From 3606707b65a82f5ace23f8a162f9b229f83b7019 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Fri, 14 Aug 2026 22:44:18 +0800
Subject: [PATCH 1/5] feat(auth): refine responsive account setup

---
 .../account-setup-dialog.tsx                  | 252 +++++++++++-------
 tests/favourites-auth-gate.dom.test.tsx       |  28 +-
 tests/ui-smoke.spec.ts                        |  42 ++-
 3 files changed, 198 insertions(+), 124 deletions(-)

diff --git a/src/components/clinical-dashboard/account-setup-dialog.tsx b/src/components/clinical-dashboard/account-setup-dialog.tsx
index 4f004e3533..0a176c50e9 100644
--- a/src/components/clinical-dashboard/account-setup-dialog.tsx
+++ b/src/components/clinical-dashboard/account-setup-dialog.tsx
@@ -1,7 +1,18 @@
 "use client";
 
+import Link from "next/link";
 import { type FormEvent, useState } from "react";
-import { Clock3, Heart, Loader2, Mail, ShieldCheck, SlidersHorizontal, type LucideIcon } from "lucide-react";
+import {
+  ArrowRight,
+  Clock3,
+  Heart,
+  Loader2,
+  LockKeyhole,
+  Mail,
+  ShieldCheck,
+  SlidersHorizontal,
+  type LucideIcon,
+} from "lucide-react";
 
 import { BrandMark } from "@/components/clinical-dashboard/brand";
 import { ProviderBrandIcon, type SsoProvider } from "@/components/clinical-dashboard/provider-brand-icons";
@@ -10,31 +21,31 @@ import { TextField } from "@/components/ui/text-field";
 import { AsyncButton, cn, floatingControl, InlineNotice, primaryControl } from "@/components/ui-primitives";
 import { useAuthSession, type OAuthProvider } from "@/lib/supabase/client";
 
-const storageBenefits = [
+const workspaceBenefits = [
   {
-    label: "Saved favourites",
-    detail: "Available whenever you sign in on another device.",
-    scope: "Account",
+    label: "Save favourites",
+    mobileLabel: "Favourites sync",
+    detail: "Reopen trusted resources on any device.",
     icon: Heart,
   },
   {
-    label: "Clinical defaults",
-    detail: "Your jurisdiction and answer style follow your account.",
-    scope: "Account",
+    label: "Keep your clinical defaults",
+    mobileLabel: "Preferences sync",
+    detail: "Your jurisdiction and answer style follow you.",
     icon: SlidersHorizontal,
   },
   {
-    label: "Recent searches",
-    detail: "Stay in this browser session and do not sync.",
-    scope: "This device",
+    label: "Recent searches stay here",
+    mobileLabel: "Searches stay here",
+    detail: "Browser activity does not sync to your account.",
     icon: Clock3,
   },
 ] as const;
 
-type StorageBenefit = {
+type WorkspaceBenefit = {
   label: string;
+  mobileLabel: string;
   detail: string;
-  scope: "Account" | "This device";
   icon: LucideIcon;
 };
 
@@ -60,10 +71,10 @@ export function AccountSetupDialog({
   const busy = auth.status === "loading";
   const actionBusy = busy || pendingProvider !== null;
   const isFavouritesIntent = intent === "favourites";
-  const title = isFavouritesIntent ? "Sign up to save favourites" : "Set up your workspace";
+  const title = isFavouritesIntent ? "Sign up to save favourites" : "Continue to your workspace";
   const description = isFavouritesIntent
     ? "Sign in or create an account to save favourites and reopen them on any device."
-    : "Sign in or create an account to keep favourites and clinical defaults with you.";
+    : "Sign in or create an account in one step.";
   const error = actionAttempted ? auth.error : null;
   const notice = actionAttempted ? auth.notice : null;
 
@@ -91,59 +102,61 @@ export function AccountSetupDialog({
     <Sheet
       open={open}
       onClose={onClose}
-      title={title}
-      description={description}
+      title="Account setup"
       closeLabel="Close account setup"
-      headerLeading={
-        <span className="grid h-10 w-10 shrink-0 place-items-center rounded-xl border border-[color:var(--border-lux)] bg-[color:var(--surface)] shadow-[var(--shadow-soft),var(--shadow-inset)] max-[359px]:hidden">
-          <BrandMark className="h-7 w-7" />
-        </span>
-      }
-      headerClassName="bg-[color:var(--surface-lux)]"
-      titleClassName="text-base sm:text-lg"
-      bodyClassName="bg-[color:var(--surface)] p-4 sm:p-6"
-      contentClassName="account-setup-dialog max-h-[calc(100dvh-0.5rem)] sm:max-h-[calc(100dvh-2rem)] sm:max-w-[44rem]"
+      headerClassName="absolute right-3 top-3 z-30 w-auto border-0 bg-transparent p-0 sm:right-4 sm:top-4 sm:p-0"
+      titleClassName="sr-only"
+      bodyClassName="bg-[color:var(--surface)] p-0 sm:p-0"
+      contentClassName="account-setup-dialog relative max-h-[calc(100dvh-0.5rem)] sm:max-h-[calc(100dvh-2rem)] sm:max-w-[68rem]"
       portal
     >
-      <form onSubmit={submit} className="mx-auto grid w-full max-w-[38rem] gap-5">
-        <section aria-labelledby="account-provider-title" className="grid gap-3">
-          <div>
-            <h3 id="account-provider-title" className="text-sm font-semibold text-[color:var(--text-heading)]">
-              Choose how to continue
-            </h3>
-            <p className="mt-1 text-xs font-medium leading-5 text-[color:var(--text-muted)]">
-              Use an existing account for the quickest setup.
-            </p>
-          </div>
+      <div className="grid min-h-0 lg:grid-cols-[minmax(20rem,0.84fr)_minmax(0,1.36fr)]">
+        <AccountOrientationPanel />
 
-          <div data-testid="account-provider-grid" className="grid gap-2.5 sm:grid-cols-3">
-            {(["Apple", "Google", "Microsoft"] as const).map((provider) => (
-              <ProviderButton
-                key={provider}
-                provider={provider}
-                busy={actionBusy}
-                pending={pendingProvider === provider}
-                onClick={() => void chooseProvider(provider)}
-              />
-            ))}
-          </div>
-        </section>
+        <form
+          onSubmit={submit}
+          className="grid content-start gap-5 bg-[color:var(--surface)] p-5 pt-8 sm:p-8 lg:p-10 lg:pt-12"
+        >
+          <section aria-labelledby="account-provider-title" className="grid gap-5">
+            <div className="max-w-[36rem] pr-10 sm:pr-8">
+              <h2
+                id="account-provider-title"
+                className="text-balance text-2xl font-semibold tracking-tight text-[color:var(--text-heading)] sm:text-3xl"
+              >
+                {title}
+              </h2>
+              <p className="mt-2 text-sm font-medium leading-6 text-[color:var(--text-muted)] sm:text-base">
+                {description}
+              </p>
+            </div>
 
-        <div className="flex items-center gap-3 text-xs font-medium text-[color:var(--text-muted)]">
-          <span className="h-px flex-1 bg-[color:var(--border)]" />
-          <span>or continue with email</span>
-          <span className="h-px flex-1 bg-[color:var(--border)]" />
-        </div>
+            <div data-testid="account-provider-grid" className="grid gap-2.5 sm:grid-cols-3">
+              {(["Apple", "Google", "Microsoft"] as const).map((provider) => (
+                <ProviderButton
+                  key={provider}
+                  provider={provider}
+                  busy={actionBusy}
+                  pending={pendingProvider === provider}
+                  onClick={() => void chooseProvider(provider)}
+                />
+              ))}
+            </div>
+          </section>
+
+          <div className="flex items-center gap-3 text-xs font-medium text-[color:var(--text-muted)]">
+            <span className="h-px flex-1 bg-[color:var(--border)]" />
+            <span>or continue with email</span>
+            <span className="h-px flex-1 bg-[color:var(--border)]" />
+          </div>
 
-        <div className="grid gap-2.5 sm:grid-cols-[minmax(0,1fr)_auto] sm:items-end">
           <TextField
             data-sheet-autofocus="true"
-            label="Email address"
+            label="Work email"
             icon={Mail}
             type="email"
             value={email}
             onChange={(event) => setEmail(event.target.value)}
-            placeholder="you@clinic.example"
+            placeholder="name@clinic.com"
             autoComplete="email"
             inputMode="email"
             enterKeyHint="go"
@@ -158,68 +171,109 @@ export function AccountSetupDialog({
             busy={busy && pendingProvider === null}
             busyLabel="Sending link…"
             disabled={actionBusy || !email.trim()}
-            idleIcon={<Mail aria-hidden="true" className="h-4 w-4" />}
-            className={cn(primaryControl, "w-full sm:min-w-48")}
+            idleIcon={<LockKeyhole aria-hidden="true" className="h-4 w-4" />}
+            className={cn(primaryControl, "min-h-tap w-full")}
           >
-            Continue with email
+            Continue securely
           </AsyncButton>
-        </div>
 
-        {notice ? <InlineNotice tone="success">{notice}</InlineNotice> : null}
-        {error ? <InlineNotice tone="danger">{error}</InlineNotice> : null}
+          <p className="flex items-center justify-center gap-2 text-center text-xs font-medium leading-5 text-[color:var(--text-muted)] sm:text-sm">
+            <Mail aria-hidden="true" className="h-4 w-4 shrink-0 text-[color:var(--clinical-accent)]" />
+            <span>We’ll email you a secure sign-in link. No password needed.</span>
+          </p>
+
+          {notice ? <InlineNotice tone="success">{notice}</InlineNotice> : null}
+          {error ? <InlineNotice tone="danger">{error}</InlineNotice> : null}
+
+          <PrivacyFooter className="border-t border-[color:var(--border)] pt-4 lg:hidden" />
+        </form>
+      </div>
+    </Sheet>
+  );
+}
+
+function AccountOrientationPanel() {
+  return (
+    <section
+      aria-labelledby="account-workspace-benefits"
+      data-testid="account-storage-summary"
+      className="relative isolate flex min-h-0 flex-col overflow-hidden bg-[color:var(--clinical-accent-soft)] px-5 pb-5 pt-6 sm:px-8 sm:py-8 lg:min-h-[36rem] lg:px-10 lg:py-10"
+    >
+      <span
+        aria-hidden="true"
+        className="pointer-events-none absolute -bottom-32 -left-24 -z-10 h-80 w-[34rem] rounded-[50%] border border-white/50 bg-white/20 forced-colors:hidden"
+      />
+      <span
+        aria-hidden="true"
+        className="pointer-events-none absolute -bottom-48 -left-12 -z-10 h-80 w-[38rem] rounded-[50%] border border-white/40 bg-white/15 forced-colors:hidden"
+      />
 
-        <section
-          aria-labelledby="account-storage-title"
-          data-testid="account-storage-summary"
-          className="overflow-hidden rounded-xl border border-[color:var(--border-lux)] bg-[color:var(--surface-lux)] shadow-[var(--shadow-inset)] forced-colors:border"
+      <div className="pr-12">
+        <span className="grid h-11 w-11 place-items-center rounded-xl border border-[color:var(--border-lux)] bg-[color:var(--surface)] shadow-[var(--shadow-soft),var(--shadow-inset)]">
+          <BrandMark className="h-8 w-8" />
+        </span>
+        <h3
+          id="account-workspace-benefits"
+          className="mt-5 max-w-[24rem] text-balance text-2xl font-semibold tracking-tight text-[color:var(--text-heading)] sm:text-3xl lg:mt-7 lg:text-4xl lg:leading-tight"
         >
-          <div className="border-b border-[color:var(--border)] px-3.5 py-3 sm:px-4">
-            <h3 id="account-storage-title" className="text-sm font-semibold text-[color:var(--text-heading)]">
-              What’s saved where
-            </h3>
-            <p className="mt-0.5 text-xs font-medium leading-5 text-[color:var(--text-muted)]">
-              Account data follows you; recent activity stays private to this browser.
-            </p>
-          </div>
+          Your workspace, wherever you work.
+        </h3>
+      </div>
 
-          <ul className="divide-y divide-[color:var(--border)]/80">
-            {storageBenefits.map((benefit) => (
-              <StorageBenefitRow key={benefit.label} benefit={benefit} />
-            ))}
-          </ul>
+      <ul className="mt-5 grid grid-cols-3 gap-2 sm:gap-3 lg:mt-8 lg:grid-cols-1 lg:gap-5">
+        {workspaceBenefits.map((benefit) => (
+          <WorkspaceBenefitRow key={benefit.label} benefit={benefit} />
+        ))}
+      </ul>
 
-          <div className="flex items-start gap-2.5 border-t border-[color:var(--border)] bg-[color:var(--surface-subtle)] px-3.5 py-3 sm:px-4">
-            <ShieldCheck aria-hidden="true" className="mt-0.5 h-4 w-4 shrink-0 text-[color:var(--clinical-accent)]" />
-            <p className="text-xs font-medium leading-5 text-[color:var(--text-muted)]">
-              <strong className="font-semibold text-[color:var(--text-heading)]">No PHI required.</strong> Do not enter
-              patient-identifying information during sign-in.
-            </p>
-          </div>
-        </section>
-      </form>
-    </Sheet>
+      <PrivacyFooter className="mt-auto hidden pt-8 lg:flex" />
+    </section>
   );
 }
 
