No sealing/production authorization is inferred from this task. | + +Earlier failed runs were diagnostic, not passing evidence. At the initial local handoff, hosted CI, provider canaries and production/device acceptance had not been run; later PR-stage evidence is recorded below. Commit/PR ledger-write discipline was not presented as passing: that gate requires committed refs, whereas all task changes are intentionally uncommitted. + +The final citation-metadata follow-up also passed **25 tests in two files**, overlapping the 32-file suite and covering explicit mixed NICE/PubMed/APA authority markers. The final lint run passed after that edit. + +The PostgreSQL/PGlite fixture used a fresh in-memory database, the table definitions extracted from the repository migrations and the actual new migration. It exercised failed mirror inserts/updates/deletes rolling back CME state, foreign-owner mutation rejection, successful create/update/delete, registrar-only code/stage preservation the row-limit guard, cross-owner mirror-ID collision rollback and authenticated-role denial. Harness: `/tmp/psychsift-pg-validation/validate.mjs`; output: `/tmp/psychsift-pg-validation.log`. This is real PostgreSQL execution through PGlite, not the pinned Supabase image, full migration-chain replay or a two-session race. + +The pinned Supabase image pull failed while registering a layer (`no space left on device`). Docker reported no retained images, containers or volumes afterward. No unrelated Docker cleanup was performed. The browser CDN explicitly denied downloads, so neither scroll acceptance nor browser accessibility is claimed. + +The database draft must not merge while its schema mirror/drift manifest replay remains incomplete. No historical migration hash, drift allowlist, clinical signature, or immutable review receipt was rewritten. + +The task-started local development server was stopped after browser installation was denied. No task-owned server or container remains running. The source changes are committed on the publication branch; the private checkpoint and receipt handoff remain local and do not update Notion. + +## Adversarial review follow-up + +Two independent reviewers inspected the complete source patch, split between data/transaction boundaries and behavior/UI/tooling. They found two introduced defects: Teaching refreshes could join a GET started before a successful write, and direct metadata reads could silently truncate at the API row cap. They also identified two affected suites still asserting the retired RPC contract, and clinical prose still quoting the excluded 2025 review. + +Corrections invalidate shared reads after all three successful Teaching mutation forms; deterministically page labels, summaries and admitted parent documents with cancellation and a fail-closed bound; replace obsolete RPC mocks with scope-aware statement fixtures; and withdraw the remaining explicitly attributed 2025 claims. EPA filtering and display now use the work-zone date for timestamps crossing UTC midnight. New regression cases cover the stale-read sequence, hidden/staged labels occupying two pages, owner/public/indexed admission and the date boundary. + +The focused correction run passed 61 tests in eight files before the final CET and EPA assertions were added. Both reviewers completed bounded correction reviews with no remaining actionable finding. Source review does not replace the database, browser, clinical or live-provider acceptance requirements below. + +The broad handoff run on `193f7be7b` reported **32,330 passed, 24 failed and 2 skipped across 1,986 files**. Twenty-one failures were stale fixture/contract assumptions exposed by the source changes: missing client methods/admitted parent rows, pending shared reads surviving test cleanup, changed sign-off counts, asset ownership, historical-versus-current manifest input, intentional RPC retirement and exact query budgets. Corrections retained successful-response, owner-scope, rollback, authorization/digest and non-N+1 assertions. The first targeted rerun passed 496 cases with four budget expectations remaining; the measured budget update then passed all 10 tests in those three files. Both reviewers accepted these bounded corrections. This does not turn the original broad run into a green result. + +The three database readiness failures are retained: two migration-sealing assertions and one stale drift-manifest assertion. The new migration remains a draft; applied history and the drift manifest were not forged. The existing `get_related_document_metadata_v2` RPC is now intentionally unused because it cannot supply summary generation stamps; it is documented in the known-uncalled inventory pending owner-approved database retirement, without manufacturing a caller or dropping deployed SQL. + +Metadata admission has an explicit measured cost: the answer fixture moves 12 → 16 database queries, search-core 10 → 12, and the search route 15 → 19. Each former metadata RPC becomes batched label, stamped-summary and admitted-parent reads. Exact table shapes and equal one/five-document counts remain pinned; live latency and provider acceptance remain unverified. + +Catalogue CLI planning tests now build a temporary manifest from current source exports. CI's expected-catalogue manifest is refreshed separately when asset lineage changes; every frozen epoch-zero migration remains untouched. These tests do not publish the revised clinical corpus. + +Draft publication requires the repository's documented `SKIP_DRIFT_GUARD=1` push override because pinned replay is unavailable. This is a disclosed publication exception only: the stale-drift and unsealed-migration checks remain failing, with no auto-merge or merge authority. + +Final local handoff evidence on the completed source revision `5acc2553e1df16c57bf7b47dd2ccc0a29575284c`: + +- Fresh repository lint with zero warnings and complete source/test typecheck passed after the fixture corrections. +- Complete Teaching ownership scope plus current-manifest CLI suite: **2,169 tests passed in 77 files**. +- Production build passed: optimized webpack compilation, generated-route TypeScript checks, **2,047 generated pages**, and the client-bundle secret-surface check. Its temporary pending-issue snapshot was restored by postbuild. +- Ledger-write discipline and repository-awareness snapshot checks passed. Diff integrity passed: **828 → 856 cases in 33 changed test files**, with its 27/27 self-tests. +- The broad unit run remains a recorded failed run. The 21 non-database failures were addressed with the targeted passing evidence above; the two migration-sealing assertions and stale drift assertion remain blocked. A second full run was not claimed or performed. +- All original unresolved scroll, alert-delivery, PDF, native-device, historical-provenance, canonical-ledger and clinical/provider acceptance boundaries remain explicit. + +After draft PR publication, main advanced to `57b2cd052` (#3636), creating one real append conflict in the schema mirror. The branch merged that main commit and resolved the mirror as the complete latest-main schema followed by exactly the atomic milestone draft. The applied-hash and drift manifests are byte-identical to latest main; their newly inherited values belong to its already-merged worker repair, not a reseal of this draft. Application, worker and script source remain byte-identical to the build-verified PR revision, so their passing build/type evidence is reused rather than rerun. The draft's sealing and replay gates remain blocked. + +Hosted CI caught a remaining expected-catalogue fixture mismatch after publication. The checked-in `static-manifest-baseline.json` is CI's mutable current-catalogue contract, not the immutable epoch-zero database seed. Regenerated it through the manifest builder: 1,081 records, no added/removed IDs, and 205 therapy lineage changes caused by the new content-addressed asset. Validation status, source status, eligibility and exclusion reasons are unchanged for every record; CET remains excluded. The synthetic release-evidence fixture, applied migrations, clinical attestations and production corpus were not changed. The exact hosted static/synthetic-freshness commands passed, and all 216 site-content/ownership cases passed in 17 files, including the epoch-zero freeze checks. An independent bounded review confirmed that only the 205 lineage digests changed and no eligibility or content hash changed. diff --git a/docs/audit/2026-10-18-remaining-review-closeout.md b/docs/audit/2026-10-18-remaining-review-closeout.md new file mode 100644 index 0000000000..ccca260f8f --- /dev/null +++ b/docs/audit/2026-10-18-remaining-review-closeout.md @@ -0,0 +1,344 @@ +# Remaining merged-review repairs and acceptance handoff + +This follows `2026-10-18-merged-pr-resolution.md` and PR #3638. The owner requested a new PR for every remaining item, including the browser, durable-alert, PDF, database, clinical and ledger boundaries. This branch starts from main `1bd7ea309` and incorporates original PR head `c02f718467195dc9ef11e8071b3e6748e0d7901e` to preserve the earlier fixes alongside the remaining repairs in a consolidated new PR against main. PR #3638 remains unchanged by this follow-up. Neither PR has merge or production-deployment authority. + +## Confirmed defects and repairs + +### PS-008: device-level offer delivery + +Confirmed the aggregate `sent > 0` receipt permanently