Complete document accordion and auth-safe catalogue refresh

docs/README.md

@@ -29,6 +29,7 @@ npm run docs:check-links
 - [deployment-architecture.md](deployment-architecture.md) — app/worker/Supabase deployment topology
 - [ingestion-state-machine.md](ingestion-state-machine.md) — ingestion job lifecycle and states
 - [design-system.md](design-system.md) — tokens, primitives, styling conventions
+- [comparison-behaviour.md](comparison-behaviour.md) — shared selection, state, responsive, and accessibility contract for comparison surfaces
 - [clinical-chat-ui-component-map.md](clinical-chat-ui-component-map.md) — chat UI component inventory
 - [clinical-badge-system-guide.md](clinical-badge-system-guide.md) — clinical badge semantics
 - [multi-user-auth-setup.md](multi-user-auth-setup.md) — auth, sessions, owner scoping

docs/comparison-behaviour.md

@@ -0,0 +1,70 @@
+# Comparison behaviour
+
+This is the shared interaction contract for side-by-side comparison surfaces. It standardises
+selection, state, navigation, and accessibility without standardising the clinical fields or the
+meaning of a comparison.
+
+Existing reference surfaces are differential diagnosis, Services Navigator, and Therapy Compass.
+New comparison work should reuse this behaviour before introducing another interaction model.
+
+## Selection contract
+
+- Comparison is always an explicit user action. A mode may suggest or initially select likely
+ candidates, but every selected item remains visibly removable before comparison begins.
+- Zero selected items shows an instructional empty state. One selected item asks for one more.
+ Two or more enables the comparison action. The mode owns any upper limit and states it before
+ the limit is reached and when an add is refused.
+- Selection controls state both actions: `Add <item> to comparison` and `Remove <item> from
+comparison`. Selected state is visually apparent and exposed with the appropriate native or
+ ARIA state.
+- Selection contains stable item identifiers, never copied clinical records. Remove identifiers
+ that no longer exist in the active result set or authorised catalogue.
+- A query, mode, organisation, or authenticated-user change must not silently carry selections
+ into a different scope. Clear them unless the surface has a deliberate, tested, shareable URL
+ contract for that exact scope.
+
+## Entry and exit
+
+- The compare affordance includes the current selected count. While fewer than two items are
+ selected it is disabled or rendered as an explicit instructional action; it is never inert.
+- Desktop placement belongs near the selection controls or summary rail. On phones, a docked or
+ composer-adjacent action is allowed only when its owner and content reserve follow
+ `search-chrome-behaviour.md`.
+- Opening comparison preserves enough context to return to the originating results. Removing an
+ item in comparison updates the originating selection if both views share client state.
+- A clear-all action is available once anything is selected. It is disabled at zero and does not
+ delete, mutate, or hide source records.
+
+## Comparison states
+
+- With two or more items, align equivalent fields so a user can scan one field across all items.
+ A narrow viewport may use a labelled stacked layout or horizontal scrolling; it must not reorder
+ an item's fields or detach values from their item and field labels.
+- Loading or background refetch preserves the last authorised comparison and labels it as
+ refreshing. An identity or comparison-scope change clears it synchronously before new data is
+ requested.
+- Missing, unknown, not applicable, and failed-to-load are distinct states. Do not render a blank
+ cell where the distinction affects interpretation.
+- Source, review, freshness, or confidence context stays attached to the item or field it qualifies.
+ A summary may highlight differences, but it must not replace the underlying source context.
+- Copy, print, and share actions operate only on the visible selected set and are disabled until the
+ set is valid. Shared URLs must validate every identifier and apply the same access checks as the
+ underlying record routes.
+
+## Mode-owned content
+
+The shared contract does not define comparison fields, clinical recommendations, rankings,
+thresholds, evidence weighting, or generated prose. Each mode owns those through its existing data,
+governance, and safety contracts. Adding a new comparison surface must document:
+
+1. the record type and stable identifier;
+2. the minimum and maximum selection count;
+3. when selection is cleared or restored;
+4. the field order and missing-value semantics;
+5. source/review context and any clinical owner;
+6. phone layout, keyboard order, and return path; and
+7. focused tests for zero, one, valid, over-limit, stale-record, and identity-change states.
+
+Do not create a shared clinical comparison component until at least two modes use the same field
+semantics. Shared selection helpers or layout primitives are acceptable when they preserve each
+mode's content ownership.

docs/design-system.md

@@ -12,6 +12,10 @@ Design direction is **settled**. Work on the UI is convergence — closing the g
 contract and the code — not reinvention. If a change genuinely needs a new direction, update
 `permanent-colour-direction.md` first, then the code.
 