-function StorageBenefitRow({ benefit }: { benefit: StorageBenefit }) {
+function WorkspaceBenefitRow({ benefit }: { benefit: WorkspaceBenefit }) {
   const Icon = benefit.icon;
 
   return (
-    <li className="grid grid-cols-[auto_minmax(0,1fr)_auto] items-start gap-2.5 px-3.5 py-3 sm:items-center sm:px-4">
-      <span className="grid h-8 w-8 shrink-0 place-items-center rounded-lg bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)]">
-        <Icon aria-hidden="true" className="h-4 w-4" />
+    <li className="flex min-w-0 flex-col items-center gap-2 rounded-xl border border-[color:var(--border-lux)] bg-[color:var(--surface)]/55 p-2.5 text-center shadow-[var(--shadow-inset)] sm:p-3 lg:flex-row lg:items-start lg:gap-3 lg:border-0 lg:bg-transparent lg:p-0 lg:text-left lg:shadow-none">
+      <span className="grid h-9 w-9 shrink-0 place-items-center rounded-lg border border-[color:var(--border-lux)] bg-[color:var(--surface)] text-[color:var(--clinical-accent)] shadow-[var(--shadow-soft),var(--shadow-inset)] lg:h-10 lg:w-10">
+        <Icon aria-hidden="true" className="h-4 w-4 lg:h-[1.125rem] lg:w-[1.125rem]" />
       </span>
       <span className="min-w-0">
-        <span className="block text-sm font-semibold leading-5 text-[color:var(--text-heading)]">{benefit.label}</span>
-        <span className="block text-xs font-medium leading-5 text-[color:var(--text-muted)]">{benefit.detail}</span>
-      </span>
-      <span className="mt-0.5 inline-flex min-h-6 items-center rounded-full border border-[color:var(--border)] bg-[color:var(--surface)] px-2 text-2xs font-semibold leading-none text-[color:var(--text-muted)] sm:mt-0">
-        {benefit.scope}
+        <span className="block text-xs font-semibold leading-4 text-[color:var(--text-heading)] sm:text-sm lg:hidden">
+          {benefit.mobileLabel}
+        </span>
+        <span className="hidden text-sm font-semibold leading-5 text-[color:var(--text-heading)] lg:block">
+          {benefit.label}
+        </span>
+        <span className="mt-0.5 hidden text-xs font-medium leading-5 text-[color:var(--text-muted)] lg:block">
+          {benefit.detail}
+        </span>
       </span>
     </li>
   );
 }
 
+function PrivacyFooter({ className }: { className?: string }) {
+  return (
+    <div
+      className={cn("flex items-start gap-2.5 text-xs font-medium leading-5 text-[color:var(--text-muted)]", className)}
+    >
+      <ShieldCheck aria-hidden="true" className="mt-0.5 h-4 w-4 shrink-0 text-[color:var(--clinical-accent)]" />
+      <p>
+        <span className="block">Do not enter patient-identifiable information.</span>
+        <Link
+          href="/privacy"
+          className="mt-0.5 inline-flex min-h-6 items-center gap-1 font-semibold text-[color:var(--clinical-accent)] underline decoration-transparent underline-offset-4 transition hover:decoration-current focus-visible:rounded-sm focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)] motion-reduce:transition-none"
+        >
+          Privacy and data processing
+          <ArrowRight aria-hidden="true" className="h-3.5 w-3.5" />
+        </Link>
+      </p>
+    </div>
+  );
+}
+
 function ProviderButton({
   provider,
   busy,
@@ -240,7 +294,7 @@ function ProviderButton({
       data-provider={provider.toLowerCase()}
       className={cn(
         floatingControl,
-        "w-full min-w-0 justify-center gap-2.5 bg-[color:var(--surface-lux)] px-3 shadow-[var(--shadow-inset)]",
+        "min-h-tap w-full min-w-0 justify-center gap-2.5 bg-[color:var(--surface-lux)] px-3 shadow-[var(--shadow-inset)]",
       )}
     >
       {pending ? (
diff --git a/tests/favourites-auth-gate.dom.test.tsx b/tests/favourites-auth-gate.dom.test.tsx
index 681453a3cb..0534422e19 100644
--- a/tests/favourites-auth-gate.dom.test.tsx
+++ b/tests/favourites-auth-gate.dom.test.tsx
@@ -154,18 +154,24 @@ describe("favourites auth gate DOM", () => {
 
     expect(screen.getByRole("heading", { name: "Sign up to save favourites" })).toBeVisible();
     expect(screen.getByText(/Sign in or create an account to save favourites/i)).toBeVisible();
-    expect(screen.getByText("Saved favourites")).toBeVisible();
+    expect(screen.getByText("Save favourites")).toBeVisible();
   });
 
   it("separates account-synced data from device-only recents", () => {
     render(<AccountSetupDialog open onClose={() => undefined} />);
 
-    expect(screen.getByRole("heading", { name: "What’s saved where" })).toBeVisible();
-    expect(screen.getAllByText("Account")).toHaveLength(2);
-    expect(screen.getByText("This device")).toBeVisible();
-    expect(screen.getByText(/Recent searches/i)).toBeVisible();
-    expect(screen.getByText(/Stay in this browser session and do not sync/i)).toBeVisible();
-    expect(screen.getByText(/No PHI required\./i)).toBeVisible();
+    expect(screen.getByRole("heading", { name: "Your workspace, wherever you work." })).toBeVisible();
+    expect(screen.getByText("Save favourites")).toBeVisible();
+    expect(screen.getByText(/Reopen trusted resources on any device/i)).toBeVisible();
+    expect(screen.getByText("Keep your clinical defaults")).toBeVisible();
+    expect(screen.getByText(/Your jurisdiction and answer style follow you/i)).toBeVisible();
+    expect(screen.getByText("Recent searches stay here")).toBeVisible();
+    expect(screen.getByText(/Browser activity does not sync to your account/i)).toBeVisible();
+    expect(screen.getAllByText("Do not enter patient-identifiable information.")).toHaveLength(2);
+    expect(screen.getAllByRole("link", { name: "Privacy and data processing" })).toHaveLength(2);
+    for (const privacyLink of screen.getAllByRole("link", { name: "Privacy and data processing" })) {
+      expect(privacyLink).toHaveAttribute("href", "/privacy");
+    }
     expect(screen.queryByText(/Everything syncs across your devices/i)).toBeNull();
     expect(screen.queryByText(/never shared/i)).toBeNull();
     expect(screen.queryByText("Account-scoped saves")).toBeNull();
@@ -178,7 +184,7 @@ describe("favourites auth gate DOM", () => {
     const apple = screen.getByRole("button", { name: "Continue with Apple" });
     const google = screen.getByRole("button", { name: "Continue with Google" });
     const microsoft = screen.getByRole("button", { name: "Continue with Microsoft" });
-    const email = screen.getByLabelText(/Email address/);
+    const email = screen.getByLabelText(/Work email/);
 
     expect(apple.compareDocumentPosition(google) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy();
     expect(google.compareDocumentPosition(microsoft) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy();
@@ -206,16 +212,16 @@ describe("favourites auth gate DOM", () => {
     for (const provider of ["Apple", "Google", "Microsoft"]) {
       expect(screen.getByRole("button", { name: `Continue with ${provider}` })).toBeDisabled();
     }
-    expect(screen.getByRole("button", { name: "Continue with email" })).toBeDisabled();
+    expect(screen.getByRole("button", { name: "Continue securely" })).toBeDisabled();
   });
 
   it("submits email and announces success and failure feedback", async () => {
     const user = userEvent.setup();
     const { rerender } = render(<AccountSetupDialog open onClose={() => undefined} />);
 
-    const submit = screen.getByRole("button", { name: "Continue with email" });
+    const submit = screen.getByRole("button", { name: "Continue securely" });
     expect(submit).toBeDisabled();
-    const email = screen.getByLabelText(/Email address/);
+    const email = screen.getByLabelText(/Work email/);
     expect(email).toHaveAttribute("data-sheet-autofocus", "true");
     await user.type(email, "clinician@clinic.example");
     await user.click(submit);
diff --git a/tests/ui-smoke.spec.ts b/tests/ui-smoke.spec.ts
index f574c5100f..e675520546 100644
--- a/tests/ui-smoke.spec.ts
+++ b/tests/ui-smoke.spec.ts
@@ -904,7 +904,7 @@ function accountSettingsDialog(page: Page) {
 }
 
 function accountSetupDialog(page: Page) {
-  return page.getByRole("dialog", { name: "Set up your workspace" });
+  return page.getByRole("dialog", { name: "Account setup" });
 }
 
 async function expectAccountSettingsSurface(settings: Locator) {
@@ -981,19 +981,31 @@ async function expectMobileSettingsLayout(settings: Locator) {
 }
 
 async function expectAccountSetupSurface(setup: Locator) {
-  await expect(setup.getByRole("heading", { name: "Set up your workspace" })).toBeVisible();
-  await expect(setup.getByLabel("Email address")).toBeVisible();
-  await expect(setup.getByRole("button", { name: "Continue with email" })).toBeVisible();
+  await expect(setup.getByRole("heading", { name: "Continue to your workspace" })).toBeVisible();
+  await expect(setup.getByRole("heading", { name: "Your workspace, wherever you work." })).toBeVisible();
+  await expect(setup.getByLabel("Work email")).toBeVisible();
+  await expect(setup.getByRole("button", { name: "Continue securely" })).toBeVisible();
   await expect(setup.getByRole("button", { name: "Continue with Apple" })).toBeEnabled();
   await expect(setup.getByRole("button", { name: "Continue with Google" })).toBeEnabled();
   await expect(setup.getByRole("button", { name: "Continue with Microsoft" })).toBeEnabled();
   await expect(setup.getByText(/Apple sign-in is not available/i)).toHaveCount(0);
-  await expect(setup.getByRole("heading", { name: "What’s saved where" })).toBeVisible();
-  await expect(setup.getByText("Account", { exact: true })).toHaveCount(2);
-  await expect(setup.getByText("This device", { exact: true })).toBeVisible();
-  await expect(setup.getByText(/Stay in this browser session and do not sync/i)).toBeVisible();
-  await expect(setup.getByText(/No PHI required\./i)).toBeVisible();
-  await expect(setup).toContainText("Do not enter patient-identifying information during sign-in.");
+  const accountSetupViewportWidth = await setup.evaluate(() => window.innerWidth);
+  if (accountSetupViewportWidth >= 1024) {
+    await expect(setup.getByText("Save favourites", { exact: true })).toBeVisible();
+    await expect(setup.getByText(/Reopen trusted resources on any device/i)).toBeVisible();
+    await expect(setup.getByText("Keep your clinical defaults", { exact: true })).toBeVisible();
+    await expect(setup.getByText(/Your jurisdiction and answer style follow you/i)).toBeVisible();
+    await expect(setup.getByText("Recent searches stay here", { exact: true })).toBeVisible();
+    await expect(setup.getByText(/Browser activity does not sync to your account/i)).toBeVisible();
+  } else {
+    await expect(setup.getByText("Favourites sync", { exact: true })).toBeVisible();
+    await expect(setup.getByText("Preferences sync", { exact: true })).toBeVisible();
+    await expect(setup.getByText("Searches stay here", { exact: true })).toBeVisible();
+  }
+  const privacyLink = setup.getByRole("link", { name: "Privacy and data processing" });
+  await expect(privacyLink).toBeVisible();
+  await expect(privacyLink).toHaveAttribute("href", "/privacy");
+  await expect(privacyLink.locator("xpath=..")).toContainText("Do not enter patient-identifiable information.");
 }
 
 async function expectAccountProviderLayout(setup: Locator, layout: "row" | "stack") {
@@ -1588,7 +1600,7 @@ test.describe("Clinical KB UI smoke coverage", () => {
     await expect(setup).toBeVisible();
     await expectAccountSetupSurface(setup);
     await expectAccountProviderLayout(setup, "stack");
-    await expect(setup.getByLabel("Email address")).toBeFocused();
+    await expect(setup.getByLabel("Work email")).toBeFocused();
     const setupBox = await setup.boundingBox();
     expect(setupBox).not.toBeNull();
     expect(setupBox!.x).toBeGreaterThanOrEqual(-1);
@@ -1597,8 +1609,10 @@ test.describe("Clinical KB UI smoke coverage", () => {
 
     await page.setViewportSize({ width: 320, height: 700 });
     const setupClose = setup.getByRole("button", { name: "Close account setup" });
-    await expect(setup.getByLabel("Email address")).toBeInViewport();
-    await expect(setup.getByRole("button", { name: "Continue with email" })).toBeInViewport();
+    const setupEmail = setup.getByLabel("Work email");
+    await setupEmail.scrollIntoViewIfNeeded();
+    await expect(setupEmail).toBeInViewport();
+    await expect(setup.getByRole("button", { name: "Continue securely" })).toBeInViewport();
     await expect(setupClose).toBeInViewport();
     await expectNoPageHorizontalOverflow(page);
 
@@ -1606,7 +1620,7 @@ test.describe("Clinical KB UI smoke coverage", () => {
     await setupScrollPort.evaluate((element) => {
       element.scrollTop = element.scrollHeight;
     });
-    await expect(setup.getByText("No PHI required")).toBeInViewport();
+    await expect(setup.getByRole("link", { name: "Privacy and data processing" })).toBeInViewport();
     await expect(setupClose).toBeInViewport();
 
     await page.emulateMedia({ reducedMotion: "reduce", forcedColors: "active" });

From e79e5d5900e031bd0e8ad6a47c6a23343411daea Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Fri, 14 Aug 2026 22:47:40 +0800
Subject: [PATCH 2/5] chore(review): record account setup review

---
 ...82663cf239be31aa3a5eb4df2c4e9b49b249ce251af596c2038.record.md | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 docs/branch-review-records/9ef3a3c00e3f782663cf239be31aa3a5eb4df2c4e9b49b249ce251af596c2038.record.md

diff --git a/docs/branch-review-records/9ef3a3c00e3f782663cf239be31aa3a5eb4df2c4e9b49b249ce251af596c2038.record.md b/docs/branch-review-records/9ef3a3c00e3f782663cf239be31aa3a5eb4df2c4e9b49b249ce251af596c2038.record.md
new file mode 100644
index 0000000000..5c925c86a1
--- /dev/null
+++ b/docs/branch-review-records/9ef3a3c00e3f782663cf239be31aa3a5eb4df2c4e9b49b249ce251af596c2038.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | codex/account-setup-polish-20260814 | 3606707b65a82f5ace23f8a162f9b229f83b7019 | account setup responsive auth privacy UI | No reproducible P0-P3 findings; local dev-server stale chunk was cleared by repository-safe restart and did not reproduce | live desktop and 390px phone review; axe WCAG A/AA 0 violations; focused DOM 17 passed; focused Chromium desktop and phone passed; typecheck, formatting, production-readiness passed; verify:pr-local timed out after 15 minutes without decisive output |

From 9c3d1b9dbf4484205c0d636337f72b4e9d1bbc4c Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Sun, 16 Aug 2026 02:27:11 +0800
Subject: [PATCH 3/5] fix(services): remove quick-search suggestions from
 service filters

---
 docs/filter-contract.md                       |  9 +++---
 .../services/services-navigator-page.tsx      | 29 -------------------
 tests/ui-tools.spec.ts                        | 15 +++-------
 3 files changed, 9 insertions(+), 44 deletions(-)

diff --git a/docs/filter-contract.md b/docs/filter-contract.md
index 0469e77946..342de4b41a 100644
--- a/docs/filter-contract.md
+++ b/docs/filter-contract.md
@@ -28,10 +28,11 @@ does today — tells the reader they cannot hold two domains at once, which is f
 
 ### There is no `navigate` kind, and that is the point
 
-Services' quick filters do not filter. They call `router.push` and **replace the query**, so
-choosing one discards the search and its results with no warning and no undo. A control labelled
-"Filter" must not do that. Query-replacing presets belong beside the composer as suggested
-searches (`AnswerSuggestionChips`), not inside the filter sheet.
+Services' former quick filters did not filter. They called `router.push` and **replaced the query**,
+so choosing one discarded the search and its results with no warning and no undo. A control labelled
+"Filter" must not do that. The presets were removed because they also competed visually with the
+service-group navigation; query-replacing suggestions should only return if they have a distinct,
+clearly labelled home beside the composer.
 