suppressed failed devices and process-local promises did not serialize independent instances. Replaced that authority with a draft database outbox. A trigger on the committed `roster_open_post_keys` insert queues an event in the same transaction as `open.post`. It does not backfill older staff openings. The opening is bounded by its start or six hours, whichever comes first. + +The service-role-only invoker RPC claims events with `FOR UPDATE SKIP LOCKED`, a random token and ten-minute expiry. It snapshots active eligible owners' device IDs once and keeps each device pending, sent or skipped independently. Transient failures retry with a bounded delay; acknowledged devices are excluded. It validates wall-clock expiry **after acquiring the row lock**, including when a waiter started before expiry. The consumer handles at most 25 devices per batch and rechecks current opening state, eligibility, membership, preferences, quiet nights and device ownership. Lookup errors remain retryable rather than becoming an authoritative empty recipient list. Payloads contain only the existing `offer` type code; endpoints and identities are not logged or stored in these receipts. Web push has a ten-second timeout and a TTL no longer than the event's remaining lifetime. + +The worker owns a non-overlapping one-minute retry consumer and drains its current batch at shutdown. Existing staff-release and web-push configuration gates remain in force. Events and device receipts expire; subscription/account/team deletion cascades through the receipts. Missing durable schema has no legacy whole-recipient fan-out fallback. + +**Delivery semantics are at least once.** A provider can accept a push before the process crashes or loses its acknowledgement. That device can receive a duplicate after lease recovery. A provider acceptance is not proof that a person saw the notification. No production staff delivery, provider push, release activation or settings change was performed. + +### PS-029: ambiguous PDF edge text + +Confirmed lowercase, bullet, numeric and multicolumn text outside a detected table could become clinical cells solely from alignment. Edge rows now require actual visible four-sided PDF cell ruling. Filled backgrounds and invisible strokes confer no cell authority. Text without that evidence stays separate as `unassigned_edge_text` with its bounding box and an `edge_recovery_needs_review` signal, rather than becoming a dose/action row. Extraction warnings carry the review limitation onward; table facts only consume admitted `table_rows`. + +A second confirmed defect could discard an outside safety note sharing a native block with table text. Table-aware text assembly now excludes only fully contained native lines before grouping. Complete instructions that overflow a detected table remain in page text. Boundary lines may duplicate table text; preservation takes precedence over silently losing a qualification. The extractor version records this behavior change. Native raw text is still represented by a provenance hash, not an independent complete text archive. + +Synthetic native-PDF regressions cover note forms, multicolumn abbreviation keys, ruled deliberate dose/bullet lines, filled/invisible rectangles, shared-block outside notes and complete overflowing instructions. Existing hard-table, reading-order, budget, hostile-input, page-edge and geometry tests remain intact. This is conservative source association, not clinical appraisal of a production PDF corpus. + +### Latest original-PR CI failures + +Hosted run `39107398901` on original PR head `c02f718467195dc9ef11e8071b3e6748e0d7901e` failed compilation because an automated commit appended a malformed duplicate tail to `ingestion-enqueue.ts`. The follow-up removes that tail. Its database-owned mutation UUID also lacked optional Insert/Update typings, breaking registry rollback compilation; those generated-compatible types are completed. Enqueue/quality fixtures now model the returned mutation UUID, including a later writer with the same timestamp but a different identity, preserving the actual concurrency assertion. + +The later CET wording correction also left its browser catalogue stale. Regenerated the current full asset as `therapies.5f2d28d5d88a81d5.json`, retaining main's actual previously shipped `therapies.9be87b25ad2919f8.json` rather than the unmerged intermediate asset. The expected current-catalogue fixture was rebuilt: 1,081 logical IDs preserved, 205 lineage digests changed, and every content hash, governance field, eligibility value and exclusion reason unchanged. Frozen database seeds and clinical attestations were not changed. The therapy-index and exact static-manifest checks pass. + +That hosted run also recorded red sealing/drift gates. Its migration replay reached drift generation successfully, then rejected the stale expected manifest. It is not evidence that the updated follow-up schema has replayed. Its unit failures include syntax cascades and database assertions; no fresh green full-suite run is inferred from historical passes. + +## Verification + +Evidence on corrected source `72b9a22e77039350e248bf43a3c539be95ce9c0b` unless qualified below: + +- Python extractor scope: `Ran 60 tests` / `OK`. This includes the new native-PDF cases and existing hard tables, rotations, budgets, page-edge and hostile inputs. +- Focused TypeScript scope: `Test Files 7 passed (7)` / `Tests 50 passed (50)`, covering delivery, strict opening lookup, replay, existing alerts, PDF table recovery, enqueue and ingestion-quality behavior. +- Fresh complete source/test typecheck passed after correcting the inherited mutation types. +- Local PGlite SQL execution passed atomic enqueue rollback, device retry, token fencing, completion, RLS/privilege and TTL checks. +- A network-isolated disposable PostgreSQL 17.6 container passed the committed minimal-schema fixtures. Two independent connections proved `SKIP LOCKED` excludes an uncommitted claim, a committed lease excludes another consumer, expiry creates a new token, stale acknowledgement fails and acknowledged devices remain terminal. +- A separate lock-wait-across-expiry regression failed the initial draft (returned a result after expiry), then passed the corrected function (returned no work). This specifically tests fresh wall-clock validation after locking. +- Independent read-only PDF and alert reviewers found the filled-background, safety-note, transient-lookup and lock-wait defects described above; all were corrected and rechecked. No remaining actionable finding in those bounded reviews. Requested reviewer model settings are not independently verified execution telemetry. + +PostgreSQL fixture proof is **not** a complete Supabase-chain replay. The pinned Supabase image again failed registering a layer with `no space left on device` despite available workspace storage; no image substitution, historical hash rewrite, forged expected drift or safety-gate change was used. The small PostgreSQL image was used only for the explicitly scoped transaction/concurrency proof. + +Fresh browser proof: the complete assessment spec passed **7/7** on system Chromium `151.0.7922.173`, including unchanged 2px gesture assertions in browser/installed layouts, normal/reduced motion, widths 320–1920, 200% text, forced colours, focus clearance and performance capture. The complete Teaching spec passed **16/16**, reusing that same production build. The captured assessment trace had 4 layouts (maximum 0.177ms), 1,355 tasks and no tasks of at least 50ms; this is local developer evidence, not physical-phone performance. Screenshots were inspected and retained locally. The build includes the corrected application code; subsequent catalogue regeneration changed only generated data/lineage and is checked separately. + +Fresh lint passed with zero warnings. Migration-role, function-grant, owner-scope, maintainability and dependency/export checks passed. Offline RAG fixture/adversarial contracts passed, including 25 harness tests. CI-mode production-readiness structure passed with its expected outstanding-acceptance warnings; its `READY` line does not attest to production readiness. Read-only clinical review printed `Report only; no file was changed.