Complete document accordion and auth-safe catalogue refresh

[BigSimmo]

Summary

• Complete Create summary.yml #65 with compact, mutually exclusive source-text disclosures that preserve deep-link/search auto-open and print restoration.
• Complete chore(deps): bump actions/ai-inference from 1 to 2 #92 with same-user background refetch preservation plus synchronous identity clearing and late-response rejection across registry, medication, and differential catalogues.
• Complete Fix all Critical & High RAG pipeline issues (indexing, retrieval, generation) #38 by defining the shared comparison interaction contract without changing clinical comparison semantics.
• Record safe read-only operator preflights for Fix Next.js binding to allow Railway healthchecks #25, Simplify operational tooling and runbooks #56, #057, and Harden production demo guards and fallback behavior #90; leave them open where credentials, migration divergence, prerequisite soak order, or upstream ESLint peer support blocks safe completion.

RAG impact: no retrieval behaviour change — document-reader disclosure, auth-safe catalogue refresh, comparison interaction documentation, and operator evidence only.

Verification

• npm run check:installed-lock-parity
• npm run lint
• npm run typecheck
• npm run test — 4600 passed, 3 skipped
• focused privacy/document DOM tests — 14 passed before review repair; repaired privacy set 9 passed
• focused document-reader Playwright journeys — deep link/search, compact 320/390/1280, and print restoration passed
• npm run verify:ui — 343 Chromium tests selected; .last-run.json status passed, zero failed
• npm run check:production-readiness -- --ci — READY with no blocking failures
• npm run docs:check-links
• npm run check:outstanding-issues
• npm run check:branch-review-ledger

Verification not run: npm run verify:pr-local adds eval:rag:offline, which is excluded by the requested no-RAG scope. Its non-RAG lint, typecheck, full-test, production-build, and static coverage ran separately; the production build ran inside verify:ui.

Verification not run: npm run verify:release includes excluded RAG/provider work and remains tracked by #55. The post-main-sync focused rerun was coordinator-blocked by another worktree; the implementation was unchanged from the passing focused/full runs.

Risk and rollout

• Risk: moderate UI and privacy-state change. The main residual risk is physical iPhone Safari/PWA behavior, which Chromium does not prove.
• Rollback: revert the feature commits; the documentation-only operator evidence can remain or be reverted with them.
• Provider or production effects: read-only names/status/history checks only. No webhook activation, migration apply, soak, rollback, deploy, provider generation, secret mutation, or production data mutation was performed.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked; no clinical decision-support behavior changed

Notes

• RAG issues Bump actions/checkout from 4 to 6 #1, Bump pdfkit from 0.18.0 to 0.19.0 #21, Protect real RAG search and answer APIs with authenticated owner scope #22, and chore(deps-dev): bump tailwindcss from 4.3.0 to 4.3.1 #35 were intentionally left untouched.
• Fix Next.js binding to allow Railway healthchecks #25, Improve data integrity and reliability of ingestion #55, Simplify operational tooling and runbooks #56, #057, and Harden production demo guards and fallback behavior #90 remain open with updated blockers/evidence.

Summary by CodeRabbit

• New Features
  • Added expandable source pages and passages with search highlights, metadata, teasers, and full-text viewing.
  • Added shared guidance for comparison interactions, selection limits, accessibility, loading states, and sharing.
• Bug Fixes
  • Search, medication, forms, and service results now remain visible during background refreshes.
  • Improved authentication-change handling so prior users’ data is cleared and stale results are ignored.
  • Refined disclosure behavior across screen sizes and print mode.
• Documentation
  • Updated architecture, staging, launch-gating, review, and issue-status documentation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 36368fa9-095b-42a5-bf49-f2fb15abf1ad

📥 Commits

Reviewing files that changed from the base of the PR and between f4f42fb and cf5cefa.

📒 Files selected for processing (1)

• docs/branch-review-ledger.md

---

📝 Walkthrough

Walkthrough

This PR adds authentication-aware catalog refetch handling, preserves same-user results while rejecting stale responses, introduces nested indexed-source disclosures with responsive and print coverage, and updates comparison, staging, issue, webhook, and review-record documentation.