 Factsheets' category dimension is not this pattern, despite an earlier draft of this section
 grouping it with services' quick filters: `filterFactsheets(query, category)` ANDs the two, so
diff --git a/src/components/services/services-navigator-page.tsx b/src/components/services/services-navigator-page.tsx
index b02e528d70..e6443dfbcf 100644
--- a/src/components/services/services-navigator-page.tsx
+++ b/src/components/services/services-navigator-page.tsx
@@ -13,7 +13,6 @@ import {
   SearchResultsSkeleton,
 } from "@/components/clinical-dashboard/search-results-header-band";
 import { UniversalSearchAlsoMatches } from "@/components/clinical-dashboard/universal-search-also-matches";
-import { AnswerSuggestionChips } from "@/components/clinical-dashboard/answer-suggestion-chips";
 import {
   ResultFilterSheet,
   ResultFilterTrigger,
@@ -55,16 +54,6 @@ import { useRegistryRecords } from "@/lib/use-registry-records";
 
 type ServiceResultScope = "results" | "all";
 
-const bestFitQuery = "13YARN crisis Aboriginal Torres Strait Islander phone";
-const serviceQuickFilters = [
-  { label: "Best fit", query: bestFitQuery },
-  { label: "Crisis", query: "crisis" },
-  { label: "Culturally safe", query: "Aboriginal Torres Strait Islander" },
-  { label: "Phone referral", query: "phone referral" },
-  { label: "Free", query: "free" },
-  { label: "WA", query: "WA" },
-] as const;
-
 function displayText(value: string | null | undefined, fallback = "Confirm locally") {
   return value?.trim() ? value.trim() : fallback;
 }
@@ -661,24 +650,6 @@ export function ServicesNavigatorPage() {
               ) : undefined
             }
           />
-
-          {/* Evicted from the filter sheet: every quick filter called
-              `router.push` and replaced the query outright, discarding the
-              search and its results with no warning and no undo — exactly
-              what docs/filter-contract.md section 1 forbids inside a control
-              labelled "Filter". Framed as a new search, which is what
-              picking one does. */}
-          <AnswerSuggestionChips
-            label="Try a focused search"
-            labelPlacement="above"
-            layout="scroll"
-            testId="service-quick-search-suggestions"
-            suggestions={serviceQuickFilters.map((filter) => filter.label)}
-            onPick={(label) => {
-              const filter = serviceQuickFilters.find((item) => item.label === label);
-              if (filter) applyServiceQuery(filter.query);
-            }}
-          />
         </>
       }
     >
diff --git a/tests/ui-tools.spec.ts b/tests/ui-tools.spec.ts
index ee790159a6..8e1cbf323e 100644
--- a/tests/ui-tools.spec.ts
+++ b/tests/ui-tools.spec.ts
@@ -1132,8 +1132,7 @@ test.describe("Clinical KB tools launcher", () => {
     const quickFilter = page.getByTestId("service-filter-trigger-phone");
     await expect(quickFilter).toBeVisible();
     await expect(quickFilter).toHaveAccessibleName(/No filters active/);
-    await page.getByTestId("service-quick-search-suggestions").getByRole("button", { name: "Crisis" }).click();
-    await expect(page).toHaveURL(/\/services\?.*q=crisis/);
+    await expect(page.getByText("Try a focused search", { exact: true })).toHaveCount(0);
 
     // Phones keep the full search results in the page instead of opening a
     // command sheet over the small viewport.
@@ -1330,6 +1329,7 @@ test.describe("Clinical KB tools launcher", () => {
     await gotoLauncher(page, "/services?focus=1");
     await expect(page.getByTestId("services-home").getByTestId("global-search-input")).toBeVisible();
     await expect(page.getByTestId("services-home").getByTestId("global-search-input")).toBeFocused();
+    await expect(page.getByText("Try a focused search", { exact: true })).toHaveCount(0);
 
     await gotoLauncher(page, "/forms?focus=1");
     await expect(visibleByTestId(page, "forms-home").getByTestId("global-search-input")).toBeVisible();
@@ -1370,16 +1370,9 @@ test.describe("Clinical KB tools launcher", () => {
     await expect(page.getByRole("navigation", { name: "Service groups" })).toBeVisible();
     await expect(page.getByTestId("services-shortlist-bar")).toHaveCount(0);
 
-    const culturallySafe = page
-      .getByTestId("service-quick-search-suggestions")
-      .getByRole("button", { name: "Culturally safe" });
-    await expect(culturallySafe).toBeVisible();
-    await waitForReactEventHandler(culturallySafe);
-    await culturallySafe.click();
-    await expect(page).toHaveURL(/q=Aboriginal\+Torres\+Strait\+Islander/);
+    await expect(page.getByText("Try a focused search", { exact: true })).toHaveCount(0);
     await expect(page.getByTestId("service-search-result-13yarn")).toBeVisible();
 
-    // Quick search suggestions and facet clearing are separate contracts.
     // Exercise a real facet, then clear only that facet while preserving q.
     await page.getByTestId("service-filter-trigger-desktop").click();
     const filterPanel = page.getByTestId("service-filter-panel");
@@ -1389,7 +1382,7 @@ test.describe("Clinical KB tools launcher", () => {
     await crisisFacet.click();
     await expect(page).toHaveURL(/acuity_flags=crisis_high/);
     await filterPanel.getByTestId("service-filter-panel-clear").click();
-    await expect(page).toHaveURL(/q=Aboriginal\+Torres\+Strait\+Islander/);
+    await expect(page).toHaveURL(/q=13YARN/);
     await expect(page.getByTestId("service-search-result-13yarn")).toBeVisible();
     await filterPanel.getByRole("button", { name: "Close", exact: true }).click();
 

From 8d59aecbdc648fe87fe14f17c223150799c30c7a Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Mon, 17 Aug 2026 00:08:06 +0800
Subject: [PATCH 4/5] Add outstanding-issues row-staleness fingerprint checks

---
 scripts/check-outstanding-issues.mjs | 22 ++++++++++
 scripts/ledger-inbox.mjs             | 62 ++++++++++++++++++++++++++--
 tests/repo-hygiene.test.ts           | 55 +++++++++++++++++++++++-
 3 files changed, 134 insertions(+), 5 deletions(-)

diff --git a/scripts/check-outstanding-issues.mjs b/scripts/check-outstanding-issues.mjs
index ac586f1b58..19e6d23e8a 100644
--- a/scripts/check-outstanding-issues.mjs
+++ b/scripts/check-outstanding-issues.mjs
@@ -29,6 +29,7 @@
 
 import { execFileSync } from "node:child_process";
 import { readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
 
 export const ISSUES_PATH = "docs/outstanding-issues.md";
 
@@ -52,6 +53,7 @@ const QUEUE_ID_CITATION = /#(\d+)/g;
  * id shape is validated rather than assumed.
  */
 const ID_CELL = /^#\d+$/;
+const ISSUE_ROW_FINGERPRINT = /^[0-9a-f]{64}$/i;
 /**
  * A table's separator row, e.g. `| ---- | --- |`, which declares its width.
  * The inner pipes must be in the class: without them this only ever matched a
@@ -259,6 +261,26 @@ export function parseIssues(markdown) {
   };
 }
 
+export function issueRowFingerprint(markdown, issueId) {
+  const match = String(issueId)
+    .trim()
+    .match(/^#(\d+)$/);
+  if (!match) return null;
+  const number = Number(match[1]);
+  if (!Number.isFinite(number)) return null;
+
+  const row = parseIssues(markdown).rows.find(
+    (entry) => entry.number === number && entry.table === "open" && entry.valid && entry.raw,
+  );
+  if (!row) return null;
+  const normalized = `| ${cells(row.raw).join(" | ")} |`;
+  return createHash("sha256").update(normalized).digest("hex");
+}
+
+export function isValidIssueRowFingerprint(value) {
+  return ISSUE_ROW_FINGERPRINT.test(String(value ?? ""));
+}
+
 export function checkIssues(markdown, { prettierIgnored = false } = {}) {
   const problems = [];
   const { openStart, archiveStart, nextId, markerCount, rows, orphans, bodyCount, queueCitations } =
diff --git a/scripts/ledger-inbox.mjs b/scripts/ledger-inbox.mjs
index 7a856fd00c..637b849207 100644
--- a/scripts/ledger-inbox.mjs
+++ b/scripts/ledger-inbox.mjs
@@ -13,7 +13,12 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { addIssue, resolveIssue, updateIssue } from "./outstanding-issues.mjs";
-import { ISSUES_PATH, checkIssues } from "./check-outstanding-issues.mjs";
+import {
+  ISSUES_PATH,
+  checkIssues,
+  issueRowFingerprint,
+  isValidIssueRowFingerprint,
+} from "./check-outstanding-issues.mjs";
 
 const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
 const INBOX_DIR = "docs/outstanding-issues-inbox";
@@ -38,6 +43,10 @@ function requestPath(id) {
   return path.posix.join(INBOX_DIR, `${id}.json`);
 }
 
+function readOutstandingIssues() {
+  return readFileSync(path.join(ROOT, ISSUES_PATH), "utf8");
+}
+
 export function validateRequest(request) {
   const problems = [];
   if (!request || typeof request !== "object") return ["request must be an object"];
@@ -53,6 +62,11 @@ export function validateRequest(request) {
   if (request.action === "done") {
     if (!/^#\d{3,}$/.test(request.payload?.id ?? "")) problems.push("done requires a canonical #NNN id");
     if (!request.payload?.outcome) problems.push("done requires outcome");
+    if (
+      request.payload?.baseRowFingerprint !== undefined &&
+      !isValidIssueRowFingerprint(request.payload.baseRowFingerprint)
+    )
+      problems.push("done requires a valid baseRowFingerprint");
   }
   if (request.action === "update") {
     if (!/^#\d{3,}$/.test(request.payload?.id ?? "")) problems.push("update requires a canonical #NNN id");
@@ -62,6 +76,11 @@ export function validateRequest(request) {
     if (!["pri", "summary", "detail", "source"].some((field) => request.payload?.[field] !== undefined)) {
       problems.push("update requires pri, summary, detail, or source");
     }
+    if (
+      request.payload?.baseRowFingerprint !== undefined &&
+      !isValidIssueRowFingerprint(request.payload.baseRowFingerprint)
+    )
+      problems.push("update requires a valid baseRowFingerprint");
     if (request.payload?.pri !== undefined && !["P1", "P2", "P3"].includes(String(request.payload.pri))) {
       problems.push("update pri must be P1, P2, or P3");
     }
@@ -82,6 +101,18 @@ export function applyRequest(markdown, request) {
     throw new Error("cancel requests must be applied through batch reconciliation");
   }
   const options = { date: request.createdOn };
+  if ((request.action === "done" || request.action === "update") && request.payload?.baseRowFingerprint) {
+    const id = request.payload.id;
+    const fingerprint = issueRowFingerprint(markdown, id);
+    if (!fingerprint) {
+      throw new Error(`${id} is no longer open; reread and reissue this request from the latest ledger`);
+    }
+    if (fingerprint !== request.payload.baseRowFingerprint) {
+      throw new Error(
+        `${id} is stale: the ledger row changed after this request was queued; reread and reissue from the latest ledger`,
+      );
+    }
+  }
   if (request.action === "add") return addIssue(markdown, request.payload, options);
   if (request.action === "done") return resolveIssue(markdown, request.payload.id, request.payload.outcome, options);
   return updateIssue(markdown, request.payload.id, request.payload);
@@ -344,6 +375,13 @@ function createRequest(action, argv) {
               detail: argValue(argv, "detail"),
               source: argValue(argv, "source"),
             };
+  if (["done", "update"].includes(action) && typeof payload.id === "string") {
+    const currentFingerprint = issueRowFingerprint(readOutstandingIssues(), payload.id);
+    if (currentFingerprint === null) {
+      throw new Error(`ledger request rejected: ${payload.id} is not in Open items`);
+    }
+    payload.baseRowFingerprint = currentFingerprint;
+  }
   const request = { version: 1, id: randomUUID(), createdOn: date(), action, payload };
   const problems = validateRequest(request);
   if (problems.length > 0) throw new Error(problems.join("; "));
@@ -498,14 +536,14 @@ function selfTest() {
     id: "22222222-2222-4222-8222-222222222222",
     createdOn: "2026-08-13",
     action: "done",
-    payload: { id: "#001", outcome: "done" },
+    payload: { id: "#001", outcome: "done", baseRowFingerprint: issueRowFingerprint(base, "#001") },
   };
   const update = {
     version: 1,
     id: "33333333-3333-4333-8333-333333333333",
     createdOn: "2026-08-13",
     action: "update",
-    payload: { id: "#001", summary: "updated" },
+    payload: { id: "#001", summary: "updated", baseRowFingerprint: issueRowFingerprint(base, "#001") },
   };
   const cancel = {
     version: 1,
@@ -522,7 +560,7 @@ function selfTest() {
     id: "55555555-5555-4555-8555-555555555555",
     createdOn: "2026-08-13",
     action: "update",
-    payload: { id: "#001", pri: "P3" },
+    payload: { id: "#001", pri: "P3", baseRowFingerprint: issueRowFingerprint(base, "#001") },
   };
   if (validateRequest(reprioritise).length > 0) {
     throw new Error("self-test failed: a pri-only update request must validate");
@@ -543,6 +581,22 @@ function selfTest() {
   if (validateRequest({ ...add, payload: {} }).length === 0)
     throw new Error("self-test failed: invalid request accepted");
 