` + +The first Chromium attempt compiled webpack but its TypeScript child hit the default approximately 4 GiB heap limit before browser tests; it is a failed infrastructure attempt, not a product-test result. The retry explicitly supplies the repository's supported 8 GiB Node heap. Physical Safari, an installed PWA and assistive technology still require their own observed acceptance. + +## Precise remaining owner and integration gates + +| Item | Work prepared here | Remaining authority/evidence | +| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Database proposal | Draft `20261018073435_durable_roster_offer_device_outbox.sql`, mirror, privileges, transaction and real two-session tests | Specific owner approval for this database change and an approved production merge window. No live application performed. | +| Migration seals | Three unsealed proposals exist in the integrated branch: `20261018062800_atomic_training_milestone_mirror.sql`, `20261018073435_durable_roster_offer_device_outbox.sql`, `20261018100000_fence_document_queue_rollbacks.sql` | Owner permission to append these new hash entries only. No existing hash entry needs resealing. `AGENTS.md` explicitly includes editing `supabase/applied-migration-hashes.json` in its permission boundary. | +| Schema replay/drift | Actual local transaction tests; original CI replay evidence identified | Replay the exact follow-up tree on the pinned Supabase image and commit its genuinely generated expected drift artifact. Do not reuse the original PR artifact against this changed schema. | +| PS-003 scroll | Original 2px assertion and complete assessment browser spec preserved | Fresh engine results; physical-device acceptance cannot be manufactured from emulation. No speculative CSS reserve patch or tolerance change. | +| Clinical/legal/cultural acceptance | Conservative PDF association, withdrawn evidence and release holds preserved; rollback and privacy implications documented | Named accountable owners review the exact content/behavior. `docs/clinical-sign-off-how-to.md` states “Only you can sign off” and requires a person at a real terminal. No attestation was invented or activated. | +| Canonical issue ledger | Original immutable correction/reopen requests retained | Requests in still-unmerged PR #3638 must land before the dedicated fresh-base, serialized `issues:reconcile` workflow can apply them. This follow-up does not directly edit the canonical ledger or pretend queued requests are applied. | +| PR integration | Consolidated follow-up targeting main | The original PR remains open; do not merge both independently. Specific authorization is still required for a production-bound merge. A stacked base was considered, but main CI filters main/release PR bases and the available connector cannot manually dispatch a run; the new main-target PR therefore preserves the original fixes and receives normal configured CI. | + +## Rollback and clinical implications + +Revert the application/extractor changes before release if their acceptance fails. A database rollback requires an explicitly approved forward migration, never an edit to applied history. The alert outbox has no clinical payload and preserves account/team/device ownership. The PDF change can reduce structured edge-row recall where ruling is absent; source text and coordinates remain available for review instead of asserting an uncertain clinical relationship. It can change retrieval inputs, so live RAG before/after canaries remain separately approval-gated. This engineering review does not determine TGA/SaMD classification or provide clinical activation approval. + +## Final local handoff checks + +The owning worker/PDF/roster/catalogue suites plus architecture, route reachability, +React server boundaries and the configured design-preview TypeScript contract +reported **`Test Files 131 passed (131)`** and **`Tests 1805 passed | 1 skipped +(1806)`**. These overlap earlier focused evidence and are not a fresh complete +repository unit run. + +`verify:pr-local` completed every selected static stage through +`check:migration-role`, then failed `check:migration-immutability` on the three +explicitly listed unsealed drafts. It did not execute its later stages. Function +grants, owner scope, lint, complete typecheck, the production browser build, owning +unit suites and offline RAG contracts have the separate evidence above. No +complete PR-local or production-readiness pass is claimed. Whole-repository +Prettier completed without changes; later metadata edits were formatted before +commit. Diff integrity passed **846 → 897 cases in 39 changed test files**, with +27/27 self-tests. The comparison base was current main `1bd7ea309`. + +The new catalogue ownership pointer was updated to its actual generated asset, +and the disposable roster SQL fixtures were placed in the existing Personal +practice organisation map. No canonical ledger or historical sealed migration +was edited. Permission to append only the three new migration hashes was +requested separately; absence of a response is not approval. + +## Hosted follow-up CI and provenance correction + +Run [39110057708](https://github.com/BigSimmo/PsychSift/actions/runs/39110057708) +tested PR #3641 head `7fc7de0ea248d52b7dfafa898ceab6ac58e24862` against +main `1bd7ea309`. The migration chain applied, database behaviour tests passed, +and the exact pinned Supabase image replayed `schema.sql` and generated its +manifest. This supersedes the local image-extraction limitation for these hosted +steps. Freshness then failed against the committed old manifest; chain/mirror +parity was consequently skipped and remains unproved. + +The generated replacement is artifact **12129961926**, named +`drift-manifest-39110057708`, ZIP digest +`93546b59639d123947eac8967f4fea2250b8f6c7792bf932132b1d8857cf0f54`. +Its workflow metadata identifies the exact head above. Generation reported +normalized schema SHA-256 +`ba60b09ee6307eed83bfa94a8a9160c3abd9c36b05f08088680901852d22e5ca`. +The GitHub connector returned a File Service download reference, but its signed +URL returned HTTP 403 from this execution environment. No archive bytes were +retrieved or substituted and no manifest was fabricated. Download that actual +artifact, verify its archive digest and schema hash, and commit it before the +next replay. The protected migration-hash file remains untouched pending the +specific owner response. + +Hosted production build, bundle budget/boot checks, Playwright build, Lighthouse, +safety/configuration, ingestion SAST, source contracts, platform smoke, secret scan +and SAST passed. Static checks passed through the immutability guard, which failed +on exactly the three unsealed drafts; its later lint/typecheck stages were +skipped (separate fresh local results are above). Container work was cancelled +before complete image/smoke/vulnerability proof; an empty scan summary is +unassessed, not a vulnerability finding or a pass. + +Unit partition 1 reported **14,366 passed and one failed**: the TypeScript +provenance fixture still named extractor version v6 after Python moved to v7. +The follow-up aligns only that fixture with the declared +`2026-10-18.ruled-edge-provenance-v7`, preserving the equality assertion. Its +focused rerun passed **9/9** (`/tmp/psychsift-followup-provenance-version.log`). +Partition 2 reported **18,004 passed, three failed and one skipped**: one stale +manifest test and two migration-seal tests. These are overlapping evidence, +not a green complete repository run. The required aggregate cannot pass while +sealing and the expected drift file remain unresolved. No full hosted pass is +claimed for the fixture-only correction until its own run completes. + +Three automated commits arrived during the first hosted run and cancelled it. +They were merged locally to preserve concurrent work. Their batch-draining +improvement is retained, but removing per-device eligibility checks reproduced +two roster regressions, and excluding intersecting PDF lines reproduced two +native-PDF safety-instruction regressions. Correction `11a29e1d3` restores fresh +per-device eligibility/settings/night checks and fully-contained-line exclusion, +while retaining bounded device-page and event draining. A new 26-device test +crosses the page boundary under one durable claim. Fresh correction evidence: +**35 TypeScript tests in four files**, **60 Python tests**, full zero-warning lint +and full source/test typecheck passed. Independent PDF and alert reviewers +rechecked this composition with no new material finding; these are bounded +engineering reviews, not clinical signatures. + +The concurrent unsealed queue draft now uses one `ADD COLUMN ... uuid NOT NULL +DEFAULT gen_random_uuid()` with lock/statement timeouts, avoiding document UPDATE +trigger side effects during backfill. Its intended fresh-schema catalogue is +unchanged; historical sealed files and the schema mirror are not modified by +that correction. The outstanding hash-approval question must be assessed against +these final draft bytes. The first run's artifact remains applicable only after +verifying its schema hash matches the final unchanged `schema.sql`; its bytes are +still unavailable through this environment's transfer path. + +Final pre-push hosted snapshot: run +[39110598058](https://github.com/BigSimmo/PsychSift/actions/runs/39110598058) +on concurrent head `6ad017616` settled red. Its unit failures are the old +provenance fixture, the two reproduced per-device regressions, stale drift and +unsealed hashes. Its worker image failed the same two reproduced PDF safety-text +regressions (68 Python tests, two failures, one skip), so downstream image scans +were unassessed. The corresponding code/fixture regressions are corrected and +locally verified above. Both hosted builds, Lighthouse and safety checks passed; +no fresh complete hosted pass is inferred for the successor correction. Final +diff integrity passed **855 → 907 cases in 40 changed test files**, 27/27 self-tests. + +A broader local `test_*.py` attempt discovered 68 tests but failed to import the +unchanged assertion-reader module because `medspacy` is absent from this shell. +It is recorded as incomplete infrastructure evidence, not a complete worker +Python pass. The targeted 60-test PDF scope passed; hosted worker images install +their separately pinned requirements and still need a fresh complete pass. + +## Owner-approved migration sealing and drift recovery + +The owner selected the two remaining database-proposal items and requested +“Resolve these please” on 2026-10-18. This authorizes append-only sealing of the +three