Changes

Authenticated catalog refetching

Layer / File(s)	Summary
Auth-aware catalog request lifecycle src/lib/use-registry-records.ts, src/components/clinical-dashboard/use-differential-catalog.ts, src/components/clinical-dashboard/use-medication-catalog.ts	Catalog hooks track identity and credential changes, expose refetching, invalidate prior requests, and ignore stale or aborted responses.
Refetching status propagation src/components/clinical-dashboard/*, src/components/forms/*, src/components/services/*	Consumers retain available records during refetching and pass the distinct status to result headers.
Auth refresh and privacy validation tests/catalog-refetch-privacy.dom.test.tsx, tests/use-differential-search.dom.test.tsx	Tests cover same-user retention, identity-change clearing, stale-response rejection, and refresh recovery.

Indexed source disclosures

Layer / File(s)	Summary
Nested source disclosure behavior src/components/document-viewer/source-panels.tsx	Source pages and passages become expandable, target-aware, mutually exclusive, and compatible with manual closing and print handling.
Responsive and print disclosure tests tests/ui-smoke.spec.ts	Smoke tests verify default states, target navigation, responsive layouts, exclusive passage opening, and print restoration.

Documentation and operational records

Layer / File(s)	Summary
Comparison behavior contract docs/README.md, docs/comparison-behaviour.md, docs/design-system.md	Documentation defines shared comparison selection, accessibility, state, source, sharing, and mode-ownership rules.
Operational and review-record updates docs/branch-review-ledger.md, docs/operator-backlog.md, docs/outstanding-issues.md, docs/staging-setup.md	Review outcomes, issue dispositions, staging migration constraints, and webhook activation preflight results are updated.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
participant AuthSession
participant CatalogHooks
participant SearchViews
participant CatalogAPI
AuthSession->>CatalogHooks: identity or credential change
CatalogHooks->>CatalogAPI: invalidate and start catalog request
CatalogAPI-->>CatalogHooks: current catalog response
CatalogHooks-->>SearchViews: refetching or ready status and records

Loading

Possibly related PRs

• BigSimmo/Database#1138: Overlaps the authentication-aware catalog and stale-result handling changes.
• BigSimmo/Database#1380: Shares indexed source-text disclosure behavior in source-panels.tsx.
• BigSimmo/Database#1036: Also modifies use-registry-records.ts request refetch behavior.

Suggested reviewers:cursoragent

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 5.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely captures the two primary implementation changes: document accordions and authentication-safe catalogue refreshes.
Description check	✅ Passed	The description is complete, follows the required template, documents verification and exceptions, and covers risk, rollout, governance, and notes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

• Production UI (3) — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
• PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #7158 (cancelled).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.

[BigSimmo]

Final queue drain completed: #1510 is merged at 49aee22. Exact head 9f12b69 contains the recovered differential-cache revalidation fix and all current-main ledger content. Issue/ledger/docs guards pass; protected RAG diff is empty.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[BigSimmo]

@cursoragent This PR was just reopened. Do not merge, force-push, rebase, or arm auto-merge
unless I explicitly ask.

1. Confirm GitHub is on the current branch tip (not the old closed head).
   Snapshot head SHA, behind/ahead, mergeable state, required checks, and
   unresolved actionable threads.

2. Mergeability on this tip only:

   • Real conflict (merge-tree dirty): smallest fix, push.
   • Behind-but-clean: if required CI is in flight, wait and sync once late;
     otherwise sync once now. Prefer human/operator identity for update-branch;
     else git merge origin/main + push. No sync thrash.
   • Clean/current: leave it.
     Missing checks while mergeability is dirty ≠ green.

3. Fresh required CI on this tip only — ignore pre-close rollup. On failure:
   smallest fix, push, re-check. Don’t rerun unless a fix landed or a check
   is stuck. No provider-backed gates without approval.

4. New/unresolved actionable Codex/Bugbot/Copilot/human threads: smallest fix
   or short already-fixed/not-actionable reply, then resolve. Ignore
   rate-limit/summary noise.