+  const staleBase = base.replace("one", "stale");
+  let staleRejected = false;
+  try {
+    applyRequest(staleBase, done);
+  } catch (error) {
+    staleRejected = /stale/.test(String(error));
+  }
+  if (!staleRejected) throw new Error("self-test failed: stale done request was not rejected");
+  let staleUpdateRejected = false;
+  try {
+    applyRequest(staleBase, update);
+  } catch (error) {
+    staleUpdateRejected = /stale/.test(String(error));
+  }
+  if (!staleUpdateRejected) throw new Error("self-test failed: stale update request was not rejected");
+
   let conflictRejected = false;
   try {
     applyRequestBatch(base, [done, update]);
diff --git a/tests/repo-hygiene.test.ts b/tests/repo-hygiene.test.ts
index 8d443d34ae..ca6c4d38ae 100644
--- a/tests/repo-hygiene.test.ts
+++ b/tests/repo-hygiene.test.ts
@@ -36,7 +36,7 @@ import {
   sanitizeCell,
 } from "../scripts/branch-review-ledger.mjs";
 import { validateLedger } from "../scripts/check-branch-review-ledger.mjs";
-import { mergeAttributeProblem } from "../scripts/check-outstanding-issues.mjs";
+import { issueRowFingerprint, mergeAttributeProblem } from "../scripts/check-outstanding-issues.mjs";
 import { applyRequest, validateRequest } from "../scripts/ledger-inbox.mjs";
 
 describe("check-env-parity name parsing", () => {
@@ -673,4 +673,57 @@ describe("outstanding-issues inbox", () => {
     ].join("\n");
     expect(applyRequest(ledger, add)).toContain("| #002 | P2 | issue | queued |");
   });
+
+  it("rejects stale done/update requests when the row hash changed after queueing", () => {
+    const ledger = [
+      "<!-- issues:next-id=2 -->",
+      "",
+      "## Recommended execution queue",
+      "",
+      "<!-- prettier-ignore -->",
+      "",
+      "| Order | ID(s) |",
+      "| --- | --- |",
+      "| 1 | `#001` |",
+      "",
+      "## Open items",
+      "",
+      "<!-- prettier-ignore -->",
+      "",
+      "| ID | Pri | Type | Summary | Detail / next action | Source | Added |",
+      "| --- | --- | --- | --- | --- | --- | --- |",
+      "| #001 | P2 | issue | original summary | original detail | source | 2026-01-01 |",
+      "",
+      "## Resolved / archive",
+      "",
+      "<!-- prettier-ignore -->",
+      "",
+      "| ID | Type | Summary | Outcome | Resolved |",
+      "| ---- | ---- | ---- | ---- | ---- |",
+      "| #000 | issue | old | done | 2026-01-01 |",
+      "",
+    ].join("\n");
+    const baseFingerprint = issueRowFingerprint(ledger, "#001");
+    expect(baseFingerprint).not.toBeNull();
+
+    const done = {
+      version: 1,
+      id: "77777777-7777-4777-8777-777777777777",
+      createdOn: "2026-08-13",
+      action: "done",
+      payload: { id: "#001", outcome: "done", baseRowFingerprint: baseFingerprint },
+    };
+    const update = {
+      version: 1,
+      id: "88888888-8888-4888-8888-888888888888",
+      createdOn: "2026-08-13",
+      action: "update",
+      payload: { id: "#001", summary: "new summary", baseRowFingerprint: baseFingerprint },
+    };
+
+    const stale = ledger.replace("original summary", "mutated summary");
+    expect(() => applyRequest(ledger, done)).not.toThrow();
+    expect(() => applyRequest(stale, done)).toThrow(/stale|no longer open/);
+    expect(() => applyRequest(stale, update)).toThrow(/stale|no longer open/);
+  });
 });

From 3662e35e439d5420812d84de08f2ee56670b570b Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Mon, 17 Aug 2026 16:19:59 +0800
Subject: [PATCH 5/5] Resolve merge conflicts + review fixes for PR #2009
 (#2018)