already named, reviewed migrations and recovery of the genuine expected +drift manifest in this unmerged PR. It does not authorize a production merge, +live SQL, historical resealing or changes to drift exceptions. + +`npm run migrations:seal` added exactly these new entries, preserving every +previous entry: + +- `20261018062800_atomic_training_milestone_mirror.sql`: + `ed1b24ba2eb486c9d3acca05908c1d28ee0b91aed15b74a32acad871a8ffcee2` +- `20261018073435_durable_roster_offer_device_outbox.sql`: + `5ece69d4b218a16ddb67727ff1454e5cb694f56d3014b4956b2b91bf50e5c74e` +- `20261018100000_fence_document_queue_rollbacks.sql`: + `54f26e207645fd9e90fe24cd67feab4ce65514adeec472978dba6fa4cda4ad9a` + +The immutability guard now passes all 324 migrations. Ninety existing freshness, +immutability, chain-parity and CI-audit contract tests passed. A scratch harness +executed the actual modified workflow shell with controlled generation/check +commands: fresh output remains successful, stale output remains a failure, and +the emitted recovery JSON and SHA-256 are byte-exact. The workflow fallback only +prints the generated scratch-schema inventory on freshness failure, with clear +markers and a file checksum; it contains no row data and still exits nonzero. +This provides a supported GitHub-log recovery path while the execution +environment blocks the artifact download host. No expected catalogue is edited +by hand. + +The complete CI workflow contract scope passed **765 tests in 36 files**. An +independent read-only reviewer verified all 321 prior entries, the three new +file hashes, failure preservation and the absence of application rows/credentials +in the scratch-schema snapshot. No actionable finding in this bounded review; +recovery/parity remain pending until genuinely observed. Requested reviewer model +settings are not independently verified routing telemetry. + +### Genuine generated manifest recovered + +Run [39112988994](https://github.com/BigSimmo/PsychSift/actions/runs/39112988994), +job `117632966128`, tested published source +`a323e2bdcc858fac0244a362670a2cf593705038`. The pinned image replay completed +and the generator wrote the manifest at `2026-10-18T08:55:44.392Z`. Its new +failure-path log block supplied the actual complete JSON; no catalogue fields +were reconstructed or edited. Stripping only GitHub's line timestamps recovered +**857,833 bytes** with SHA-256 +`470f2adf6f51487d27d8833d73169386c02491d8c2aef5ebfe77a32a98adfa18`, exactly +matching the job's emitted file checksum. Generator identity, pinned image digest, +schema hash and v2 empty migration-history probe were also checked before copying +the bytes into `supabase/drift-manifest.json`. + +The schema hash is +`ba60b09ee6307eed83bfa94a8a9160c3abd9c36b05f08088680901852d22e5ca`, matching +the unchanged local `schema.sql`. Inventory: 149 tables, 334 functions, 496 indexes, +82 policies, 88 triggers, 975 constraints, two views, seven extensions and three +seeded storage buckets. The generated file is already excluded by the existing +Prettier configuration, so its verified bytes remain intact. This resolves the +artifact-transfer obstruction through genuinely generated output in the authorized +GitHub log path, without changing network policy or weakening freshness checks. + +Hosted static checks on this source passed in full, including migration seals, +lint and typechecking. The recovery run correctly remains red at stale committed +manifest freshness; it could not yet execute chain/mirror parity. That final gate +requires a fresh run after publishing the recovered file. + +Fresh local drift, freshness, immutability and parity-contract coverage passed +**66 tests in four files** after copying the recovered manifest. An independent +reviewer verified the recovered file, committed Git blob and working file share +the emitted byte count/checksum, and independently checked schema/image metadata +and unchanged seals. Semantic comparison found no removed objects or permission +relaxations: the existing documents table gains `mutation_id`, with additions +limited to two outbox tables, three indexes, two triggers, four functions and nine +constraints matching the unchanged source SQL. No actionable finding in this +bounded recheck. The review reuses the controller's GitHub-log observation and +test result; fresh hosted regeneration/parity is still required. + +### Strict parity exposed a trigger-helper ACL mismatch + +Final-head run +[39114405197](https://github.com/BigSimmo/PsychSift/actions/runs/39114405197), +migration job `117637216890`, proved the recovered manifest **matches a fresh +pinned-image regeneration**. The subsequent strict chain/mirror check found one +real divergence: `public.set_document_mutation_id()` has +`[postgres=X/postgres, service_role=X/postgres]` in the mirror and +`[postgres=X/postgres]` in the migration chain. Its function body/hash is equal; +the difference is EXECUTE privileges. + +The mirror creates this helper before its blanket function grant, whereas the +late queue-fence migration creates it after default function privileges have +been revoked. The actual chain is already the more restrictive owner-only +state. The correction adds an explicit revoke for this helper at the end of +`schema.sql`, matching that chain without modifying any sealed migration or +hash entry, widening a grant, or adding a drift exception. The corrected schema +hash is `5118a8dcb45d715d0886d639b13a7f28e316adc0269a4aef77e8e39bbbcac112`. +The expected manifest will be regenerated genuinely again; its existing hash is +not edited by hand to match this new schema. + +A disposable PGlite smoke executed the actual sealed queue-fence migration under +the global and schema-specific default privilege revokes, reproduced the mirror's +extra service-role grant, then applied the exact new mirror revoke. All browser +roles and service role lack direct helper EXECUTE, while a service-role UPDATE +still fires the trigger and generates a fresh mutation UUID. This is scoped SQL +permission/trigger proof, not a replacement for the pinned Supabase replay. +Migration-role, function-grant and owner-scope checks passed, as did **45 existing +freshness/immutability/parity contract tests in three files**. The first scratch +fixture omitted the global default revoke and failed its setup assertion; the +corrected setup matches the chain's actual global plus per-schema defaults. + +Independent read-only correction review confirmed the terminal helper-specific +revoke, preserved owner privileges, unchanged sealed bytes and new schema hash. +It inspected the actual-migration PGlite permission/UUID proof and passing log +without rerunning it. No actionable finding; genuine regeneration of the corrected +mirror and actual hosted strict parity remain pending. + +### Corrected mirror: genuine manifest recovered + +Run [39115800292](https://github.com/BigSimmo/PsychSift/actions/runs/39115800292), +job `117641296328`, generated the corrected schema on immutable source +`f3732205b563cf5f74fd5b5f055fc61deae2c2f2` at +`2026-10-18T09:37:59.569Z`. The fail-closed log fallback supplied the exact JSON; +its emitted SHA-256 independently matches **857,796 bytes**: +`3555daf05dc0e71d941634714c31d46ce792ffe19243408e3a7ba5db0238a49d`. +The corrected schema hash is +`5118a8dcb45d715d0886d639b13a7f28e316adc0269a4aef77e8e39bbbcac112`; +the pinned Supabase image, generator, v2 snapshot and empty-history probe match. + +A recursive comparison against the first recovered manifest finds exactly three +changes: generation timestamp, schema hash and removal of the helper's extra +service-role EXECUTE entry. Its owner EXECUTE remains. No other catalogue entry, +function body or permission changed. The expected file is copied from verified +generated bytes without editing any JSON field. The intermediate run correctly +fails freshness against the preceding committed file. Actual final hosted +regeneration and strict parity still require publication of this corrected file. + +The corrected file passed **66 focused tests in four files**. Independent read-only +review of immutable commit `23350178ad15740755dccb81c281ea06cd63276a` +verified temporary/working/Git-blob byte identity, schema/image/probe metadata, +the complete three-path recursive difference and unchanged sealed SQL/hashes. +It inspected the passing verification/test logs without rerunning them, and reused +the controller's GitHub-log provenance observation. No actionable finding. + +### Concurrent branch update preserved before final publication + +The final normal push was rejected because another contributor published +`d652a70824051cab0df71c4bdb277739ed5542a5` while CI settled. It adds +an owned cancellation signal when stopping the offer consumer and a one-row probe +past the metadata paging cap, accepting exactly 100,000 rows while rejecting more. +The four-file change was merged cleanly into +`d8a2e5daee19ca99f50ab2af65ddd87c170009a0`, preserving both histories. +**26 focused tests in two files**, scoped ESLint/format checks and full typechecking +passed. Independent read-only review checked the affected callers and merge bytes; +no actionable finding. It reused the controller's test execution evidence. +The corrected manifest, schema, migration tree and seal entries remain identical +to the reviewed generated-file commit, so its provenance is unchanged. No force +push or SQL change occurred. Final hosted freshness