5. Stop when: merge-tree clean, no actionable threads, required checks green
   or clearly in progress on this tip. Report tip SHA, sync done/not needed,
   CI status, threads handled, residual risks. Leave the merge decision to me.

[cursor]

Tip:ba44b0cb — GitHub PR head matches the branch tip (not the old closed head 231e8b1c / 9f12b69e).

1. Snapshot

• Ahead 42 / behind 0 vs origin/main
• MERGEABLE, mergeStateStatus: BLOCKED (checks still finishing)
• Unresolved actionable threads: 0

2. Sync

• Not needed — tip already contains current main (merge-tree clean, 0 behind)

3. CI (this tip only)

• Prior tip 9f12b69e failed Static PR checks (React Compiler preserve-manual-memoization on differential refetch)
• Fixed by adding setState to the useCallback deps; pushed ba44b0cb
• On ba44b0cb: PR mergeability, Static PR, Unit coverage, Build, Production UI critical — SUCCESS
• Production UI (1)/(2)/(3) — in progress on this tip; no failures

4. Threads

• None unresolved; prior CodeRabbit items already marked addressed

5. Stop

• merge-tree clean, 0 actionable threads, required checks green or in progress on ba44b0cb
• Residual risk: physical iPhone Safari/PWA (unchanged)
• Merge decision left to you

[BigSimmo]

Static failure repaired at exact head 4d7a5c4: React Compiler dependency narrowed to its inferred stable setter; the stale allocation-table conflict markers found by git diff --check were also removed while retaining current-main #147 guidance and the completed #38/#65 archives. Issue/ledger/docs guards and git diff --check pass; RAG diff remains empty.

[BigSimmo]

@cursoragent This PR was just reopened. Do not merge, force-push, rebase, or arm auto-merge
unless I explicitly ask.

1. Confirm GitHub is on the current branch tip (not the old closed head).
   Snapshot head SHA, behind/ahead, mergeable state, required checks, and
   unresolved actionable threads.

2. Mergeability on this tip only:

   • Real conflict (merge-tree dirty): smallest fix, push.
   • Behind-but-clean: if required CI is in flight, wait and sync once late;
     otherwise sync once now. Prefer human/operator identity for update-branch;
     else git merge origin/main + push. No sync thrash.
   • Clean/current: leave it.
     Missing checks while mergeability is dirty ≠ green.

3. Fresh required CI on this tip only — ignore pre-close rollup. On failure:
   smallest fix, push, re-check. Don’t rerun unless a fix landed or a check
   is stuck. No provider-backed gates without approval.

4. New/unresolved actionable Codex/Bugbot/Copilot/human threads: smallest fix
   or short already-fixed/not-actionable reply, then resolve. Ignore
   rate-limit/summary noise.

5. Stop when: merge-tree clean, no actionable threads, required checks green
   or clearly in progress on this tip. Report tip SHA, sync done/not needed,
   CI status, threads handled, residual risks. Leave the merge decision to me.

[cursor]

Tip:f4f42fbc — GitHub head matches the branch tip.

1. Snapshot (pre-sync)

• Was at 4d7a5c4e, 1 behind main; GitHub CONFLICTING/DIRTY
• merge-tree was actually clean (behind-but-clean false dirty)
• Unresolved threads: 0
• Missing CI was from dirty mergeability, not a green pass

2. Sync

• Merged origin/main (be8c9ff7 / test(phone-scroll): split the 2100-line spec, and fix two coverage holes it exposed #1466) once and pushed
• Now: merge-tree clean, ahead 46 / behind 0, MERGEABLE

3. CI (this tip only)

• Fresh run on f4f42fbc: PR mergeability + Change scope SUCCESS
• Static PR, Unit coverage, Build, Production UI critical — in progress
• No failures on this tip

4. Threads

• None unresolved; nothing to fix or reply

5. Stop

• merge-tree clean, 0 actionable threads, required checks in progress on f4f42fbc
• Residual risk: physical iPhone Safari/PWA
• Merge decision left to you