---
 .claude/hooks/issues-surface.sh               |   8 +-
 .claude/skills/handoff/SKILL.md               |   8 +
 .claude/skills/issues/SKILL.md                |   6 +
 .claude/skills/newtask/SKILL.md               |   8 +
 .design-sync/config.json                      |   2 +-
 .env.example                                  |   3 +
 .github/workflows/ci.yml                      |   8 +
 docs/README.md                                |   3 +
 docs/audit/live-drift-forensics-2026-08.md    | 235 +++++-
 ...ab62d03663c70e87ffdf0209fa2e5790.record.md |   1 +
 ...30c8fad36ffc94a1bafd0d5ca55693a7.record.md |   1 +
 ...53c64dbd30e5af948b0b041bd6ba537b.record.md |   1 +
 ...79183c4c8cd7d6d8303dba20a80489f4.record.md |   1 +
 ...ae2c97681ffc7179731785beb78b5a6a.record.md |   1 +
 ...b6e8fe8167098620126ddf8a61a1994e.record.md |   1 +
 ...415668919f9bc7f081bedf9fe16aecdf.record.md |   1 +
 ...8545f45e9ac5efe70e8e97e97233dfa6.record.md |   1 +
 ...55ccff9c97fc5f4a99286d566142b192.record.md |   1 +
 ...4eceaa07712147fdfb1fd71dcf2603d5.record.md |   1 +
 ...7f67b4c39e333654499b933d49b6b0f4.record.md |   1 +
 ...63a92e5d288897225e5e48dfe6822ca8.record.md |   1 +
 ...924563215dd96f29802abdb3f093fc41.record.md |   1 +
 ...526366619d6e858107ca0fe108f95382.record.md |   1 +
 ...3bac3f9a436acc5b0336b62533ab1c54.record.md |   1 +
 ...72c2610971d057b366f68f12bc87baba.record.md |   1 +
 ...56a5a019e93f3966580d3d41434e2a47.record.md |   1 +
 ...4d99c4075a36d42378e4fe7717a9b02f.record.md |   1 +
 ...3d7b2f39f39414b70103aab3a0a8fcc0.record.md |   1 +
 ...c22f231e8ebb30f3023eb4a5956ceef8.record.md |   1 +
 ...06a309c9f0d6beb92203bdd5717f47b3.record.md |   1 +
 ...647dac6fb84d348f6b12fea7f87e7968.record.md |   1 +
 ...5c4f4b2c2e82254fec86eb5c50ee6784.record.md |   1 +
 ...6b5c09228a76c7dcb950557c88123401.record.md |   1 +
 ...7e10477e73f22ca8c1ccfe02d4b84f50.record.md |   1 +
 ...b41a6841e644b036b1b0f9f54b118f37.record.md |   1 +
 ...e737d1565612b12828818d2377162c38.record.md |   1 +
 ...84067c3339f7a2f50cd5c5e642b9988e.record.md |   1 +
 ...0ef55dcb9d41bac400841a83eb4564f3.record.md |   1 +
 ...5a8e7d5b869c94ad78c36a062211e4e5.record.md |   1 +
 ...a51012c6de6ec22028f0f2b600adeaa7.record.md |   1 +
 ...38816418b90abb2584b88d3d49962c5d.record.md |   1 +
 ...b1ad5125cb1551eb036da361229c79c6.record.md |   1 +
 ...6a9dbfa89fdd249cead35fa563bd9119.record.md |   1 +
 ...aa45acffe5c1fd6c10a285564b8465e6.record.md |   1 +
 ...85cd5e9fa87be7bbcb0fe5f75c369912.record.md |   1 +
 ...4a753cf9a1522a6298f9286d8835adfd.record.md |   1 +
 ...494337db0a6927d4b2f55c077e60c173.record.md |   1 +
 ...734364de32bf354d9092762d7a6e4786.record.md |   1 +
 ...722498df625ff9e72b40ac86e0f75fe1.record.md |   1 +
 ...d293f56e299993ebe74b56b4ea329756.record.md |   1 +
 ...51b159fedb9b0e5fce759cb470f06252.record.md |   1 +
 ...cd3d1bfd81cd70b816831c3d166119de.record.md |   1 +
 ...ea9adacc348db610be6494d50d6bd842.record.md |   1 +
 ...2c64370049420fc3dd6939b28780721b.record.md |   1 +
 ...54e02ec2055fd40acb890720fbcdd8c3.record.md |   1 +
 ...7348002139c4d9b8ead0b7bfb6c1c548.record.md |   1 +
 ...55c0164dc545dce172e67703b2be6fda.record.md |   1 +
 ...0fc3a9008650b6c058d34bd4d87a2afe.record.md |   1 +
 ...be075d7400770fbb25654628610cda51.record.md |   1 +
 ...84a4cee33bf9c809091f21ed28f76192.record.md |   1 +
 ...d4f72e244027e5a389bee78924c450cf.record.md |   1 +
 ...12fc13abb7aaf5fc9d7e6f75a3db0fa1.record.md |   1 +
 ...c8589e5a59de4871bbab616ad8a91c5c.record.md |   1 +
 ...3d033ffc179a15ef4b69248c4df83669.record.md |   1 +
 ...952b5d8479ef56a45808b8fda27bba37.record.md |   1 +
 ...04d0fd60e25fab0edbf33408b720efa9.record.md |   1 +
 ...35a1a50108e2c0268cbf41ee612eaa76.record.md |   1 +
 ...59d5509bfd975096af94b63ef16e825a.record.md |   1 +
 ...8458290b624c6b506f6fd403ad8157c0.record.md |   1 +
 ...7a5b3debdb029af744345900ca5acdc1.record.md |   1 +
 ...78ba349cd9e9f625efb537215cbf1227.record.md |   1 +
 ...3b0b76a4bfd1cd9b2c9052dca555bc08.record.md |   1 +
 ...ed6cc3c4e988daa2a9d1d5165c4a8e2e.record.md |   1 +
 ...e6bc83a7ebc8734fba8c6c71148e0d6f.record.md |   1 +
 ...0a097a15f8fb74a52623abe427f21421.record.md |   1 +
 ...5f16432fe3243bb89a199885f6a09730.record.md |   1 +
 ...69be8ad8f8459b70b86140a155a88967.record.md |   1 +
 ...e9c3055ed0b3a5f9f139a838dc8c1c2d.record.md |   1 +
 ...3fe39d02317237fbe8fe7ab43f8a459d.record.md |   1 +
 ...cd7d2e44c4b79c2badd5c8be19153682.record.md |   1 +
 ...372309f02b547300fa7ca6426587d82c.record.md |   1 +
 ...10987b3597aeef62b9a2fb964975dd5b.record.md |   1 +
 ...4f04840076dfbb4f79fa55ab14605d71.record.md |   1 +
 ...bba0026f0898a8f6e3afae6123075fce.record.md |   1 +
 ...3f3acdf9d7d26bff9e0017e1cdd58c60.record.md |   1 +
 ...3d2e2d2709bee0f3d2e35384751e8358.record.md |   1 +
 ...ca83af0e52d784bb3860e470876e1e75.record.md |   1 +
 ...508df0c95fc85014b6cc6546b765bf32.record.md |   1 +
 ...161e501d15805774b5446fb4c393d383.record.md |   1 +
 ...ac6c21d3d7912bc77caa5deda23aefea.record.md |   1 +
 ...45206350cff5c6bf2f3b86690f27c5d7.record.md |   1 +
 ...4b56cfb2c711ec548b6aeea715b05c9f.record.md |   1 +
 ...d9edbfec91f1f75fd8ba007bdd90d979.record.md |   1 +
 ...fb142e1e4e1d4b8e8d787d6abf9ea62f.record.md |   1 +
 ...101d7e3ada1bb102dcd1631e83d7bf55.record.md |   1 +
 ...b8119ba24d916c6cd8b8f521347ffd23.record.md |   1 +
 ...54ba5f04f0c8c06a38fc88ddc42c85e6.record.md |   1 +
 ...6e929cbbe76b46ab8d3a953de2b0883f.record.md |   1 +
 ...825198aad8e34f32ecc8d6381b2ce5a2.record.md |   1 +
 ...32cd9e2adbed6433ed8cb4e2e04eb3aa.record.md |   1 +
 ...3db356d6b17cf68b4829a19643b9b71a.record.md |   1 +
 ...f4c8a0d304ec3a5251f1920d023b06c0.record.md |   1 +
 ...6744d11d10a1fee600ca1eac1d0354fe.record.md |   1 +
 ...bfe7cd5a364f7fd8d8da5287aa2a4e38.record.md |   1 +
 ...0660337191337c4097bc1831ccd34960.record.md |   1 +
 ...8a27e21ebb7545745fa66facf618d208.record.md |   1 +
 ...8fd5e5b18eee189d01baaaa18ffd432c.record.md |   1 +
 ...24d3c5d61ebd572a963c9495b3745731.record.md |   1 +
 ...12cf732bc2ad6e0bfc360a7a759102ed.record.md |   1 +
 ...cb7b441b62d2ddf6230bbc962e48a76c.record.md |   1 +
 ...2ac29c430dc0d2d9fc0930d314b14c9f.record.md |   1 +
 ...dbaa08024e096bbcc0201a7434bbf1f3.record.md |   1 +
 ...659aaa9b1439015c6354eb96e19d0c46.record.md |   1 +
 ...0713a6a06b532505caa5548de80b814c.record.md |   1 +
 ...080dd7191777c1be29037b6edc8c3069.record.md |   1 +
 ...6f562cfdaabd4d2b23cd3a67336a02ff.record.md |   1 +
 ...6822d3be129f8d506cb93ac4bc3960a3.record.md |   1 +
 ...0d9dcbbfa158d1876e0ed8744f2c0162.record.md |   1 +
 ...3d10e50e1fa7091856c41a9fe03cde52.record.md |   1 +
 ...061e0b75ff2d71b8610f6b5cfd49ae43.record.md |   1 +
 ...cf8e042b608a2c3553c5ae303b34e92b.record.md |   1 +
 ...a9971399fe8906bfc771c3543c63b820.record.md |   1 +
 ...d2b404d07061df6833f1ef1289d053f3.record.md |   1 +
 ...f47b1ae95aae4517cd969e5cd9246fa6.record.md |   1 +
 ...6b1851cec993f8a91dd526fcbc750d25.record.md |   1 +
 ...3256129ab978d51a792d14ad7c785d73.record.md |   1 +
 ...3a1c9ca11fa10969155f42bcdda2e75b.record.md |   1 +
 ...2fc5f3b7bb18a89e813bc2d9a11d1e12.record.md |   1 +
 ...406c49c01ccd942a2c3f16bca8ae8ade.record.md |   1 +
 ...75b5cabc1802d1b6511b30323adad6ad.record.md |   1 +
 ...3c1893c66a80b3dc38988a8ef6ef5dc0.record.md |   1 +
 ...7b7415e4213102534a21b99bb97e87fe.record.md |   1 +
 ...f4e32aab35d3d3bfe1d0654c41f7bf34.record.md |   1 +
 ...ce45c035738a63aaa40ea6ca6afcfa3d.record.md |   1 +
 ...445bd109c6f2bfcffd686c6e436d8c74.record.md |   1 +
 ...8c6faddaa53896ff35345ca396b74fc6.record.md |   1 +
 ...1e54c41d2868644d05d96de656d0fe06.record.md |   1 +
 ...b68f83afb90f34c467a97b28ecf12fc0.record.md |   1 +
 ...0d74e359a217e4d91d21eae705b7ab81.record.md |   1 +
 ...50012974b924d01bcc5b55b6dc00d1ad.record.md |   1 +
 ...557f400ee0e274af7e1ce61963db465b.record.md |   1 +
 ...a415ce87df2c2daba46045b0b84391ab.record.md |   1 +
 ...0452994ad503349944c2fb345c8b42a1.record.md |   1 +
 ...5eafe28d82fda3e3c9386541fb3aaec0.record.md |   1 +
 ...623eaa682ce4b9524e6eed48ee04a235.record.md |   1 +
 ...9a9ba43bc3591b8d0e1bd117ed930ea5.record.md |   1 +
 ...f09cbe3e2cf670a084930b870cd6fed6.record.md |   1 +
 ...f04e9dfb00089261c37800f7d8edf694.record.md |   1 +
 ...211520ff473b1e56d7fa4d4551f1c5b3.record.md |   1 +
 ...1d5f90e53c3187b03f4165df702e9b5d.record.md |   1 +
 ...901cef851b57bccb7874d8d6ff114f54.record.md |   1 +
 ...19edd41a2f38f86c05ae354673816ce5.record.md |   1 +
 ...10ada2f3ebe7fab5da0edc041142a1c1.record.md |   1 +
 ...9e88a0195f76078511821ab44cc09456.record.md |   1 +
 ...94177a6bbdef0d1c83cfdba62a110cd4.record.md |   1 +
 ...a3b8c870210d155da52c563fca1d97d9.record.md |   1 +
 ...b1e7c8c43197488836bb70a79c6d366b.record.md |   1 +
 ...0d8615e08db6094e54733085c7427d0c.record.md |   1 +
 ...9e2c8d4ea54160fe52e351afd389f9de.record.md |   1 +
 ...8d9da4ee00a7b78131ef1396fca2dfc8.record.md |   1 +
 ...548e9f4d84b79b828a42a53505e3ff5c.record.md |   1 +
 ...648e1632d2645016ce189113e6f4a1b3.record.md |   1 +
 ...753e5c619599c803531d4bc36c6914ce.record.md |   1 +
 ...3a90a7780810546df0674fb7b35b7d50.record.md |   1 +
 ...c4292d00fcdac8e3629b2e8e1f3f4845.record.md |   1 +
 ...e4cc4398091af68728179d8b5b63e2e0.record.md |   1 +
 ...30bc14b98d5c069c3e7fa8b7f89edee4.record.md |   1 +
 ...25da55131c0caacbaab18ac81507cd0d.record.md |   1 +
 ...565e99f53e2979f061dd3cc68c012315.record.md |   1 +
 docs/database-remediation-plan.md             |  40 +-
 docs/database-remediation-playbook.md         |  39 +-
 docs/design-system/COMPONENTS.md              |   2 +-
 docs/design-system/GATES.md                   |  82 +-
 docs/design-system/adoption-contract.json     |   2 +-
 docs/design-system/adoption-manifest.json     |   8 +-
 docs/filter-contract.md                       |  29 +-
 docs/ledger-id-scheme-proposal.md             | 149 ++++
 docs/maturity-backlog-workorders.md           |  36 +-
 docs/medication-interaction-lexicon-review.md |   4 +-
 docs/medication-lexicon-review-worklist.md    | 188 +++++
 ...unchecked-indexed-access-migration-plan.md | 213 +++++
 .../1d35d652-d833-4934-890c-84b6837581cd.json |  10 +
 .../314e5e31-7d15-46f2-adb0-c4d113bc589d.json |  11 +
 .../46750cbf-f4f4-4a00-ab93-bdac644afbde.json |  10 +
 .../55cb57e8-7e6e-42f8-bd79-81b81a01ef3a.json |  11 +
 .../55f0d5de-8642-487a-b063-44c1c0bc0921.json |  10 +
 .../739887b7-24d6-4ea8-9aad-e7700a537913.json |  10 +
 .../7ad31d10-aeef-4635-863d-d6ce9340d916.json |  11 +
 .../7e454b66-74ae-4e67-8669-1f1fdc2c018c.json |  10 +
 .../81fdf812-4dd6-4fd6-b2e8-f3b730affd8a.json |  10 +
 .../a81b68eb-6b26-46db-81fa-90279a599886.json |  10 +
 .../00428ff0-1b45-4066-9838-94216fa8b6eb.json |   0
 .../01580a63-502e-4ee9-bdf2-a5bf492f7dee.json |   0
 .../04a0b8d6-8af9-4779-8af8-8e3b6e9a3b2b.json |   0
 .../0948fcd2-2e51-47bc-8990-7ec002934e43.json |  10 +
 .../0a052268-97e1-4d4a-9ad7-033003aa486c.json |  13 +
 .../0b6a19d6-c586-4ea3-8fc6-fa8ee941d922.json |  10 +
 .../0bbea6d5-4d5e-4e9a-bcba-bc129beeba3f.json |  10 +
 .../0e5573e3-425d-4253-9b28-0c1c81a4f3fe.json |  10 +
 .../11e56221-8d46-4c9a-a89c-78621f18e754.json |   0
 .../1376cc64-a753-41a0-9c54-30a5cca7f896.json |  10 +
 .../17e1baf4-7d8f-4494-acd6-a845ade305ca.json |   0
 .../1860498b-2e89-41cf-85f1-e62dc3cca057.json |  10 +
 .../19762e55-fa25-41de-a5a2-7f4932a545fe.json |  11 +
 .../19fb70c0-1fd4-43a8-a4f4-efa9c31d16b1.json |  11 +
 .../1b483041-4f2e-4ccf-872e-f7657785cfb3.json |   0
 .../1da43f2b-4b52-4fb7-b39a-e5aa5bf7c7e7.json |  12 +
 .../1e598935-a21b-4aa5-9bd2-c667ce16ebbd.json |   0
 .../2194da1d-c445-47db-8b97-09774056ab42.json |   0
 .../21b6525a-dd2d-4dcc-95d5-c3c777420adf.json |  10 +
 .../24408f86-38ff-4715-affa-55d6c7bc1bb7.json |  10 +
 .../256e9f44-2c1d-4068-a3e6-74baf3de271d.json |  11 +
 .../25f6b53a-86e2-42e9-9b38-1c2daae28892.json |   0
 .../2b7856a5-fe32-49b8-9e3c-819d961784c6.json |  10 +
 .../3156e1c9-82aa-46c3-84e6-0e119015acc6.json |  10 +
 .../33d68dca-16b7-4325-8c50-f046c2f71316.json |   0
 .../38c6095f-41f5-4925-b1ea-f5af5187885d.json |  10 +
 .../397a3588-b8cf-404b-a3d4-6060b84f7d60.json |  10 +
 .../39b08439-bd16-4b6d-b218-f04ad0a9a8cd.json |   0
 .../3d0adf39-ec7a-4fa3-9309-057a193410de.json |  10 +
 .../3d861de3-4402-4e40-8dec-8a84e10093c2.json |  10 +
 .../3dda04ff-1ae9-4153-80ed-ad081931e396.json |  10 +
 .../3f8797e0-dffa-4d26-8019-15147b9af397.json |  10 +
 .../413a0aec-0239-45b2-8880-d3ace65cfdaf.json |   0
 .../42dd600a-b032-45a5-8c53-cb185f08cf13.json |  11 +
 .../4b6930e6-fae2-4b4f-9f90-49bf0bcd548c.json |   0
 .../4b85e2d3-963d-46fe-a9c3-b234b4de14b0.json |  13 +
 .../4bc449a1-ec81-426d-aadd-8a78abec21cf.json |  11 +