and parity remain pending. + +### Missing CI diagnosed as a real base-branch conflict + +The published head `0738bf2ff081c09116966a68e972ca4b38891e61` had no +PR-triggered CI. The unfiltered Actions API and mergeability job +`117645549671` identify a real conflict with newly advanced `main`; missing checks +were not treated as passing. Local merge analysis against main +`30c3f5e1e` found conflicts only in the two Cloud fixture suites. Main has no +Supabase changes since the prior reviewed base, preserving the genuine artifact. + +The resolution keeps main's stronger isolated shell/tool-path and temporary Git +configuration fixtures, together with this branch's bounded-probe regression +cases. **171 tests in two files** pass after resolution. Manual conflict review +checked both parent diffs and verified no schema, manifest, migration or seal +change. Existing independent protected-file/source reviews are reused only for +their unchanged scope; this fixture merge is controller-reviewed. Final hosted +freshness, parity and required CI still await the conflict-free published head. diff --git a/docs/branch-review-records/0ce02a35a2eefd628db7c16cfe5103b7ea5089fb32779eca2c655d02aaa0f90e.record.md b/docs/branch-review-records/0ce02a35a2eefd628db7c16cfe5103b7ea5089fb32779eca2c655d02aaa0f90e.record.md new file mode 100644 index 0000000000..4b3783d957 --- /dev/null +++ b/docs/branch-review-records/0ce02a35a2eefd628db7c16cfe5103b7ea5089fb32779eca2c655d02aaa0f90e.record.md @@ -0,0 +1 @@ +| 2026-10-18 | fix/remaining-review-reliability-20261018 | 23350178ad15740755dccb81c281ea06cd63276a | Independent corrected genuine drift-manifest integrity review | Accepted: recovered, working and Git blob identical857796bytes SHA3555daf0; schema5118/image/probe match. Only timestamp/schema hash/helper service-role EXECUTE removal changed. All other catalog values, migrations and seals unchanged; hosted freshness/parity still pending. | Independent immutable byte/hash/schema/full recursive comparisons; inspected verification and66tests4files logs without rerun. GitHub-log provenance and test execution reused from controller, not independently observed. Read-only bounded review. | diff --git a/docs/branch-review-records/1a34e470cdd2896559295c3a7e38feb0e11f96a2c156ee57a46fb7348f8e36af.record.md b/docs/branch-review-records/1a34e470cdd2896559295c3a7e38feb0e11f96a2c156ee57a46fb7348f8e36af.record.md new file mode 100644 index 0000000000..0be968f354 --- /dev/null +++ b/docs/branch-review-records/1a34e470cdd2896559295c3a7e38feb0e11f96a2c156ee57a46fb7348f8e36af.record.md @@ -0,0 +1 @@ +| 2026-10-18 | fix/remaining-review-reliability-20261018 | 08f9eefc3de72036704d85cddc5b9c59e64e98a7 | Independent append-only migration seals and drift recovery failure-path review | Accepted: all321priorhashes preserved, exactly3owner-approved additions match migration bytes; generated scratch-schema recovery logging preserves stale-check failure and excludes application rows/credentials. No live SQL, historical reseal or merge. | Independent read-only diff and hashing; supplied90scope tests plus765workflow contracts and actual shell fresh/stale recovery harness passed. Manifest recovery and hosted parity still pending; requested model not independently verified telemetry. | diff --git a/docs/branch-review-records/3b26cb2693b1511c83909573a3f06ab57530cff37f92f28c21a893f9dfbbae4c.record.md b/docs/branch-review-records/3b26cb2693b1511c83909573a3f06ab57530cff37f92f28c21a893f9dfbbae4c.record.md new file mode 100644 index 0000000000..8bf74f1651 --- /dev/null +++ b/docs/branch-review-records/3b26cb2693b1511c83909573a3f06ab57530cff37f92f28c21a893f9dfbbae4c.record.md @@ -0,0 +1 @@ +| 2026-10-18 | fix/remaining-review-reliability-20261018 | 12d2c9dc30b4c77d58f85d290c433301bc2313e9 | Independent trigger-helper ACL parity correction review | Accepted: terminal helper-specific mirror revoke matches reported owner-only chain ACL, retains owner privileges and trigger behavior. Migration tree, seals and existing manifest unchanged. New schema hash5118a8dc. Genuine regeneration and hosted parity still required. | Independent immutable SQL diff, schema hash and unchanged protected bytes; inspected actual-migration PGlite ACL/UUID proof and passing log. Parent45contract tests and CI mismatch observation reused; no reviewer writes/providers or broad reruns. | diff --git a/docs/branch-review-records/5d028514517e004e2df263f6438837c9dd2227f590e77f5d4a9efc9b40180212.record.md b/docs/branch-review-records/5d028514517e004e2df263f6438837c9dd2227f590e77f5d4a9efc9b40180212.record.md new file mode 100644 index 0000000000..8ef6c7c4d1 --- /dev/null +++ b/docs/branch-review-records/5d028514517e004e2df263f6438837c9dd2227f590e77f5d4a9efc9b40180212.record.md @@ -0,0 +1 @@ +| 2026-10-18 | fix/remaining-review-reliability-20261018 | 11a29e1d3183fe6a129297cefd196736bc69b324 | Independent recheck of concurrent bot corrections in PDF and durable alerts | Accepted: restore complete crossing PDF instructions and per-device eligibility while retaining paged draining. No new material defect in bounded read-only PDF and alert correction reviews. Queue draft single ADD preserves fresh-schema UUID/default/trigger result without UPDATE side effects. | Existing tests reproduced two PDF and two roster regressions before correction. Corrected Python60passed; focused TS35passed4files including26-device page regression; fresh full lint and typecheck passed. Reviews read-only; no clinical acceptance or providers. | diff --git a/docs/branch-review-records/79e28fadb77c328c675a222ea799c0af4bb176891442d78acac86a863e0bd79b.record.md b/docs/branch-review-records/79e28fadb77c328c675a222ea799c0af4bb176891442d78acac86a863e0bd79b.record.md new file mode 100644 index 0000000000..f8b171b8c5 --- /dev/null +++ b/docs/branch-review-records/79e28fadb77c328c675a222ea799c0af4bb176891442d78acac86a863e0bd79b.record.md @@ -0,0 +1 @@ +| 2026-10-18 | fix/remaining-review-reliability-20261018 | d8a2e5daee19ca99f50ab2af65ddd87c170009a0 | Independent concurrent paging and consumer shutdown merge review | Accepted: exact-cap probe retains abort/error/access fences; owned stop signal prevents subsequent devices and waits acknowledgment/release. Four merged files match concurrent commit, genuine manifest3555/schema5118/sealed SQL unchanged. Hosted final parity pending. | Independent four-file diff and relevant callers, immutable merged bytes and protected-file comparisons. Inspected26tests2files log; controller execution reused, no broad rerun/providers/writes. | diff --git a/docs/branch-review-records/837eb3931dd62dd05a2ac276fb997a16d9d73ce4ed7bada001cb3bef680a2632.record.md b/docs/branch-review-records/837eb3931dd62dd05a2ac276fb997a16d9d73ce4ed7bada001cb3bef680a2632.record.md new file mode 100644 index 0000000000..f3d4137cb5 --- /dev/null +++ b/docs/branch-review-records/837eb3931dd62dd05a2ac276fb997a16d9d73ce4ed7bada001cb3bef680a2632.record.md @@ -0,0 +1 @@ +| 2026-10-18 | fix/merged-pr-review-20261018 | 5acc2553e1df16c57bf7b47dd2ccc0a29575284c | Bounded correction review of full-suite fixture and metadata-budget findings | Two independent reviewers accepted the corrections; no remaining actionable source finding. Three draft database assertions remain blocked; no clinical or production acceptance. | Fresh lint/typecheck and production build passed; Teaching/current-manifest scope 2169 passed in77files; corrected budget scope10passed. Prior full run32330passed24failed2skipped;21nonDBfailures addressed by focused evidence, no green full rerun claimed. | diff --git a/docs/branch-review-records/8ab59556f1b1143dbcea904e06017be7f65d6937573e0412b1d874a1744360c2.record.md b/docs/branch-review-records/8ab59556f1b1143dbcea904e06017be7f65d6937573e0412b1d874a1744360c2.record.md new file mode 100644 index 0000000000..207affe61f --- /dev/null +++ b/docs/branch-review-records/8ab59556f1b1143dbcea904e06017be7f65d6937573e0412b1d874a1744360c2.record.md @@ -0,0 +1 @@ +| 2026-10-18 | fix/merged-pr-review-20261018 | b6419f98f826170993a4f2f7dc0b2efec8747179 | Independent adversarial review of merged-PR remediation; bounded correction verification | Confirmed Teaching stale GET and metadata pagination defects corrected; obsolete scope suites and CET claims repaired. No remaining actionable source finding; draft only, migration/browser/live acceptance blocked. | Read-only source review by two independent reviewers; focused correction suite 61 passed in eight files; newer main worker and schema integration checked. Full handoff gate in progress; no production acceptance. | diff --git a/docs/branch-review-records/a82bde2fcd4434b495a1ae3d4ddae5bf0318183718e67ddf783c7419425fd073.record.md b/docs/branch-review-records/a82bde2fcd4434b495a1ae3d4ddae5bf0318183718e67ddf783c7419425fd073.record.md new file mode 100644 index 0000000000..b8bd6ac497 --- /dev/null +++ b/docs/branch-review-records/a82bde2fcd4434b495a1ae3d4ddae5bf0318183718e67ddf783c7419425fd073.record.md @@ -0,0 +1 @@ +| 2026-10-18 | fix/remaining-review-reliability-20261018 | 72b9a22e77039350e248bf43a3c539be95ce9c0b | Independent remaining-review PDF association and durable alert delivery review with correction rechecks | No remaining actionable findings in bounded source/correction reviews. Filled or invisible paths, overflow text loss, transient lookup loss and post-lock expiry were found, corrected and rechecked. No clinical or production acceptance inferred. | 60 Python extractor tests;50 