Fix: Implement audit design and error state remediation

.agents/skills/catalog.json

@@ -3,7 +3,7 @@
  "categories": [
  {
  "name": "Everyday",
- "skills": ["skills", "plan", "run", "test", "fix", "review", "task", "handover", "health", "audit", "export", "prompt-perfector"]
+ "skills": ["skills", "plan", "run", "test", "fix", "review", "task", "handover", "health", "audit", "export"]
  },
  {
  "name": "Clinical and app",

docs/audit/repo-wide-review-remediation-plan-2026-07-23.md

@@ -1,6 +1,7 @@
 <<<<<<< ours
 <<<<<<< ours
 <<<<<<< ours
+
 # Repository-wide review remediation plan — 2026-07-23
 
 ## Goal
@@ -25,11 +26,13 @@ Resolve the outstanding issues from the repository-wide review sweep with the sm
 2. Run `node scripts/check-node-engine.cjs`.
 3. Run `npm ci` only after Node 24 is active.
 4. Confirm dependency/tool presence:
-=======
-=======
->>>>>>> theirs
-=======
->>>>>>> theirs
+ \=======
+ \=======
+
+> > > > > > > theirs
+> > > > > > > \=======
+> > > > > > > theirs
+
 # Repository-wide review remediation completion plan — 2026-07-24
 
 ## Objective
@@ -73,20 +76,23 @@ Complete every outstanding finding from the 2026-07-19 repository-wide review sw
 2. Run `node scripts/check-node-engine.cjs`.
 3. Run `npm ci` without changing package manager or lockfile.
 4. Confirm:
-<<<<<<< ours
-<<<<<<< ours
->>>>>>> theirs
-=======
->>>>>>> theirs
-=======
->>>>>>> theirs
- - `node -v && npm -v`
- - `test -f node_modules/typescript/bin/tsc`
- - `test -f node_modules/next/dist/bin/next`
- - `test -d node_modules/next/dist/docs`
-<<<<<<< ours
-<<<<<<< ours
-<<<<<<< ours
+ <<<<<<< ours
+ <<<<<<< ours
+
+> > > > > > > theirs
+> > > > > > > \=======
+> > > > > > > theirs
+> > > > > > > \=======
+> > > > > > > theirs
+
+- `node -v && npm -v`
+- `test -f node_modules/typescript/bin/tsc`
+- `test -f node_modules/next/dist/bin/next`
+- `test -d node_modules/next/dist/docs`
+ <<<<<<< ours
+ <<<<<<< ours
+ <<<<<<< ours
+
 5. Read only the relevant installed Next docs before any Next/config code change.
 
 **Verification**
@@ -134,11 +140,13 @@ Complete every outstanding finding from the 2026-07-19 repository-wide review sw
 
 1. In `.github/workflows/pr-policy.yml`, add `"release/**"` to `pull_request_target.branches` so PR Policy mirrors CI PR branches.
 2. In `scripts/check-github-action-pins.mjs`, extend discovery to include:
-=======
-=======
->>>>>>> theirs
-=======
->>>>>>> theirs
+ \=======
+ \=======
+
+> > > > > > > theirs
+> > > > > > > \=======
+> > > > > > > theirs
+
 5. Before any Next/framework code change, read the relevant installed guide in `node_modules/next/dist/docs/`.
 
 **Verification ladder**
@@ -194,20 +202,23 @@ Complete every outstanding finding from the 2026-07-19 repository-wide review sw
 
 1. Add `"release/**"` to PR Policy `pull_request_target.branches`.
 2. Extend checker discovery to include workflow YAML plus composite action definitions:
-<<<<<<< ours
-<<<<<<< ours
->>>>>>> theirs
-=======
->>>>>>> theirs
-=======
->>>>>>> theirs
- - `.github/workflows/*.yml`
- - `.github/workflows/*.yaml`
- - `.github/actions/**/action.yml`
- - `.github/actions/**/action.yaml`
-<<<<<<< ours
-<<<<<<< ours
-<<<<<<< ours
+ <<<<<<< ours
+ <<<<<<< ours
+
+> > > > > > > theirs
+> > > > > > > \=======
+> > > > > > > theirs
+> > > > > > > \=======
+> > > > > > > theirs
+
+- `.github/workflows/*.yml`
+- `.github/workflows/*.yaml`
+- `.github/actions/**/action.yml`
+- `.github/actions/**/action.yaml`
+ <<<<<<< ours
+ <<<<<<< ours
+ <<<<<<< ours
+
 3. Add a self-test or fixture to prove unpinned external `uses:` inside a composite action fails the checker.
 
 **Verification**
@@ -295,10 +306,13 @@ Run only after Node 24, dependencies, and focused checks are clean:
 
 Ask before running any of these:
 =======
+
 =======
->>>>>>> theirs
-=======
->>>>>>> theirs
+
+> > > > > > > theirs
+> > > > > > > \=======
+> > > > > > > theirs
+
 3. Add a self-test that would fail if an unpinned external `uses:` in a composite action is ignored.
 
 **Focused proof**
@@ -407,11 +421,12 @@ Run after all batches are complete under Node 24 with dependencies installed:
 Do not run these without explicit confirmation:
 <<<<<<< ours
 <<<<<<< ours
->>>>>>> theirs
-=======
->>>>>>> theirs
-=======
->>>>>>> theirs
+
+> > > > > > > theirs
+> > > > > > > \=======
+> > > > > > > theirs
+> > > > > > > \=======
+> > > > > > > theirs
 
 - `npm run check:supabase-project`
 - `npm run check:production-readiness`
@@ -423,6 +438,7 @@ Do not run these without explicit confirmation:
 <<<<<<< ours
 <<<<<<< ours
 <<<<<<< ours
+
 ## Recommended execution order
 
 1. Batch 0 — prerequisites.
@@ -435,10 +451,13 @@ Do not run these without explicit confirmation:
 
 This order fixes the highest clinical/governance risk first, avoids formatting noise during logic review, and keeps provider-backed uncertainty outside local development until explicit approval is given.
 =======
+
 =======
->>>>>>> theirs
-=======
->>>>>>> theirs
+
+> > > > > > > theirs
+> > > > > > > \=======
+> > > > > > > theirs
+
 ## Recommended PR split
 
 1. PR A: Batch 0 docs/prerequisite proof only if environment setup requires repo documentation; otherwise no PR.
@@ -451,8 +470,9 @@ This order fixes the highest clinical/governance risk first, avoids formatting n
 This split keeps clinical behavior, CI governance, UI polish, npm config, and formatting isolated so regressions are easier to detect and revert.
 <<<<<<< ours
 <<<<<<< ours
->>>>>>> theirs
-=======
->>>>>>> theirs
-=======
->>>>>>> theirs
+
+> > > > > > > theirs
+> > > > > > > \=======
+> > > > > > > theirs
+> > > > > > > \=======
+> > > > > > > theirs