 .../568597bd-fc9f-47d6-b582-443812115e67.json |  13 +
 .../5cf082dd-60c3-42ef-95dc-82b9c255e9be.json |  11 +
 .../5cf244c3-1b68-4214-8097-767b11a49e13.json |  10 +
 .../5db479fa-07fc-4e9e-a377-93b4e27797ee.json |  10 +
 .../606b1573-6217-457a-9183-7f8e550d3094.json |  10 +
 .../60fea622-a448-4e8f-a5d3-0122ab08b2d0.json |  11 +
 .../63419f06-c12a-4a84-a684-6e177f527365.json |   0
 .../69b9cd4a-9c2a-4e37-a146-48c7e540b87e.json |   0
 .../6b09c1df-5f7c-4103-af3c-aead33eafb00.json |  10 +
 .../6e354901-7694-40e0-b03d-8c398cec7b05.json |  13 +
 .../71d61764-9d93-43bd-a3d3-230f5ad78418.json |  10 +
 .../7268da45-5b77-4583-a3cb-27e5ec7067b1.json |   0
 .../74edc91b-042b-4e73-911c-286d0b38da45.json |   0
 .../7f5e6922-8d0b-424a-b359-12bed3a4e315.json |  10 +
 .../81845ded-27a8-43d8-9a56-d85a5515935b.json |  11 +
 .../83ec71cf-db94-4110-ada8-ec7e730e5154.json |  10 +
 .../8c133c4e-23e7-427f-b1b8-6d6a64dfd381.json |  11 +
 .../9792c896-78d8-46ab-b194-6a52b7fd7cab.json |  10 +
 .../97e7beeb-97e5-43a6-b238-065b42070969.json |  10 +
 .../9b67dd0e-f11e-423e-be63-7e4d91f4dd82.json |  10 +
 .../a780ce8a-a373-4c95-974f-0692af775ff6.json |  10 +
 .../a860ce7a-5ecf-4f30-a3b9-5c22d1d914b9.json |   0
 .../b53c5e20-2c6f-41da-a202-bcf5c7609938.json |  11 +
 .../b5f28517-89c9-455d-a4b4-202608141940.json |   0
 .../b7a5bee9-bddc-4a7a-9614-a49301c00cc8.json |   0
 .../b7c0f9f6-c95d-413f-9bdd-6b6ad9cbcb91.json |   0
 .../b935dad0-394c-435a-acc5-21df750c7e52.json |  11 +
 .../bbf21714-0ef9-4c2f-942f-1b8d7e328ac8.json |  11 +
 .../bcea44bc-5738-41b8-96f1-e96b1488ab29.json |  10 +
 .../bd11cfe9-1627-425f-a8f7-e0e202b980a4.json |  10 +
 .../c3622ee1-872f-4476-8b12-20e97057c5d5.json |  10 +
 .../c3d91fce-52e5-41ed-8648-b2bf5e95b32c.json |  10 +
 .../c5e84848-9a84-442e-a818-1b53df5693fa.json |  10 +
 .../c63161f6-21b8-40ec-927c-684e22791066.json |  10 +
 .../ce304701-1e01-4cfb-bf9c-202608141940.json |   0
 .../d194f4ec-568c-4689-a411-22447c59fb53.json |  13 +
 .../d226dce3-76a2-4ccc-9723-5e7ca03a6c5d.json |  10 +
 .../d229e6b5-a31a-44a9-8a7b-536e7f8ccf50.json |  10 +
 .../d2e60a94-b12a-4502-a8b9-3dc8406cc8c8.json |  13 +
 .../d3b2fe49-3282-4756-9135-7c555dede447.json |   0
 .../d52dbc3d-6759-4f6e-9089-24059830ed5a.json |  10 +
 .../d656dcb5-3228-4ab8-b40c-b0377e63cb94.json |  10 +
 .../d9a7e3fc-06e9-45ca-ab2a-202608141940.json |   0
 .../dcb09280-0436-4651-a707-b0007e872d7b.json |   0
 .../ddef5391-d476-417f-b0c8-662e44c54f8b.json |  10 +
 .../ded27e2f-5c71-43b8-99dc-ffffa6294ba3.json |   0
 .../e4a11465-348c-49e5-8a0a-202608141941.json |   0
 .../e684a311-2a0d-4c21-ba18-13afde3b62f8.json |  13 +
 .../ec6d0c23-2f19-4159-9c73-49bdc103b61e.json |  10 +
 .../ef62d13b-6852-4a12-a1d3-4d7e22ec1232.json |  11 +
 .../f3b63187-c295-4f6a-8ecd-602f348835c4.json |  10 +
 .../f825f6b9-94ec-4af1-929c-202608141941.json |   0
 .../f86a3002-5019-4ae4-93fb-d01a05a7bae6.json |  11 +
 .../f9f40594-a816-45a8-954a-3fcecf6d5d05.json |   0
 .../fbfe982f-cd2f-49c9-a94e-908a99efa6b8.json |  11 +
 .../fc23f1ec-c597-4690-b256-2263ecf73c86.json |   0
 .../fd42e1f9-4012-4296-b7c2-102c7d199738.json |  13 +
 .../fd548180-f031-44d8-bd70-24c3b03c5f21.json |  10 +
 .../e54f04f8-09bb-4887-b3e4-a5cd99958798.json |  10 +
 docs/outstanding-issues.md                    | 153 ++--
 .../plans/edge-ingestion-overhaul-3pr-plan.md | 260 ++++++
 docs/pr-handoff-stop-cross-agent-gap.md       |  95 +++
 docs/pwa.md                                   |  20 +-
 docs/scripts-index.md                         |   3 +-
 docs/search-chrome-behaviour.md               |  29 +-
 docs/site-map.md                              |   4 +-
 package.json                                  |   3 +-
 scripts/archive/backfill-document-covers.mjs  | 380 +++++++--
 scripts/audit-merge-loss.mjs                  | 574 +++++++++++++
 scripts/check-design-system-contract.mjs      |  10 +-
 scripts/check-ledger-write-discipline.mjs     |  96 +++
 scripts/check-outstanding-issues.mjs          | 173 ++--
 scripts/check-playwright-browser-revision.mjs | 202 ++++-
 scripts/ci-change-scope.mjs                   |  13 +
 scripts/design-system-contract-baseline.json  |  43 +-
 scripts/design-system-contract-utils.mjs      | 147 ++++
 scripts/generate-site-map.ts                  |   4 +-
 scripts/guard-push.mjs                        |  41 +-
 scripts/issue-id.mjs                          | 119 +++
 scripts/issues-report.mjs                     |   6 +-
 scripts/ledger-inbox.mjs                      |  96 ++-
 scripts/outstanding-issues.mjs                |  58 +-
 scripts/run-playwright.mjs                    |  27 +
 src/app/(search-app)/calculators/page.tsx     |  39 +-
 src/app/(search-app)/tools/page.tsx           |   9 +-
 src/app/api/documents/route.ts                |  48 +-
 src/app/api/ingestion/batches/route.ts        |   3 +-
 src/app/api/ingestion/jobs/route.ts           |   3 +-
 src/app/api/ingestion/quality/route.ts        | 154 ++--
 src/app/api/jobs/route.ts                     |   3 +-
 src/app/api/search/universal/route.ts         |   9 +-
 src/app/globals.css                           | 372 +++++++--
 .../accessible-table-browser-fixture/page.tsx |  27 +
 src/components/ClinicalDashboard.tsx          | 123 ++-
 src/components/applications-launcher-page.tsx |  14 +
 .../calculators/calculator-filters.ts         |  94 +++
 .../calculators/calculator-fixtures.ts        |  10 +
 .../calculators/calculator-sheet.tsx          |   2 +-
 src/components/calculators/home-page.tsx      |  58 ++
 src/components/calculators/index.ts           |   1 +
 src/components/calculators/search-page.tsx    | 752 ++++++------------
 .../clinical-dashboard/ClinicalSidebar.tsx    |   2 +
 .../account-setup-dialog.tsx                  |  24 +-
 .../answer-evidence-preview.tsx               |  67 ++
 .../clinical-dashboard/answer-progress.ts     |  10 +-
 .../clinical-dashboard/answer-request.ts      |  94 +++
 .../clinical-dashboard/answer-status.tsx      |  34 +-
 .../clinical-dashboard-helpers.ts             |  29 +
 .../clinical-dashboard/dashboard-nav.tsx      |   4 +-
 .../clinical-dashboard/differentials-home.tsx | 253 +++---
 .../favourites-command-library-page.tsx       | 502 +++++++++---
 .../favourites-library-nav.tsx                | 529 ------------
 .../global-search-shell.tsx                   |  33 +-
 .../clinical-dashboard/guide-dialog.tsx       | 106 ++-
 .../master-search-header.tsx                  |  52 +-
 .../medication-nav-header.tsx                 |   1 +
 .../medication-prescribing-workspace.tsx      |  41 +-
 .../medication-record-page.tsx                |   5 +-
 .../mobile-composer-reserve.ts                |  22 +-
 .../clinical-dashboard/mode-action-popup.tsx  |  12 +
 .../clinical-dashboard/search-utils.ts        | 106 ++-
 .../universal-search-command-surface.tsx      |   7 +-
 src/components/forms/form-detail-page.tsx     |   2 +-
 .../in-page-nav/in-page-section-rail.tsx      |   8 +-
 src/components/pwa-lifecycle.tsx              | 207 +++--
 src/components/services/service-group-nav.tsx | 113 ---
 .../services/services-navigator-page.tsx      | 516 ++++++++----
 .../tools-search-mode-mockup.tsx              |   2 +-
 .../tools/tools-search-results-page.tsx       |  80 +-
 src/components/ui/sheet.tsx                   |  33 +-
 src/lib/api-list-response.ts                  |  31 +
 src/lib/app-mode-icons.ts                     |   2 +
 src/lib/app-modes.ts                          |  27 +
 src/lib/client-env.ts                         |   7 +
 src/lib/differential-search-composition.ts    |   6 +
 src/lib/mode-secondary-navigation.ts          |   3 +-
 src/lib/rag/rag-candidate-sources.ts          |  68 +-
 src/lib/rag/rag-row-contracts.ts              | 201 +++++
 src/lib/rag/rag.ts                            |  30 +-
 src/lib/search-command-surface.ts             |  17 +
 src/lib/search-route-ownership.ts             |   2 +
 src/lib/search-shell-props.ts                 |  10 +-
 src/lib/service-core-groups.ts                |  31 +
 src/lib/ui-copy.ts                            |   3 +
 src/lib/universal-search-mode-context.ts      |   3 +
 src/lib/universal-search-stream.ts            |  13 +-
 tests/answer-activity-trace-css.test.ts       |  24 +-
 tests/answer-evidence-preview.dom.test.tsx    |  49 ++
 tests/answer-progress-ui-smoke.spec.ts        |  34 +-
 tests/answer-progress.test.ts                 | 211 ++++-
 tests/answer-request.test.ts                  | 104 +++
 tests/api-list-response.test.ts               |  18 +
 tests/api-validation-contract.test.ts         | 175 ++++
 tests/app-modes.test.ts                       |  20 +
 .../audit-navigation-auth-regressions.test.ts |  51 +-
 tests/calculators-mode.dom.test.tsx           | 240 ++++++
 .../check-playwright-browser-revision.test.ts | 332 +++++++-
 tests/ci-cache-safety.test.ts                 |   6 +
 tests/client-secret-surface.test.ts           |   6 +-
 tests/clinical-dashboard-helpers.test.ts      |  31 +
 tests/design-system-contract-utils.test.ts    |  34 +
 ...fferentials-compare-selection.dom.test.tsx | 164 +++-
 tests/differentials.test.ts                   |  17 +-
 tests/document-cover-thumbnails.test.ts       |  54 ++
 tests/document-detail-performance.test.ts     |  10 +-
 tests/document-section-nav-contract.test.ts   |  10 +-
 tests/favourites-auth-gate.dom.test.tsx       |  18 +-
 tests/favourites-demo-boundary.test.ts        |  13 +-
 tests/guard-push.test.ts                      |  43 +
 tests/guide-centre.dom.test.tsx               |  56 ++
 tests/header-scroll-hide-contract.test.ts     |  12 +-
 tests/helpers/phone-scroll.ts                 |  11 +-
 tests/helpers/source-contract.ts              | 129 +++
 tests/helpers/style-contracts.ts              |  31 +-
 tests/in-page-nav-playwright-contract.test.ts |  18 +-
 tests/in-page-nav-route-sections.dom.test.tsx |  18 +
 tests/issues-report.test.ts                   |   7 +-
 tests/ledger-inbox-cancellation.test.ts       | 113 +++
 tests/ledger-write-discipline.test.ts         |  69 ++
 tests/live-drift-workflow.test.ts             | 311 ++++++++
 ...ication-prescribing-workspace.dom.test.tsx |   8 +
 tests/merge-loss-audit.test.ts                | 292 +++++++
 tests/mobile-chrome-paint-contract.test.ts    |  14 +-
 tests/mobile-composer-reserve.test.ts         |  46 +-
 tests/mobile-sheet-safe-area-contract.test.ts |  31 +
 tests/mode-menu-prefetch.dom.test.tsx         | 109 +++
 tests/mode-secondary-navigation.test.ts       |  11 +-
 tests/outstanding-issues-writer.test.ts       |  41 +-
 tests/phone-dock-addon-contract.test.ts       |   6 +-
 tests/pwa-lifecycle.dom.test.tsx              |  40 +-
 tests/rag-retrieval-row-contract.test.ts      | 295 +++++++
 tests/registry-service-facets.test.ts         |  68 ++
 tests/repo-hygiene.test.ts                    |  12 +-
 tests/search-command-surface.test.ts          |   7 +
 tests/search-results-band-adoption.test.ts    |   4 +-
 tests/search-route-ownership.test.ts          |  37 +-
 tests/search-shell-props.test.ts              |  17 +-
 .../services-bookmark-readiness.dom.test.tsx  | 145 ++++
 tests/services-catalog.test.ts                |  28 +-
 ...s-navigator-scope-empty-state.dom.test.tsx |  17 +
 tests/shared-home-empty-state.dom.test.tsx    |   5 +
 tests/sheet.dom.test.tsx                      |  57 ++
 tests/source-contract-helper.test.ts          |  63 ++
 ...herapy-compass-responsive-contract.test.ts |   9 +-
 tests/tools-search-directions-mockups.test.ts |  12 +-
 tests/ui-forms-section-nav.spec.ts            |  24 +
 tests/ui-overlay-css-contract.test.ts         |   2 +-
 tests/ui-phone-scroll-page-owned.spec.ts      | 394 +--------
 tests/ui-pwa.spec.ts                          | 181 +++++
 tests/ui-smoke.spec.ts                        | 109 ++-
 tests/ui-stress.spec.ts                       |  26 +
 tests/ui-style-contract.spec.ts               | 153 ++++
 tests/ui-tools-search-mode-mockup.spec.ts     |   4 +-
 tests/ui-tools-show-all.spec.ts               |  39 +
 tests/ui-tools.spec.ts                        | 296 +++++--
 tests/ui-universal-search.spec.ts             |  15 +
 tests/universal-search-stream.test.ts         |  20 +
 tests/universal-search.test.ts                |  18 +
 vitest.config.mts                             |  19 +-
 447 files changed, 11725 insertions(+), 3050 deletions(-)
 create mode 100644 docs/branch-review-records/00d268a6cf6a1beeb904826b9f82a104ab62d03663c70e87ffdf0209fa2e5790.record.md