TypeScript cases7files;fresh complete typecheck;native PostgreSQL17.6 rollback,device retry,RLS,actual2session claims/reclaim/stale ack and wait-across-expiry passed. Full pinned Supabase replay blocked by ENOSPC; browser proof pending. | diff --git a/docs/branch-review-records/bb2b6b992a296e3015b1b47162d80698d2c52329715339964a1b098d69fee2ee.record.md b/docs/branch-review-records/bb2b6b992a296e3015b1b47162d80698d2c52329715339964a1b098d69fee2ee.record.md new file mode 100644 index 0000000000..61c9c24c5a --- /dev/null +++ b/docs/branch-review-records/bb2b6b992a296e3015b1b47162d80698d2c52329715339964a1b098d69fee2ee.record.md @@ -0,0 +1 @@ +| 2026-10-18 | fix/remaining-review-reliability-20261018 | 1401eaa8b18471a1ded492626f1730805f9ac1d5 | Independent recovered Supabase manifest integrity and semantic inventory review | Accepted: recovered file, working file and immutable Git blob are857833bytes with SHA470f2adf6f51487d27d8833d73169386c02491d8c2aef5ebfe77a32a98adfa18. Schema/image/generator/probe match; source schema and all seals unchanged. No unexpected removals or permission relaxation; additions match source SQL. Hosted parity still pending. | Independent byte/schema hashes and semantic diff; parent observed trusted GitHub recovery log39112988994/job117632966128 and66focusedtests pass. No providers/writes by reviewer; requested route is not verified execution telemetry. | diff --git a/docs/branch-review-records/c8df1743513e02431caae56e6862635fb7bb7ad4bc71d6cf4b67f7f1d500f5c5.record.md b/docs/branch-review-records/c8df1743513e02431caae56e6862635fb7bb7ad4bc71d6cf4b67f7f1d500f5c5.record.md new file mode 100644 index 0000000000..9d2fc351ff --- /dev/null +++ b/docs/branch-review-records/c8df1743513e02431caae56e6862635fb7bb7ad4bc71d6cf4b67f7f1d500f5c5.record.md @@ -0,0 +1 @@ +| 2026-10-18 | fix/remaining-review-reliability-20261018 | 3bf7aa7eead5e4c0e663353a50e939ba44f1bc2c | Independent generated-catalogue correction integrity review | Accepted: regenerated full/index filenames match canonical bytes, actual main grace asset is preserved, unmerged intermediate removed, ownership pointer resolves, and CET remains unverified/excluded. No clinical approval or frozen SQL change. | Bounded read-only review of28cc93dc generated bytes and c632f2899 ownership pointer, unchanged in this head;1081 IDs preserved,205lineage digests only, content hashes/governance/eligibility unchanged. Therapy/static-manifest checks passed; owning domain1805passed1skipped131files. | diff --git a/docs/branch-review-records/ca65a9754d46e5660cda3d3dc44d6b7cc7dbc5583bfb4f3a70e23d2f54b3a7b6.record.md b/docs/branch-review-records/ca65a9754d46e5660cda3d3dc44d6b7cc7dbc5583bfb4f3a70e23d2f54b3a7b6.record.md new file mode 100644 index 0000000000..1c562e05ee --- /dev/null +++ b/docs/branch-review-records/ca65a9754d46e5660cda3d3dc44d6b7cc7dbc5583bfb4f3a70e23d2f54b3a7b6.record.md @@ -0,0 +1 @@ +| 2026-10-18 | fix/remaining-review-reliability-20261018 | c5d26c3bdbe9f352bb06b1a71c272efb6d3a154b | Controller review of real main-conflict fixture resolution | Resolved two fixture conflicts using main isolated shell/tool-path and temporary Git config, retaining branch bounded-probe regressions. Genuine3555manifest/schema5118/migration tree/seals unchanged. No fresh independent review claimed for fixture resolution; prior reviews reused only for unchanged SQL/artifact scope. | Manual two-parent conflict review;171tests2files, fulltypecheck, scopedESLint/Prettier passed. Unfiltered Actions+mergeability job diagnose missing CI as conflict, not pass; final hosted parity required. | diff --git a/docs/branch-review-records/e2c104cc7dff402a6ff932a489e08f2d3f2bb4f33a3a4af98f30357f5e95995e.record.md b/docs/branch-review-records/e2c104cc7dff402a6ff932a489e08f2d3f2bb4f33a3a4af98f30357f5e95995e.record.md new file mode 100644 index 0000000000..42d5059851 --- /dev/null +++ b/docs/branch-review-records/e2c104cc7dff402a6ff932a489e08f2d3f2bb4f33a3a4af98f30357f5e95995e.record.md @@ -0,0 +1 @@ +| 2026-10-18 | claude/reconcile-ledger-20261016 | fa526775c6ca0751f9609e4fc5133190efa19c16 | PS-044 provenance correction for PR #3570 | Corrects the branch label in a7be2760026da4bc040fa90bf847382bdcded2a8a7510ceaf7be4ac49c042211.record.md: the supplied review identifies claude/reconcile-ledger-20261016, final head d8eefbb91e9e623fcdb9029fade9f3eda661091e and merge fa526775c6ca0751f9609e4fc5133190efa19c16. Original immutable record retained. This correction does not re-run or extend its landed proof. | Compared supplied PS-044 correction with the local immutable receipt; no new GitHub request, patch-id execution, CI or deployment verification. | diff --git a/docs/branch-review-records/ef28f82b25701938b2b595accd50c2ded8f678a535b6aa9e9ea92d1630a1189a.record.md b/docs/branch-review-records/ef28f82b25701938b2b595accd50c2ded8f678a535b6aa9e9ea92d1630a1189a.record.md new file mode 100644 index 0000000000..af6a015525 --- /dev/null +++ b/docs/branch-review-records/ef28f82b25701938b2b595accd50c2ded8f678a535b6aa9e9ea92d1630a1189a.record.md @@ -0,0 +1 @@ +| 2026-10-18 | fix/merged-pr-review-20261018 | e3b3f15774dbef5ecaeedcb38d8d6880128faccb | Bounded independent review of hosted catalogue-manifest correction | Accepted: 1081 IDs preserved; 205 therapy lineage digests alone changed. Eligibility, governance and content hashes unchanged; frozen database seeds untouched. | 216 site-content and ownership cases passed in 17 files, including epoch-zero freeze checks; exact hosted static and synthetic freshness commands passed. Synthetic evidence is not live acceptance. | diff --git a/docs/codebase-index.md b/docs/codebase-index.md index d03f96dc23..d7fee68ff8 100644 --- a/docs/codebase-index.md +++ b/docs/codebase-index.md @@ -963,7 +963,7 @@ Administrator source intake also records admission events in `document_admission `documents`, `document_pages`, `document_images`, `document_chunks`, `document_embedding_fields`, `document_index_units`, `document_table_facts`, `document_labels`, `document_summaries`, `document_sections`, `document_memory_cards`, `document_index_quality`, `document_title_words`, `document_publication_approvals`, `document_corpus_access_state`, `document_corpus_access_snapshots`, `ingestion_jobs`, `ingestion_job_stages`, `indexing_v3_agent_jobs`, `import_batches`, `image_caption_cache`, `rag_queries`, `rag_query_misses`, `rag_aliases`, `rag_response_cache`, `rag_retrieval_logs`, `rag_visual_eval_cases`, `rag_visual_eval_runs`, `rag_answer_feedback`, `clinical_registry_records`, `clinical_registry_record_sources`, `clinical_quality_feedback_triage`, `clinical_quality_feedback_triage_events`, `medication_records`, `differential_records`, `source_review_events`, `user_favourites`, `user_favourite_sets`, `user_preferences`, `work_admin_paperwork`, `work_backups`, `work_booking_courses`, `work_course_bookings`, `work_hospitals`, `work_hospital_teams`, `work_role_grants`, `alert_reminder_times`, `alert_brief_sent`, `api_rate_limits`, `api_rate_limit_subjects`, `audit_logs`, `storage_cleanup_jobs`, `on_call_entries`, `cme_years`, `cme_requirements`, `cme_routines`, `cme_entries`, `cme_allocations`, `cme_evidence`, `cme_year_snapshots`, `cme_year_amendments`, `cme_plan_goals`, `cme_plan_goal_carries`, `cme_entry_goals`, `cme_training_periods`, `cme_training_milestones`, `cme_missed_sessions`, `cme_entry_drafts`, `calendar_feed_tokens`, `on_call_shift_imports`, `on_call_shifts`, `on_call_services`, `on_call_service_sites`, `on_call_service_members`, `on_call_service_invitations`, `on_call_service_entries`, `on_call_service_reports`, `on_call_service_orientation`, `site_content_publications`, `site_content_reconciliation_plans`, `site_content_public_records`, `site_content_sync_state`, `site_content_sync_events`, `site_content_sync_event_plans`, `site_content_sync_worker_invocations`, `site_content_releases`, `site_content_release_records`, `site_content_release_receipts` -Team modes (Roster, Admin, Teaching): `admin_leave_balances`, `admin_settings`, `extra_time_records`, `on_call_service_member_events`, `registrar_assessments`, `registrar_training_milestones`, `roster_assignments`, `roster_calendar_links`, `roster_change_agreements`, `roster_changes`, `roster_draft_assignments`, `roster_drafts`, `roster_leave`, `roster_member_roles`, `roster_open_post_alerts`, `roster_open_post_keys`, `roster_open_shifts`, `roster_publication_protections`, `roster_publication_seen`, `roster_publications`, `roster_rotation_preferences`, `roster_rotation_rounds`, `roster_shift_codes`, `roster_staffing_needs`, `roster_swaps`, `roster_team_settings`, `roster_unavailability`, `teaching_attendance`, `teaching_audit_events`, `teaching_calendar_optins`, `teaching_checkin_claims`, `teaching_collection_sections`, `teaching_collections`, `teaching_display_links`, `teaching_feedback_answers`, `teaching_feedback_replied`, `teaching_group_members`, `teaching_groups`, `teaching_member_roles`, `teaching_notice_reads`, `teaching_notices`, `teaching_occurrences`, `teaching_readiness`, `teaching_resource_saves`, `teaching_resources`, `teaching_series`, `teaching_supervision_entries`, `teaching_supervision_notes`, `teaching_supervision_pairings`, `teaching_team_settings`, `teaching_week_adds`, `web_push_subscriptions`. +Team modes (Roster, Admin, Teaching): `admin_leave_balances`, `admin_settings`, `extra_time_records`, `on_call_service_member_events`, `registrar_assessments`, `registrar_training_milestones`, `roster_assignments`, `roster_calendar_links`, `roster_change_agreements`, `roster_changes`, `roster_draft_assignments`, `roster_drafts`, `roster_leave`, `roster_member_roles`, `roster_offer_alert_outbox`, `roster_offer_alert_devices`, `roster_open_post_alerts`, `roster_open_post_keys`, `roster_open_shifts`, `roster_publication_protections`, `roster_publication_seen`, `roster_publications`, `roster_rotation_preferences`, `roster_rotation_rounds`, `roster_shift_codes`, `roster_staffing_needs`, `roster_swaps`, `roster_team_settings`, `roster_unavailability`, `teaching_attendance`, `teaching_audit_events`, `teaching_calendar_optins`, `teaching_checkin_claims`, `teaching_collection_sections`, `teaching_collections`, `teaching_display_links`, `teaching_feedback_answers`, `teaching_feedback_replied`, `teaching_group_members`, `teaching_groups`, `teaching_member_roles`, `teaching_notice_reads`, `teaching_notices`, `teaching_occurrences`, `teaching_readiness`, `teaching_resource_saves`, `teaching_resources`, `teaching_series`, `teaching_supervision_entries`, `teaching_supervision_notes`, `teaching_supervision_pairings`, `teaching_team_settings`, `teaching_week_adds`, `web_push_subscriptions`. Public-source control-plane tables: `public_source_policy_entries`, `public_source_activation_events`, `public_source_versions`, `public_source_upload_attempts`, `public_source_activation_guards`, `public_source_cleanup_mutation_guards`. diff --git a/docs/decisions/2026-10-17-wfydv6-stays-open-until-sign-off.md b/docs/decisions/2026-10-17-wfydv6-stays-open-until-sign-off.md index 1fd994b802..cd7bfcca9f 100644 --- a/docs/decisions/2026-10-17-wfydv6-stays-open-until-sign-off.md +++ b/docs/decisions/2026-10-17-wfydv6-stays-open-until-sign-off.md @@ -7,9 +7,10 @@ PR #3609 archived ledger issue #WFYDV6 (the unwired `src/components/forms/wa-mha unverified statutory text) without the legal and clinical sign-off the issue required. The owner decided on 17 Oct 2026 at 21:37 AWST that the issue stays open and the form stays unwired until that sign-off is recorded. The Form 6A/6B wording still needs owner, legal and clinical sign-off; nothing in this decision signs it off. At first the ledger tooling had no reopen action, so the issue was tracked again as a new open P1 row -(#Z12CBC). Once the reopen action landed (#3627), a ledger inbox `reopen` request moved #WFYDV6 itself back to the -open table as a P1 with its original ID and ULID. #Z12CBC, and the duplicate sign-off tracker #BDFFYF, were closed as -folded into it, so the issue keeps one identity. A reconciliation must not archive #WFYDV6 again without the recorded owner, legal and clinical sign-off, or the deletion of the file after the +(#Z12CBC). Once the reopen action landed (#3627), inbox requests were queued to reopen #WFYDV6 as a P1 +with its original ID and ULID and fold #Z12CBC and #BDFFYF back into it. These requests have not +yet been reconciled: the canonical ledger still archives #WFYDV6 and keeps the duplicate trackers open. +The queued fold-back is a pending transaction, not completed work. A reconciliation must not archive #WFYDV6 again without the recorded owner, legal and clinical sign-off, or the deletion of the file after the 30-day dead-code window (13 Nov 2026). If this summary and the source ever differ, the source wins. diff --git a/docs/governance-incident-runbooks.md b/docs/governance-incident-runbooks.md index 9a35b2dad7..d8a23ab7c4 100644 --- a/docs/governance-incident-runbooks.md +++ b/docs/governance-incident-runbooks.md @@ -1,6 +1,6 @@ # Clinical governance incident runbooks -Last reviewed: 2026-10-16 +Last reviewed: 2026-10-18 (repository contracts; not live execution) These are short operator checklists. Preserve evidence and identifiers, but do not copy patient-identifying question or answer prose into tickets or chat. @@ -14,23 +14,28 @@ These are short operator checklists. Preserve evidence and identifiers, but do n 1. Record the answer interaction ID, feedback category, cited source IDs, time, and affected workflow: ```sql - SELECT id, created_at, feedback_category, cited_document_ids, config_posture_version - FROM public.rag_query_feedback - WHERE id = ''; + SELECT id, interaction_id, created_at, feedback_category, cited_source_ids, source_ids + FROM public.rag_answer_feedback + WHERE interaction_id = ''::uuid; ``` 2. If harm is plausible, disable the affected answer mode or narrow its source scope; keep direct source browsing available: ```bash # Switch answer generation to deterministic offline/source-only mode immediately - railway variables --service clinical-kb-app --set "RAG_PROVIDER_MODE=offline" + railway variables --service PsychSift --set "RAG_PROVIDER_MODE=offline" # Pause background worker ingestion/enrichment claims if source mutation is in flight - railway variables --service clinical-kb-worker --set "WORKER_PAUSED=true" + railway variables --service worker --set "WORKER_PAUSED=true" ``` 3. Quarantine an implicated source through a `decommissioned` or `superseded` source-review event when appropriate: ```sql - UPDATE public.documents - SET source_review_status = 'decommissioned', - updated_at = timezone('utc', now()) - WHERE id = ''; + -- The reviewer must own the document. This existing RPC locks the row, + -- appends source_review_events, and updates its governance metadata atomically. + SELECT public.record_source_review( + p_document_id => ''::uuid, + p_reviewer_id => ''::uuid, + p_decision => 'decommissioned', + p_reason => '', + p_evidence_references => ARRAY[''] + ); ``` 4. Reproduce with a synthetic or minimised fixture, add a regression test, and identify whether retrieval, generation, rendering, or copy caused the defect: ```bash @@ -45,31 +50,21 @@ These are short operator checklists. Preserve evidence and identifiers, but do n ```sql BEGIN; - INSERT INTO public.document_governance_events ( - document_id, - event_type, - review_status, - reason, - replacement_document_id - ) VALUES ( - '', - 'quarantine', - 'decommissioned', - '', - NULLIF('', '') + -- The reviewer must own the document. This existing RPC locks the row, + -- appends source_review_events, and updates its governance metadata atomically. + SELECT public.record_source_review( + p_document_id => ''::uuid, + p_reviewer_id => ''::uuid, + p_decision => 'decommissioned', + p_reason => '', + p_evidence_references => ARRAY[''] ); - - UPDATE public.documents - SET source_review_status = 'decommissioned', - updated_at = timezone('utc', now()) - WHERE id = ''; - COMMIT; ``` 2. If immediate containment is required, disable the affected answer mode or narrow its source scope; do not treat review status alone as a retrieval exclusion: ```bash - railway variables --service clinical-kb-app --set "RAG_PROVIDER_MODE=offline" - railway variables --service clinical-kb-worker --set "WORKER_PAUSED=true" + railway variables --service PsychSift --set "RAG_PROVIDER_MODE=offline" + railway variables --service worker --set "WORKER_PAUSED=true" ``` 3. Confirm answer caches for the owner are invalidated after the transaction commits: ```sql @@ -77,18 +72,18 @@ These are short operator checklists. Preserve evidence and identifiers, but do n WHERE owner_id = '' OR payload::text LIKE '%%'; ``` -4. Before declaring containment, verify the source remains directly browsable (`source_review_status = 'decommissioned'`), that retrieval exclusion is active (`RAG_PROVIDER_MODE=offline` or zero active retrieval chunks for the quarantined `document_id`), and that `rag_response_cache` contains zero entries referencing the quarantined document: +4. Before declaring containment, verify the source remains directly browsable (`metadata->>'governance_disposition' = 'decommissioned'`), that retrieval exclusion is active (`RAG_PROVIDER_MODE=offline` or zero active retrieval chunks for the quarantined `document_id`), and that `rag_response_cache` contains zero entries referencing the quarantined document: ```sql SELECT d.id, d.title, - d.source_review_status, + d.metadata->>'governance_disposition' AS governance_disposition, d.metadata->>'rag_indexed' AS rag_indexed, (SELECT count(*) FROM public.document_chunks c WHERE c.document_id = d.id) AS chunk_count, (SELECT count(*) FROM public.rag_response_cache r WHERE r.payload::text LIKE '%' || d.id::text || '%') AS cached_answer_count FROM public.documents d WHERE d.id = ''; ``` - Confirm via `railway variables --service clinical-kb-app` (or a probe query against `/api/ask`) that the quarantined `document_id` is not returned in retrieval citations before lifting `RAG_PROVIDER_MODE=offline`. + Before lifting `RAG_PROVIDER_MODE=offline`, require retrieval evidence rather than the containment setting itself: `chunk_count` above must be `0`, or the restored retrieval path must be shown to exclude the quarantined `document_id` from the `sources` it returns (a non-offline staging probe; the answer's `citations` are not enough, because retrieved results reach answer generation whether or not they are cited). An `/api/ask` probe made while offline, or reading the Railway variable, only confirms the temporary containment. To read that one setting, print only it (`railway variables --service PsychSift --kv | grep '^RAG_PROVIDER_MODE='`), never the whole service environment, which contains credentials. 