+Comparison surfaces also follow [`comparison-behaviour.md`](comparison-behaviour.md). That contract
+standardises selection and interaction states while leaving clinical fields and meaning with each
+mode.
+
 ## 1. Non-negotiables
 
 - **Tokens only.** Every colour comes from a CSS custom property defined in

docs/operator-backlog.md

@@ -18,15 +18,15 @@ Findings inventory for handover: [audit/audit-handover-2026-07-14.md](audit/audi
 
 ## Launch-gating actions
 
-| Action | Status | Blocked by | Verify command | Runbook |
-| ----------------------------------------------------- | ---------- | --------------------- | ----------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Apply July-8 migration batch (a–g) to live | ✅ done | — | `SUPABASE_ENVIRONMENT=production npm run check:july8-live-batch` (2026-07-13: 6 live, apply=no-op) | [operator-apply-july8-batch.md](operator-apply-july8-batch.md) |
-| Apply drift-codify forward migration (step 1h) | ✅ done | — | Applied and drift/readiness verified 2026-07-13; verify only unless new reviewed drift is found | [database-drift-detection.md](database-drift-detection.md) |
-| Apply repo-ahead migrations to live (post-2026-07-13) | ✅ done | — | Zero unsafe title-word rows; `npm run check:drift`; then `eval:retrieval:quality` (36/36) for the corrector | [deploy-corrector-public-titles.md](deploy-corrector-public-titles.md) · [operator-apply-performance-latency-remediation.md](operator-apply-performance-latency-remediation.md) |
-| Full release gate (bounded OpenAI spend) | ⏳ pending | hosted audit/browser | Let Dependabot PRs #1268/#1269 clear the production audit, then run one exact-SHA release/browser gate | [launch-operator-runbook.md §2](launch-operator-runbook.md) |
-| Reconcile existing staging Supabase schema | ⏳ pending | DB CLI credential | Apply the exact 23-version repository chain after `20260719055623`; then `npm run check:indexing` | [staging-setup.md](staging-setup.md) |
-| Staging soak + rollback rehearsal on Railway | ⏳ pending | staging schema parity | Re-run tenancy proof, then `scripts/soak-test.ts --confirm-staging` (answer p95 ≤ 25 s) | [launch-operator-runbook.md §4](launch-operator-runbook.md) · [capacity-review.md](capacity-review.md) |
-| Production deploy to Railway | ✅ done | — | App deployment recorded live 2026-07-14; re-verify with `GET /api/health` and deployment readiness | [deployment-architecture.md](deployment-architecture.md) |
+| Action | Status | Blocked by | Verify command | Runbook |
+| ----------------------------------------------------- | ---------- | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Apply July-8 migration batch (a–g) to live | ✅ done | — | `SUPABASE_ENVIRONMENT=production npm run check:july8-live-batch` (2026-07-13: 6 live, apply=no-op) | [operator-apply-july8-batch.md](operator-apply-july8-batch.md) |
+| Apply drift-codify forward migration (step 1h) | ✅ done | — | Applied and drift/readiness verified 2026-07-13; verify only unless new reviewed drift is found | [database-drift-detection.md](database-drift-detection.md) |
+| Apply repo-ahead migrations to live (post-2026-07-13) | ✅ done | — | Zero unsafe title-word rows; `npm run check:drift`; then `eval:retrieval:quality` (36/36) for the corrector | [deploy-corrector-public-titles.md](deploy-corrector-public-titles.md) · [operator-apply-performance-latency-remediation.md](operator-apply-performance-latency-remediation.md) |
+| Full release gate (bounded OpenAI spend) | ⏳ pending | hosted audit/browser | Let Dependabot PRs #1268/#1269 clear the production audit, then run one exact-SHA release/browser gate | [launch-operator-runbook.md §2](launch-operator-runbook.md) |
+| Reconcile existing staging Supabase schema | ⏳ pending | reviewed full-chain scope | 2026-07-30 live list shows 24 local-only versions, including ten earlier history holes and fourteen after `20260719055623`; apply only the complete reviewed chain, then `npm run check:indexing` | [staging-setup.md](staging-setup.md) |
+| Staging soak + rollback rehearsal on Railway | ⏳ pending | staging schema parity | Re-run tenancy proof, then `scripts/soak-test.ts --confirm-staging` (answer p95 ≤ 25 s) | [launch-operator-runbook.md §4](launch-operator-runbook.md) · [capacity-review.md](capacity-review.md) |
+| Production deploy to Railway | ✅ done | — | App deployment recorded live 2026-07-14; re-verify with `GET /api/health` and deployment readiness | [deployment-architecture.md](deployment-architecture.md) |
 
 ## Post-deploy actions
 
@@ -53,6 +53,13 @@ dashboard/CLI action, never committed.
 | Supabase schedules / Vault names | ✅ present | `Clinical KB Database` | Read-only 2026-07-27 proof found active retention/performance/auto-toggle schedules and the `cron_ingestion_jwt` / `indexing_v3_agent_secret` Vault names. The deliberately absent document-change webhook activation secret remains tracked by #025. |
 | OpenAI DPA / ZDR execution | ⏳ pending | OpenAI account + legal | App endpoints are ZDR-eligible; execution is operator + legal — see [openai-cross-border-basis.md](openai-cross-border-basis.md). This legal/provider decision remains #053 and is not implied by config presence. |
 
+**Webhook activation preflight (2026-07-30):** names-only checks found neither chat webhook URL in
+the designated local env, GitHub Actions secrets, Railway production app, or Railway staging app.
+`RAILWAY_WEBHOOK_SECRET` and `SUPABASE_INGESTION_WEBHOOK_SECRET` were also absent from both Railway
+app environments. Activation stopped without generating or setting partial secrets because no
+accountable chat endpoint/responder was available; no webhook provider mutation or controlled event
+was dispatched. This remains #025.
+
 ## Disaster-recovery re-creation (does NOT survive a schema restore)
 
 Per [disaster-recovery-runbook.md](disaster-recovery-runbook.md) — config & secrets are the layer a schema