 create mode 100644 docs/branch-review-records/01671f1a4ca2796caf84922f73bc373f30c8fad36ffc94a1bafd0d5ca55693a7.record.md
 create mode 100644 docs/branch-review-records/023564085ea84fa8f81b78f3ec3e137053c64dbd30e5af948b0b041bd6ba537b.record.md
 create mode 100644 docs/branch-review-records/05b6c633adabd9647962f315da24d8e079183c4c8cd7d6d8303dba20a80489f4.record.md
 create mode 100644 docs/branch-review-records/06df711430759e1dddd2be8983c0188aae2c97681ffc7179731785beb78b5a6a.record.md
 create mode 100644 docs/branch-review-records/09f7a6223d2cc9cf801d28f42c84347fb6e8fe8167098620126ddf8a61a1994e.record.md
 create mode 100644 docs/branch-review-records/0ab0fabc55b3958783c42bcd3a18b865415668919f9bc7f081bedf9fe16aecdf.record.md
 create mode 100644 docs/branch-review-records/0bd6e78104f1efb528b8a02e6ce07cb58545f45e9ac5efe70e8e97e97233dfa6.record.md
 create mode 100644 docs/branch-review-records/0cf1eff09758f402a2e5b6d928c83a1455ccff9c97fc5f4a99286d566142b192.record.md
 create mode 100644 docs/branch-review-records/115a1304ff998fd0eeaee128b93a1b624eceaa07712147fdfb1fd71dcf2603d5.record.md
 create mode 100644 docs/branch-review-records/11809456723dae8154679a80157654f47f67b4c39e333654499b933d49b6b0f4.record.md
 create mode 100644 docs/branch-review-records/123580c2767d327b59ab4f6cc62bb75263a92e5d288897225e5e48dfe6822ca8.record.md
 create mode 100644 docs/branch-review-records/140eabfb61f0822b5fb955d0c1d8d7fd924563215dd96f29802abdb3f093fc41.record.md
 create mode 100644 docs/branch-review-records/149dbe376e6d9fa6eac0edcdb578b65c526366619d6e858107ca0fe108f95382.record.md
 create mode 100644 docs/branch-review-records/150c95562bf34c0fc9a79c97c63bbacb3bac3f9a436acc5b0336b62533ab1c54.record.md
 create mode 100644 docs/branch-review-records/1750578822f17106f9029aa52fbe2ba972c2610971d057b366f68f12bc87baba.record.md
 create mode 100644 docs/branch-review-records/1798e0af4644bdccaa00cfc3bd7fedeb56a5a019e93f3966580d3d41434e2a47.record.md
 create mode 100644 docs/branch-review-records/180f5d9460a80283fbf5730d32a11b9a4d99c4075a36d42378e4fe7717a9b02f.record.md
 create mode 100644 docs/branch-review-records/18503906b6f41b6151d7298f2a14ba993d7b2f39f39414b70103aab3a0a8fcc0.record.md
 create mode 100644 docs/branch-review-records/192997fbab4a8e3383dccff432e693a8c22f231e8ebb30f3023eb4a5956ceef8.record.md
 create mode 100644 docs/branch-review-records/19d9b5ccfa4a8c3a52744d24cfc3bb7906a309c9f0d6beb92203bdd5717f47b3.record.md
 create mode 100644 docs/branch-review-records/1bcd7481c03879170cc5f4dc265e6b1e647dac6fb84d348f6b12fea7f87e7968.record.md
 create mode 100644 docs/branch-review-records/1cd9399241d3cbac65652b1b8008514d5c4f4b2c2e82254fec86eb5c50ee6784.record.md
 create mode 100644 docs/branch-review-records/1eb170403cacbc03de02adf5632f19f46b5c09228a76c7dcb950557c88123401.record.md
 create mode 100644 docs/branch-review-records/1f2f64dc3b528b7149b664c65dc98e4b7e10477e73f22ca8c1ccfe02d4b84f50.record.md
 create mode 100644 docs/branch-review-records/1f3d777e83828ea67eb00c77229eafceb41a6841e644b036b1b0f9f54b118f37.record.md
 create mode 100644 docs/branch-review-records/2151c86f85ae9cbf8e2e8530ac02019ce737d1565612b12828818d2377162c38.record.md
 create mode 100644 docs/branch-review-records/216a72e41232d90b9641c9a9cf0446c884067c3339f7a2f50cd5c5e642b9988e.record.md
 create mode 100644 docs/branch-review-records/21c77c3c5582a1424f204ead318b9b780ef55dcb9d41bac400841a83eb4564f3.record.md
 create mode 100644 docs/branch-review-records/23787765990717e03f13cc7032add47d5a8e7d5b869c94ad78c36a062211e4e5.record.md
 create mode 100644 docs/branch-review-records/24336297cd7a192b04d348313e763ff4a51012c6de6ec22028f0f2b600adeaa7.record.md
 create mode 100644 docs/branch-review-records/248b36b92b06adf7c5c774b595dbdd7338816418b90abb2584b88d3d49962c5d.record.md
 create mode 100644 docs/branch-review-records/26cca9a8fb9d8d74d7f1ee7930cfbe94b1ad5125cb1551eb036da361229c79c6.record.md
 create mode 100644 docs/branch-review-records/28051a48f8acb8c67da3f5d43e867ed46a9dbfa89fdd249cead35fa563bd9119.record.md
 create mode 100644 docs/branch-review-records/2ac50f7ddcdaa1190c9965f50d2bd503aa45acffe5c1fd6c10a285564b8465e6.record.md
 create mode 100644 docs/branch-review-records/2cdb103223cd78c8d29b3a26ffae52f385cd5e9fa87be7bbcb0fe5f75c369912.record.md
 create mode 100644 docs/branch-review-records/2f102c68fe61b45d4dbfd9b43a1ca1d14a753cf9a1522a6298f9286d8835adfd.record.md
 create mode 100644 docs/branch-review-records/2fed40a238cbd6e5803e25f6c4778648494337db0a6927d4b2f55c077e60c173.record.md
 create mode 100644 docs/branch-review-records/332ea83963cbf2857a64df609c9722ca734364de32bf354d9092762d7a6e4786.record.md
 create mode 100644 docs/branch-review-records/34ba441a8c53d4b7eaa2bb5afd846da9722498df625ff9e72b40ac86e0f75fe1.record.md
 create mode 100644 docs/branch-review-records/3553393e685f32b5925dc037af832d38d293f56e299993ebe74b56b4ea329756.record.md
 create mode 100644 docs/branch-review-records/35ae4a75db629a7a9ee8b0daf3b933bb51b159fedb9b0e5fce759cb470f06252.record.md
 create mode 100644 docs/branch-review-records/365fa9a7353142f52f78e4498f1a4046cd3d1bfd81cd70b816831c3d166119de.record.md
 create mode 100644 docs/branch-review-records/39058fcc89165e68d1e7359bb28e8b83ea9adacc348db610be6494d50d6bd842.record.md
 create mode 100644 docs/branch-review-records/39296f14956e2712c76344bea1eb1d312c64370049420fc3dd6939b28780721b.record.md
 create mode 100644 docs/branch-review-records/3c872a41535a5852133f97afa60a07d554e02ec2055fd40acb890720fbcdd8c3.record.md
 create mode 100644 docs/branch-review-records/3d1e296045909c10383c715b1abaa9ee7348002139c4d9b8ead0b7bfb6c1c548.record.md
 create mode 100644 docs/branch-review-records/3d45d96c0c8e97d835c1a3f6c12b320255c0164dc545dce172e67703b2be6fda.record.md
 create mode 100644 docs/branch-review-records/3dc49fdd6e24d09e3e6830eb12934c340fc3a9008650b6c058d34bd4d87a2afe.record.md
 create mode 100644 docs/branch-review-records/3e31711658b047a477e82af444f00d88be075d7400770fbb25654628610cda51.record.md
 create mode 100644 docs/branch-review-records/3fbcef2b507598e6baa40944420519cc84a4cee33bf9c809091f21ed28f76192.record.md
 create mode 100644 docs/branch-review-records/40b0c05db4e9b44c17bc78bb0246cd15d4f72e244027e5a389bee78924c450cf.record.md
 create mode 100644 docs/branch-review-records/417c3d2bbb8346fc650dc4bed9db149912fc13abb7aaf5fc9d7e6f75a3db0fa1.record.md
 create mode 100644 docs/branch-review-records/4405a36b7fedb006b4f8a9947a9e66aec8589e5a59de4871bbab616ad8a91c5c.record.md
 create mode 100644 docs/branch-review-records/44c2668e0a184a3856e8f614a4358bb33d033ffc179a15ef4b69248c4df83669.record.md
 create mode 100644 docs/branch-review-records/4575cff3b5b7591de309f5e375293bda952b5d8479ef56a45808b8fda27bba37.record.md
 create mode 100644 docs/branch-review-records/4859907cc6069250fcef7f0156490f1e04d0fd60e25fab0edbf33408b720efa9.record.md
 create mode 100644 docs/branch-review-records/497a7b26ad6568692b3dbc9e939c1e7d35a1a50108e2c0268cbf41ee612eaa76.record.md
 create mode 100644 docs/branch-review-records/4a51a80a457f85c939048278f01e3a3059d5509bfd975096af94b63ef16e825a.record.md
 create mode 100644 docs/branch-review-records/4a8002d2aa8743b62a8189f3bd3621768458290b624c6b506f6fd403ad8157c0.record.md
 create mode 100644 docs/branch-review-records/4dbb7f7d041801dbdbfb1360d45e46027a5b3debdb029af744345900ca5acdc1.record.md
 create mode 100644 docs/branch-review-records/4e9b4d92a67f8938115ff0ea2b99458078ba349cd9e9f625efb537215cbf1227.record.md
 create mode 100644 docs/branch-review-records/51a91c30aac9b44f7a14db23c3b96cf23b0b76a4bfd1cd9b2c9052dca555bc08.record.md
 create mode 100644 docs/branch-review-records/522436cc75e96c3d5ec24c4ed5206978ed6cc3c4e988daa2a9d1d5165c4a8e2e.record.md
 create mode 100644 docs/branch-review-records/534a1703b8963c66fe43de4889cf3f33e6bc83a7ebc8734fba8c6c71148e0d6f.record.md
 create mode 100644 docs/branch-review-records/55297ab0e355af3fbf69ae0321defbaa0a097a15f8fb74a52623abe427f21421.record.md
 create mode 100644 docs/branch-review-records/5bffd23d66a7e2f1ef7b6b9a3b4188835f16432fe3243bb89a199885f6a09730.record.md
 create mode 100644 docs/branch-review-records/5c0ac2f4e15f46fb39e8fd09c38c3cc169be8ad8f8459b70b86140a155a88967.record.md
 create mode 100644 docs/branch-review-records/5dfd91a1c7b294fec5c2fca7834a9812e9c3055ed0b3a5f9f139a838dc8c1c2d.record.md
 create mode 100644 docs/branch-review-records/5fb194b68baa840377fcf801664fdbe23fe39d02317237fbe8fe7ab43f8a459d.record.md
 create mode 100644 docs/branch-review-records/60422ff1c15e4237b0b0d3028b47dde0cd7d2e44c4b79c2badd5c8be19153682.record.md
 create mode 100644 docs/branch-review-records/60f458bc7e118a4c0f36e12b0294e651372309f02b547300fa7ca6426587d82c.record.md
 create mode 100644 docs/branch-review-records/615deb9148ec106e31cf72902d4a1b2710987b3597aeef62b9a2fb964975dd5b.record.md
 create mode 100644 docs/branch-review-records/61a53ca459551a7a2ca43dee60a4d50a4f04840076dfbb4f79fa55ab14605d71.record.md
 create mode 100644 docs/branch-review-records/63bb22a3ea42c41966caaa63a61b73a2bba0026f0898a8f6e3afae6123075fce.record.md
 create mode 100644 docs/branch-review-records/642a0ca61b346fbb0b4dd8bda07b9e763f3acdf9d7d26bff9e0017e1cdd58c60.record.md
 create mode 100644 docs/branch-review-records/652d642c8900c600dd0d8e9f229c6c9f3d2e2d2709bee0f3d2e35384751e8358.record.md
 create mode 100644 docs/branch-review-records/65bf63ffd245181d054f30ee9fc24f16ca83af0e52d784bb3860e470876e1e75.record.md
 create mode 100644 docs/branch-review-records/667079dd07cd03821a2d3b2ec65a1d04508df0c95fc85014b6cc6546b765bf32.record.md
 create mode 100644 docs/branch-review-records/6897c4836aee66827e7eec71bfa16917161e501d15805774b5446fb4c393d383.record.md
 create mode 100644 docs/branch-review-records/68deea2b69f60f4b52bdea24ceb748ddac6c21d3d7912bc77caa5deda23aefea.record.md
 create mode 100644 docs/branch-review-records/6c6404a8a018cff566a2b0f00c17f87c45206350cff5c6bf2f3b86690f27c5d7.record.md
 create mode 100644 docs/branch-review-records/6edbc14cf38b74d61a02ebdd3bb7c5114b56cfb2c711ec548b6aeea715b05c9f.record.md
 create mode 100644 docs/branch-review-records/6f2e5ab42932b76f6bc1f9e99c44558ad9edbfec91f1f75fd8ba007bdd90d979.record.md
 create mode 100644 docs/branch-review-records/6fdbf4d3fb732b73a4c56c0bb3c09278fb142e1e4e1d4b8e8d787d6abf9ea62f.record.md
 create mode 100644 docs/branch-review-records/7060c1fcf1c15570212c29f7afe5379d101d7e3ada1bb102dcd1631e83d7bf55.record.md
 create mode 100644 docs/branch-review-records/70ed179206c9c4c492ee7a969f0a2c5bb8119ba24d916c6cd8b8f521347ffd23.record.md
 create mode 100644 docs/branch-review-records/711ddbc0e2119fb166c1c4267644135f54ba5f04f0c8c06a38fc88ddc42c85e6.record.md
 create mode 100644 docs/branch-review-records/719b4f9ab3ccc24a497b1f84a5262acd6e929cbbe76b46ab8d3a953de2b0883f.record.md
 create mode 100644 docs/branch-review-records/71e026951e34c888a933c97c6f0f48f3825198aad8e34f32ecc8d6381b2ce5a2.record.md
 create mode 100644 docs/branch-review-records/73e1ce27d354653c23fc961f40f9d63232cd9e2adbed6433ed8cb4e2e04eb3aa.record.md
 create mode 100644 docs/branch-review-records/74e47bb0fd4e2b3ff3ec524606a00b573db356d6b17cf68b4829a19643b9b71a.record.md
 create mode 100644 docs/branch-review-records/7620543101feadcebdc49427ad0395f1f4c8a0d304ec3a5251f1920d023b06c0.record.md
 create mode 100644 docs/branch-review-records/771a9eb221c68c8d73f05d8831089a7b6744d11d10a1fee600ca1eac1d0354fe.record.md
 create mode 100644 docs/branch-review-records/7a1bb8ea354bbff006a1deb9148167b6bfe7cd5a364f7fd8d8da5287aa2a4e38.record.md
 create mode 100644 docs/branch-review-records/7b17944b9be99b8dfecf5a608e68fcee0660337191337c4097bc1831ccd34960.record.md
 create mode 100644 docs/branch-review-records/7bd50bd9c4093cf764692231945db6e88a27e21ebb7545745fa66facf618d208.record.md
 create mode 100644 docs/branch-review-records/7ce860ee652bd3f4e91c56cab26f002c8fd5e5b18eee189d01baaaa18ffd432c.record.md
 create mode 100644 docs/branch-review-records/801656524b713b73ce558ee09425ea5e24d3c5d61ebd572a963c9495b3745731.record.md
 create mode 100644 docs/branch-review-records/80cbe21a397bb239bbc43ceca3bf117412cf732bc2ad6e0bfc360a7a759102ed.record.md
 create mode 100644 docs/branch-review-records/8145832620703718dd3e73fb75753072cb7b441b62d2ddf6230bbc962e48a76c.record.md
 create mode 100644 docs/branch-review-records/8243bee1cb3db8072c44ead4c341496c2ac29c430dc0d2d9fc0930d314b14c9f.record.md
 create mode 100644 docs/branch-review-records/87f8cf80747ffeca51cee65f24c1a612dbaa08024e096bbcc0201a7434bbf1f3.record.md
 create mode 100644 docs/branch-review-records/887618b97bf3256125def037cd1b5e87659aaa9b1439015c6354eb96e19d0c46.record.md