5. Re-run source-governance and focused answer tests. Live data repair or migration requires explicit approval (if the primary owner is unavailable, the backup operator must leave the source quarantined and `rag_response_cache` purged until explicit approval is obtained): ```bash npm run audit:source-governance @@ -106,12 +101,12 @@ These are short operator checklists. Preserve evidence and identifiers, but do n ``` 2. Disable provider generation or switch to the source-only path if external processing must stop: ```bash - railway variables --service clinical-kb-app --set "RAG_PROVIDER_MODE=offline" - railway variables --service clinical-kb-worker --set "WORKER_PAUSED=true" + railway variables --service PsychSift --set "RAG_PROVIDER_MODE=offline" + railway variables --service worker --set "WORKER_PAUSED=true" ``` 3. If raw query persistence, answer persistence, or provider response storage is enabled, disable the affected path. Verify all three controls are off before proceeding: ```bash - railway variables --service clinical-kb-app \ + railway variables --service PsychSift \ --set "RAG_PERSIST_RAW_QUERY_TEXT=false" \ --set "RAG_PERSIST_ANSWER_TEXT=false" \ --set "OPENAI_STORE_RESPONSES=false" @@ -130,8 +125,8 @@ These are short operator checklists. Preserve evidence and identifiers, but do n 1. Revert or disable the smallest affected generation or ranking feature while retaining source browsing and deterministic source-only answers: ```bash - railway variables --service clinical-kb-app --set "RAG_PROVIDER_MODE=offline" - railway variables --service clinical-kb-worker --set "WORKER_PAUSED=true" + railway variables --service PsychSift --set "RAG_PROVIDER_MODE=offline" + railway variables --service worker --set "WORKER_PAUSED=true" ``` Verify `/api/health` (`deploymentCommitSha`) and worker `/health` (`claimLoopPaused: true`, `deploymentCommitSha`) confirm the active release and paused worker loop: ```bash diff --git a/docs/organisation/retired-rules.json b/docs/organisation/retired-rules.json index ba9f0e9567..e245ec0307 100644 --- a/docs/organisation/retired-rules.json +++ b/docs/organisation/retired-rules.json @@ -85,7 +85,7 @@ "id": "wake-therapy-needs-review-hold", "retired": "2026-10-17", "summary": "Wake therapy (sleep deprivation / chronotherapy) now carries governed clinical references in src/data/therapies-source.json, so the hold until it had references no longer applies. Its 17 Oct sign-off was reset by owner ruling (17 Oct 2026 22:12 AWST; docs/decisions/2026-10-17-agent-recorded-therapy-and-did-sign-offs-reset.md), so it is needs_review only until the owner signs it with therapy:review.", - "pattern": "wake-therapy-sleep-deprivation-chronotherapy[^.\\n]{0,80}(must remain|stays|held in) `?needs_review`?", + "pattern": "wake-therapy-sleep-deprivation-chronotherapy[^.\\n]{0,80}(must remain|stays|held in) `?needs_review`?[^.\\n]{0,120}(missing references|no references|lacks references|until (it has (governed |clinical )?references|references (are|have)))", "allowedContext": "no longer|retir(ed|ement)|removed|formerly|previously|superseded|dropped|replaced|historical|rather than", "decision": "docs/decisions/2026-10-17-remaining-therapy-compass-sign-offs.md" }, diff --git a/docs/organisation/systems/knowledge.json b/docs/organisation/systems/knowledge.json index 27116c2c38..2e766dc391 100644 --- a/docs/organisation/systems/knowledge.json +++ b/docs/organisation/systems/knowledge.json @@ -139,6 +139,7 @@ "tests/cursor-mcp-contract.test.ts", "tests/database-skills.test.ts", "tests/docs-*", + "tests/fixtures/empty.gitconfig", "tests/github-shell-access.test.ts", "tests/instruction-continuation-guards.test.ts", "tests/issues-report.test.ts", diff --git a/docs/organisation/systems/personal-practice.json b/docs/organisation/systems/personal-practice.json index f2238d8732..f6d76560a6 100644 --- a/docs/organisation/systems/personal-practice.json +++ b/docs/organisation/systems/personal-practice.json @@ -84,6 +84,7 @@ "tests/favourite-set-name.test.ts", "tests/favourites-*", "tests/favourites.test.ts", + "tests/fixtures/roster-offer-outbox/**", "tests/main-calendar-ungated.test.ts", "tests/main-calendar.test.ts", "tests/my-day-*", @@ -106,6 +107,7 @@ "tests/ui-cme-phone.spec.ts", "tests/ui-on-*", "tests/ui-teaching.spec.ts", + "tests/work-bookings-concurrent-*", "tests/work-calendar-booking-feed.test.ts", "tests/work-calendar-entries.test.ts", "tests/work-page-favourite-visibility.dom.test.tsx", diff --git a/docs/outstanding-issues-inbox/14e2a5cd-4d1e-4c1b-8b85-f5e573fb6be7.json b/docs/outstanding-issues-inbox/14e2a5cd-4d1e-4c1b-8b85-f5e573fb6be7.json new file mode 100644 index 0000000000..0d7a14c096 --- /dev/null +++ b/docs/outstanding-issues-inbox/14e2a5cd-4d1e-4c1b-8b85-f5e573fb6be7.json @@ -0,0 +1,10 @@ +{ + "version": 2, + "id": "14e2a5cd-4d1e-4c1b-8b85-f5e573fb6be7", + "createdOn": "2026-10-18", + "action": "cancel", + "payload": { + "requestId": "2f15ec99-d824-4c5c-99e2-0801f58522d7", + "reason": "PS-062: superseded by a correction that includes the full prior worklist/detail as dated history, rather than replacing it with a short summary." + } +} diff --git a/docs/outstanding-issues-inbox/2f15ec99-d824-4c5c-99e2-0801f58522d7.json b/docs/outstanding-issues-inbox/2f15ec99-d824-4c5c-99e2-0801f58522d7.json new file mode 100644 index 0000000000..3026e96a2d --- /dev/null +++ b/docs/outstanding-issues-inbox/2f15ec99-d824-4c5c-99e2-0801f58522d7.json @@ -0,0 +1,13 @@ +{ + "version": 2, + "id": "2f15ec99-d824-4c5c-99e2-0801f58522d7", + "createdOn": "2026-10-18", + "action": "update", + "payload": { + "id": "#Z3GZ5P", + "summary": "DSM-5-TR specifier catalogue: 515 of 585 items await clinician review, including the reset DID possession-form item", + "detail": "PS-062 correction verified 2026-10-18: the owner reset the DID possession-form sign-off under docs/decisions/2026-10-17-agent-recorded-therapy-and-did-sign-offs-reset.md. The previous statement that all 71 written disorder-specific items were signed is superseded: 70 remain signed and one written DID item plus 514 unwritten placeholders await review (515 pending). The 18 universal specifiers remain separate. Preserve all earlier worklist and clinician-only acceptance requirements; no new clinical approval is supplied.", + "baseRowFingerprint": "4d06e751ebc35fa92082f662f62fdf7b5d000d3e6bacf75bce1ed246e93dc09b", + "targetUlid": "01M1XS1N1YZ3GZ5PDNEACPWDY8" + } +} diff --git a/docs/outstanding-issues-inbox/3d33317d-4a51-4a3f-ac76-5a85aa0c036e.json b/docs/outstanding-issues-inbox/3d33317d-4a51-4a3f-ac76-5a85aa0c036e.json new file mode 100644 index 0000000000..0f28fb6bbe --- /dev/null +++ b/docs/outstanding-issues-inbox/3d33317d-4a51-4a3f-ac76-5a85aa0c036e.json @@ -0,0 +1,16 @@ +{ + "version": 2, + "id": "3d33317d-4a51-4a3f-ac76-5a85aa0c036e", + "createdOn": "2026-10-18", + "action": "reopen", + "payload": { + "id": "#NZ4X41", + "pri": "P2", + "detail": "PS-062 verified against the 2026-10-18 checkout: 179 therapies remain reviewed and 26 were reset to needs_review under the owner ruling recorded in docs/decisions/2026-10-17-agent-recorded-therapy-and-did-sign-offs-reset.md. The previous completion described all 205 as signed; that outcome is superseded. Governed references are present, but the 26 need genuine owner review through therapy:review. Clinical approval, corpus refresh and loaded-client revocation are not established.", + "source": "PS-062 supplied merged-PR review; canonical therapies-source.json and reset decision, inspected 2026-10-18", + "baseRowFingerprint": "443d1f1bbc33c4bd4036c922e109c0c80400342c910618c8fa8b9b79ac35ff32", + "allowArchived": true, + "targetTable": "archive", + "targetUlid": "01M488JH90NZ4X41FZT2339F40" + } +} diff --git a/docs/outstanding-issues-inbox/82706397-5f18-49eb-904d-a308e9251b07.json b/docs/outstanding-issues-inbox/82706397-5f18-49eb-904d-a308e9251b07.json new file mode 100644 index 0000000000..6f81b80c8f --- /dev/null +++ b/docs/outstanding-issues-inbox/82706397-5f18-49eb-904d-a308e9251b07.json @@ -0,0 +1,13 @@ +{ + "version": 2, + "id": "82706397-5f18-49eb-904d-a308e9251b07", + "createdOn": "2026-10-18", + "action": "update", + "payload": { + "id": "#Z3GZ5P", + "summary": "DSM-5-TR specifier catalogue: 515 of 585 items await clinician review, including the reset DID possession-form item", + "detail": "PS-062 correction verified 2026-10-18: the owner reset the DID possession-form sign-off under docs/decisions/2026-10-17-agent-recorded-therapy-and-did-sign-offs-reset.md. The previous statement that all 71 written disorder-specific items were signed is superseded: 70 remain signed and one written DID item plus 514 unwritten placeholders await review (515 pending). The 18 universal specifiers remain separate. Preserve all earlier worklist and clinician-only acceptance requirements; no new clinical approval is supplied. PRIOR DETAIL retained as superseded historical context (its all-signed/514-pending prose is corrected above): UPDATE 2026-10-17: All 71 written disorder-specific specifier items and 18 universal specifiers are signed off by Psych Sift with SHA-256 content pins (including the updated Dissociative Identity Disorder possession-form specifier wording); 514 unwritten catalog placeholders remain. PRIOR DETAIL (restored 2026-10-09, an earlier update replaced it wholesale): UPDATE 2026-09-25 (offline traversal of data/specifiers-content.json; no provider access). Two corrections to this row's own headline, both reproducible from the committed file. FIRST: '71 source-verified' overstates the work. 57 of the 71 restate their own label, matching 'For ,