issues: close #122, record #098 delivery and #130 pre-paint guard design

[BigSimmo]

Summary

Ledger maintenance, bundled per AGENTS.md "PR bundling" — all append-only docs plus one rule-wording fix, each listed on its own bullet. The body was rewritten after review: an earlier version advertised a new row #145, which was withdrawn as a duplicate (see the fourth bullet), so no new id is allocated by this PR.

• Close #122 (ci/circleci: verify fails on every branch and its log needs operator access). Its outcome allowed either branch — "trustworthy signal again, or it stops reporting" — and the second is what happened, so the operator log read is withdrawn rather than still owed. .circleci/config.yml was deleted by 9779828 ("chore: remove CircleCI from repo", PR chore: remove CircleCI from repo #1412), and ls -d .circleci on main returns No such file or directory. Confirmed live rather than only from the tree: PR issues: close #120 as not reproducible on current main #1452's head reported 21 check runs and not one named ci/circleci: verify. The row's quota hypothesis is archived retired unproven — never confirmable without a CircleCI token, and nothing remains to confirm it against.

• Fix a stale rule in AGENTS.md, found while verifying #122. Line 171 cited ci/circleci: verify as a check that fails on unformatted files. It cannot report again, so the rule now names Static PR checks alone and keeps the CircleCI failures as history. This is the only item here a session acts on directly, and it makes the rule more accurate, not more permissive.

• Update #098 (offline round-trip budget harness). PR test(rag): pin Supabase round-trip budgets on the answer path #1450 landed the substance while this branch was open, so the row is corrected rather than left advertising completed work as pending. Verified rather than inferred from filenames: tests/helpers/supabase-round-trip-counter.ts counts on execution, not construction; tests/rag-round-trip-budget.test.ts pins two offline answer-path scenarios plus three counter self-tests; it is registered in scripts/fixtures/rag-offline-contract-tests.json so it runs inside the offline contract. The row stays open with its Next narrowed to the two genuine gaps — /api/search has no budget, and eval-rag-offline / test-rag-offline were not wired — and records the helper's own blind spot: it sees only traffic through the wrapped client, so a budget is evidence about that client, not total request cost.

• Update #130 with the pre-paint/cold-load guard's design, instead of filing it as a new row. #130's Next already owns that guard, and a separate row would repeat the duplication Codex caught on this PR. Recorded: the value under test is the pre-paint reserve seed calc(max(0.5rem, var(--safe-area-top)) + var(--shell-header-h)); the test must sample content top before and after hydration rather than once after, since a single post-hydration read passes on the broken shape; it must run on a zero-inset profile, because the max() under-reserves by max(0, 0.5rem − inset) — zero on a notched iPhone, 8px on Android and Playwright's default emulation — so on a notched profile the assertion cannot fail; and it must be proven against the broken shape before being trusted.

Withdrawn during review: Codex raised a P2 that a newly added #145 duplicated the existing #121 ("Container Playwright browser build lags the pinned client"). Verified against the file — same condition, client 1234 versus container 1194 — so the finding was correct. #145 was removed, its distinct evidence folded into #121, and the id marker rolled back 146 → 145 since it was never live. The thread is answered with the resolution marker.

Verification

npm run verify:pr-local was not run and is not the right gate: two docs files, no source, test, script, or config content. What does cover this diff was run, after the final main sync:

• npm run check:outstanding-issues — Outstanding-issues guard passed: 142 rows (68 open, 74 archived), unique ids, next-id=145 above the highest, no merge driver.
• npm run format:check (whole tree, not per-file) — All matched files use Prettier code style!
• npm run docs:check-links — docs link check passed: 1405 repo path references resolve.
• #098's delivery re-verified by running it, not by reading test(rag): pin Supabase round-trip budgets on the answer path #1450's file list: node scripts/run-vitest.mjs run tests/rag-round-trip-budget.test.ts → Test Files 1 passed (1), Tests 5 passed (5), provider-free.
• #122's premise re-verified before closing: deleting commit located with git log --diff-filter=D, absence confirmed on current main, live check-run list read from PR issues: close #120 as not reproducible on current main #1452.

UI verification not run, and could not be: browser gates cannot launch in this container — npx playwright install --dry-run chromium wants chromium v1234 while /opt/pw-browsers holds 1194 (ledger #121). The documented symlink bridge writes under /opt/pw-browsers, which this session's sandbox refuses, so no browser evidence exists here and none is claimed. That constraint is now recorded on #130 as a blocker for the guard it describes.

Verification not run: every provider-backed gate (eval:*, verify:release, check:supabase-project, test:live) is unimplicated and unauthorized; no OpenAI, Supabase, or hosted-CI call was made. check:production-readiness does not apply — no clinical workflow, privacy, environment, Supabase, source-governance, or deployment behaviour is touched.

Risk and rollout

• Risk: Low, confined to repository memory plus one rule's wording. The asymmetric risk is closing or narrowing something still live: #122 is guarded by two independent confirmations that the provider is gone, and #098 and #130 are updated, not closed, so neither drops work from the open queue.
• Rollback: git revert the relevant commit; rows return to their prior state.
• Provider or production effects: None.

Notes

• scripts/pr-policy.mjs classifies this diff clinicalRisk: false, operationalRisk: false, ragRanking: false, so no Clinical Governance Preflight or RAG impact: line is required. Both sections are omitted deliberately rather than left as unchecked boxes.
• Two PR required reds on superseded heads (3b54fb05, 6f00b494) were each read from the job log rather than assumed: both are STATIC_RESULT: cancelled / CANCELLED with no failing job: static-pr, the cancel-in-progress case #095 was resolved to distinguish. Neither describes the diff.
• The branch was restarted from origin/main after PR issues: close #120 as not reproducible on current main #1452 squash-merged, per the repo's merged-branch rule; no commits are stacked on already-merged history.

🤖 Generated with Claude Code

https://claude.ai/code/session_018K7sEKH35KZkWxvCnQcNN2

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in:47 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 44b23cf5-8e36-4229-be7a-4963d0c97157

📥 Commits

Reviewing files that changed from the base of the PR and between d76b0f7 and c222606.

📒 Files selected for processing (2)

• AGENTS.md
• docs/outstanding-issues.md

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:6f00b494cb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".