issues: record the lowercase authorizationHeader trap from PR #1741 review

[BigSimmo]

Summary

• One append-only row to docs/outstanding-issues.md (#285). No code change.
• authorizationHeadersForAccessToken returns { authorization: 'Bearer …' } — lowercase, per the Fetch/Headers convention (src/lib/supabase/client.tsx:82). The value is typed Record<string, string>, so reading .Authorization off it type-checks, returns undefined, and silently degrades to whatever fallback the caller wrote.
• PR feat(document-viewer): rework the viewer for phone and PWA reading #1741 made exactly that mistake twice in one session, and both sites were identity-scoping code: the in-flight signed-URL dedupe key in use-signed-image-url.ts collapsed every user onto endpoint + '', so an account switch with a request in flight could hand user B user A's signed URL; and detailRequestSignature in DocumentViewer.tsx omitted the bearer token its own comment claimed was present. Review caught both before merge and each site now reads headers.authorization ?? headers.Authorization ?? ''.
• Merged main has no other property reads of that object — every remaining caller passes it wholesale to fetch, where casing is irrelevant — so this is a note for the future, not an outstanding defect.
• The row's next action is the cheap durable fix: export a named authorizationIdentity(headers) helper so there is one definition, then consider a narrower type so .Authorization stops type-checking at all.

Branch restarted from origin/main (e8adde1) rather than stacked on the merged #1741 history, per AGENTS.md's merged-PR rule. The old remote branch was deleted on merge.

Verification

• npm run verify:pr-local

Docs-only, single append-only ledger row, so the applicable gates were run directly rather than through the aggregate:

• npm run check:outstanding-issues — "Outstanding-issues guard passed: 283 rows (139 open, 144 archived), unique ids, next-id=286 above the highest, no merge driver, no ids deleted from base e8adde1."
• npx prettier --check docs/outstanding-issues.md — "All matched files use Prettier code style!"

No source, test, config, dependency or schema file is touched, so lint, typecheck, unit tests, build and the browser gates have no changed failure path to cover.

• npm run verify:ui — not applicable, no UI change.
• npm run verify:release — not run, provider-backed, not claimed.

RAG impact: no retrieval behaviour change — documentation only, one row appended to the outstanding-work ledger. No file under src/ is modified.

Risk and rollout

• Risk: none to runtime. The only file changed is an append-only markdown ledger, guarded by check:outstanding-issues.
• Rollback: revert the single commit.
• Provider or production effects: None.

Notes

• Related follow-ups from the same session already on main from feat(document-viewer): rework the viewer for phone and PWA reading #1741: the container Chromium that cannot raster pdf.js 6, the physical iPhone acceptance owed for the pinch gesture and canvas budget, the two competing clinical-summary surfaces on the phone document route, the pdf.js decoder-asset probe, the still-uncalled batch signed-URL route, and the root-container pr-handoff-stop test failure.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ER2xPFzPzoS8fAxkgHC8yo

---

Generated by Claude Code

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in:20 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c626baa3-b3d8-4044-aac4-1f657caf9899

📥 Commits

Reviewing files that changed from the base of the PR and between 429cbd9 and ee3a8ad.

📒 Files selected for processing (2)

• docs/branch-review-ledger.md
• docs/outstanding-issues.md

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:9a5f79ab13

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".