 create mode 100644 docs/branch-review-records/898e1bc7855d44ca3df03b0c0f9747960713a6a06b532505caa5548de80b814c.record.md
 create mode 100644 docs/branch-review-records/8a26a9949fd0c9384acd0f0868d96374080dd7191777c1be29037b6edc8c3069.record.md
 create mode 100644 docs/branch-review-records/8f593be414cd088768dc59074dcd77476f562cfdaabd4d2b23cd3a67336a02ff.record.md
 create mode 100644 docs/branch-review-records/903f043f143538cff9e2ce0043a9d2fa6822d3be129f8d506cb93ac4bc3960a3.record.md
 create mode 100644 docs/branch-review-records/91679c0f8d364c93cfbe6f9c54463ec90d9dcbbfa158d1876e0ed8744f2c0162.record.md
 create mode 100644 docs/branch-review-records/99bf725572728b2e2a1e7b1ddcc5f08b3d10e50e1fa7091856c41a9fe03cde52.record.md
 create mode 100644 docs/branch-review-records/9b89f9091c287b15d98bcce1bbf9c687061e0b75ff2d71b8610f6b5cfd49ae43.record.md
 create mode 100644 docs/branch-review-records/9cb91634447e60affd610471e14ffdbacf8e042b608a2c3553c5ae303b34e92b.record.md
 create mode 100644 docs/branch-review-records/a23d66df28dc33bad16d7d3883fb4129a9971399fe8906bfc771c3543c63b820.record.md
 create mode 100644 docs/branch-review-records/a5309edd41a122ccf51a2dacea385abdd2b404d07061df6833f1ef1289d053f3.record.md
 create mode 100644 docs/branch-review-records/a55dc77c0266823fc485b9f5e8b164e6f47b1ae95aae4517cd969e5cd9246fa6.record.md
 create mode 100644 docs/branch-review-records/a9f750bbfb5bbb2857e2cdbb97a2dc446b1851cec993f8a91dd526fcbc750d25.record.md
 create mode 100644 docs/branch-review-records/aa23b8cd5be8c299c1878de6b92a7b1a3256129ab978d51a792d14ad7c785d73.record.md
 create mode 100644 docs/branch-review-records/ac537aead3881d4cf73e22512e83e1803a1c9ca11fa10969155f42bcdda2e75b.record.md
 create mode 100644 docs/branch-review-records/b22a65eca447a754f2a971dae18a24a12fc5f3b7bb18a89e813bc2d9a11d1e12.record.md
 create mode 100644 docs/branch-review-records/b2482dceb2ee840589af0dfbe5f66b5f406c49c01ccd942a2c3f16bca8ae8ade.record.md
 create mode 100644 docs/branch-review-records/b3523668f8839bde68f1fae4de2e7e8275b5cabc1802d1b6511b30323adad6ad.record.md
 create mode 100644 docs/branch-review-records/b50552bc27edf96d286fcb2c582831863c1893c66a80b3dc38988a8ef6ef5dc0.record.md
 create mode 100644 docs/branch-review-records/badab2e50d140f081e049c934ff5e1c37b7415e4213102534a21b99bb97e87fe.record.md
 create mode 100644 docs/branch-review-records/bb4cf300c0917336cbfb205dc3631242f4e32aab35d3d3bfe1d0654c41f7bf34.record.md
 create mode 100644 docs/branch-review-records/bc83ff5f4c4f9421ec32cf4351708e95ce45c035738a63aaa40ea6ca6afcfa3d.record.md
 create mode 100644 docs/branch-review-records/bde56718d14d5138e7a29a72d16402b4445bd109c6f2bfcffd686c6e436d8c74.record.md
 create mode 100644 docs/branch-review-records/beb5fe80c053cc8851671deef0ce7cd98c6faddaa53896ff35345ca396b74fc6.record.md
 create mode 100644 docs/branch-review-records/bef6e7b39ba0aa36284eab8596c7dc491e54c41d2868644d05d96de656d0fe06.record.md
 create mode 100644 docs/branch-review-records/c0745ca069118cbdc5b5a01db696a7e7b68f83afb90f34c467a97b28ecf12fc0.record.md
 create mode 100644 docs/branch-review-records/c0e02ee4e90a6401ef8316af58b1bf530d74e359a217e4d91d21eae705b7ab81.record.md
 create mode 100644 docs/branch-review-records/c56fc20eb8b758bec749726901ef79ce50012974b924d01bcc5b55b6dc00d1ad.record.md
 create mode 100644 docs/branch-review-records/c7a8273f16ecbd3771d5a703a01cb219557f400ee0e274af7e1ce61963db465b.record.md
 create mode 100644 docs/branch-review-records/c87cf33f8557b35b1edb08b1fc38f1a5a415ce87df2c2daba46045b0b84391ab.record.md
 create mode 100644 docs/branch-review-records/c9661626e5c2a0e5f848b375b83006a00452994ad503349944c2fb345c8b42a1.record.md
 create mode 100644 docs/branch-review-records/c9a0488b91b894d94e2d4e04dcafc9695eafe28d82fda3e3c9386541fb3aaec0.record.md
 create mode 100644 docs/branch-review-records/cc0db6b399e9168bfe40fd9cdce6209b623eaa682ce4b9524e6eed48ee04a235.record.md
 create mode 100644 docs/branch-review-records/ccf620aa5c3871b3787e29f50511d79a9a9ba43bc3591b8d0e1bd117ed930ea5.record.md
 create mode 100644 docs/branch-review-records/cd495affb93b35a4c9c27292318bff9bf09cbe3e2cf670a084930b870cd6fed6.record.md
 create mode 100644 docs/branch-review-records/cebd03715e584420f2fb63b757718fd8f04e9dfb00089261c37800f7d8edf694.record.md
 create mode 100644 docs/branch-review-records/d05426d18a2ed15eb393d7bc70c57358211520ff473b1e56d7fa4d4551f1c5b3.record.md
 create mode 100644 docs/branch-review-records/d50a877214261c376d150342864090de1d5f90e53c3187b03f4165df702e9b5d.record.md
 create mode 100644 docs/branch-review-records/d545333169b6e7645c813d4f760bcc8d901cef851b57bccb7874d8d6ff114f54.record.md
 create mode 100644 docs/branch-review-records/d566ba015a558b6a48c81f5c8d59fd2b19edd41a2f38f86c05ae354673816ce5.record.md
 create mode 100644 docs/branch-review-records/df5b100555e4f07ef667054d2a80ba9f10ada2f3ebe7fab5da0edc041142a1c1.record.md
 create mode 100644 docs/branch-review-records/e28c56717b466a1206d6eea9b313f4a39e88a0195f76078511821ab44cc09456.record.md
 create mode 100644 docs/branch-review-records/ec64a2232c6a292e1ca38a08fc425f5194177a6bbdef0d1c83cfdba62a110cd4.record.md
 create mode 100644 docs/branch-review-records/eee79235c4e2d7ed08fd81dccf399317a3b8c870210d155da52c563fca1d97d9.record.md
 create mode 100644 docs/branch-review-records/f0bc08ea7f5c5c924273de2608597dddb1e7c8c43197488836bb70a79c6d366b.record.md
 create mode 100644 docs/branch-review-records/f11604766bd32807910a04f2bc52664b0d8615e08db6094e54733085c7427d0c.record.md
 create mode 100644 docs/branch-review-records/f1fda63bd3854860481ab01a098aff859e2c8d4ea54160fe52e351afd389f9de.record.md
 create mode 100644 docs/branch-review-records/f238bb27fa4754ee4948d68b3019e4fb8d9da4ee00a7b78131ef1396fca2dfc8.record.md
 create mode 100644 docs/branch-review-records/f2f43e75cc44bf4d80d3e6bddb9f6844548e9f4d84b79b828a42a53505e3ff5c.record.md
 create mode 100644 docs/branch-review-records/f4aa3dfaabe1e3f82d0b8e20729b1c40648e1632d2645016ce189113e6f4a1b3.record.md
 create mode 100644 docs/branch-review-records/f502c5ed1c220bc23384ffbdff722ab7753e5c619599c803531d4bc36c6914ce.record.md
 create mode 100644 docs/branch-review-records/f51d7e3693e266ab35c224b3c487b3173a90a7780810546df0674fb7b35b7d50.record.md
 create mode 100644 docs/branch-review-records/f726c2e6e71b61720a0609b9fdfd96aac4292d00fcdac8e3629b2e8e1f3f4845.record.md
 create mode 100644 docs/branch-review-records/f8f65adef944919407355aee8f60e939e4cc4398091af68728179d8b5b63e2e0.record.md
 create mode 100644 docs/branch-review-records/fb53209f910afc80ba5fb207e1a2f36d30bc14b98d5c069c3e7fa8b7f89edee4.record.md
 create mode 100644 docs/branch-review-records/fe8542d735a4d0a26e76906a700a861925da55131c0caacbaab18ac81507cd0d.record.md
 create mode 100644 docs/branch-review-records/fec8d16693dafc5f5c400815e091e8d8565e99f53e2979f061dd3cc68c012315.record.md
 create mode 100644 docs/ledger-id-scheme-proposal.md
 create mode 100644 docs/medication-lexicon-review-worklist.md
 create mode 100644 docs/no-unchecked-indexed-access-migration-plan.md
 create mode 100644 docs/outstanding-issues-inbox/1d35d652-d833-4934-890c-84b6837581cd.json
 create mode 100644 docs/outstanding-issues-inbox/314e5e31-7d15-46f2-adb0-c4d113bc589d.json
 create mode 100644 docs/outstanding-issues-inbox/46750cbf-f4f4-4a00-ab93-bdac644afbde.json
 create mode 100644 docs/outstanding-issues-inbox/55cb57e8-7e6e-42f8-bd79-81b81a01ef3a.json
 create mode 100644 docs/outstanding-issues-inbox/55f0d5de-8642-487a-b063-44c1c0bc0921.json
 create mode 100644 docs/outstanding-issues-inbox/739887b7-24d6-4ea8-9aad-e7700a537913.json
 create mode 100644 docs/outstanding-issues-inbox/7ad31d10-aeef-4635-863d-d6ce9340d916.json
 create mode 100644 docs/outstanding-issues-inbox/7e454b66-74ae-4e67-8669-1f1fdc2c018c.json
 create mode 100644 docs/outstanding-issues-inbox/81fdf812-4dd6-4fd6-b2e8-f3b730affd8a.json
 create mode 100644 docs/outstanding-issues-inbox/a81b68eb-6b26-46db-81fa-90279a599886.json
 rename docs/outstanding-issues-inbox/{ => applied}/00428ff0-1b45-4066-9838-94216fa8b6eb.json (100%)
 rename docs/outstanding-issues-inbox/{ => applied}/01580a63-502e-4ee9-bdf2-a5bf492f7dee.json (100%)
 rename docs/outstanding-issues-inbox/{ => applied}/04a0b8d6-8af9-4779-8af8-8e3b6e9a3b2b.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/0948fcd2-2e51-47bc-8990-7ec002934e43.json
 create mode 100644 docs/outstanding-issues-inbox/applied/0a052268-97e1-4d4a-9ad7-033003aa486c.json
 create mode 100644 docs/outstanding-issues-inbox/applied/0b6a19d6-c586-4ea3-8fc6-fa8ee941d922.json
 create mode 100644 docs/outstanding-issues-inbox/applied/0bbea6d5-4d5e-4e9a-bcba-bc129beeba3f.json
 create mode 100644 docs/outstanding-issues-inbox/applied/0e5573e3-425d-4253-9b28-0c1c81a4f3fe.json
 rename docs/outstanding-issues-inbox/{ => applied}/11e56221-8d46-4c9a-a89c-78621f18e754.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/1376cc64-a753-41a0-9c54-30a5cca7f896.json
 rename docs/outstanding-issues-inbox/{ => applied}/17e1baf4-7d8f-4494-acd6-a845ade305ca.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/1860498b-2e89-41cf-85f1-e62dc3cca057.json
 create mode 100644 docs/outstanding-issues-inbox/applied/19762e55-fa25-41de-a5a2-7f4932a545fe.json
 create mode 100644 docs/outstanding-issues-inbox/applied/19fb70c0-1fd4-43a8-a4f4-efa9c31d16b1.json
 rename docs/outstanding-issues-inbox/{ => applied}/1b483041-4f2e-4ccf-872e-f7657785cfb3.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/1da43f2b-4b52-4fb7-b39a-e5aa5bf7c7e7.json
 rename docs/outstanding-issues-inbox/{ => applied}/1e598935-a21b-4aa5-9bd2-c667ce16ebbd.json (100%)
 rename docs/outstanding-issues-inbox/{ => applied}/2194da1d-c445-47db-8b97-09774056ab42.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/21b6525a-dd2d-4dcc-95d5-c3c777420adf.json
 create mode 100644 docs/outstanding-issues-inbox/applied/24408f86-38ff-4715-affa-55d6c7bc1bb7.json
 create mode 100644 docs/outstanding-issues-inbox/applied/256e9f44-2c1d-4068-a3e6-74baf3de271d.json
 rename docs/outstanding-issues-inbox/{ => applied}/25f6b53a-86e2-42e9-9b38-1c2daae28892.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/2b7856a5-fe32-49b8-9e3c-819d961784c6.json
 create mode 100644 docs/outstanding-issues-inbox/applied/3156e1c9-82aa-46c3-84e6-0e119015acc6.json
 rename docs/outstanding-issues-inbox/{ => applied}/33d68dca-16b7-4325-8c50-f046c2f71316.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/38c6095f-41f5-4925-b1ea-f5af5187885d.json
 create mode 100644 docs/outstanding-issues-inbox/applied/397a3588-b8cf-404b-a3d4-6060b84f7d60.json
 rename docs/outstanding-issues-inbox/{ => applied}/39b08439-bd16-4b6d-b218-f04ad0a9a8cd.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/3d0adf39-ec7a-4fa3-9309-057a193410de.json
 create mode 100644 docs/outstanding-issues-inbox/applied/3d861de3-4402-4e40-8dec-8a84e10093c2.json
 create mode 100644 docs/outstanding-issues-inbox/applied/3dda04ff-1ae9-4153-80ed-ad081931e396.json
 create mode 100644 docs/outstanding-issues-inbox/applied/3f8797e0-dffa-4d26-8019-15147b9af397.json
 rename docs/outstanding-issues-inbox/{ => applied}/413a0aec-0239-45b2-8880-d3ace65cfdaf.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/42dd600a-b032-45a5-8c53-cb185f08cf13.json
 rename docs/outstanding-issues-inbox/{ => applied}/4b6930e6-fae2-4b4f-9f90-49bf0bcd548c.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/4b85e2d3-963d-46fe-a9c3-b234b4de14b0.json
 create mode 100644 docs/outstanding-issues-inbox/applied/4bc449a1-ec81-426d-aadd-8a78abec21cf.json
 create mode 100644 docs/outstanding-issues-inbox/applied/568597bd-fc9f-47d6-b582-443812115e67.json
 create mode 100644 docs/outstanding-issues-inbox/applied/5cf082dd-60c3-42ef-95dc-82b9c255e9be.json
 create mode 100644 docs/outstanding-issues-inbox/applied/5cf244c3-1b68-4214-8097-767b11a49e13.json
 create mode 100644 docs/outstanding-issues-inbox/applied/5db479fa-07fc-4e9e-a377-93b4e27797ee.json
 create mode 100644 docs/outstanding-issues-inbox/applied/606b1573-6217-457a-9183-7f8e550d3094.json
 create mode 100644 docs/outstanding-issues-inbox/applied/60fea622-a448-4e8f-a5d3-0122ab08b2d0.json
 rename docs/outstanding-issues-inbox/{ => applied}/63419f06-c12a-4a84-a684-6e177f527365.json (100%)
 rename docs/outstanding-issues-inbox/{ => applied}/69b9cd4a-9c2a-4e37-a146-48c7e540b87e.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/6b09c1df-5f7c-4103-af3c-aead33eafb00.json
 create mode 100644 docs/outstanding-issues-inbox/applied/6e354901-7694-40e0-b03d-8c398cec7b05.json
 create mode 100644 docs/outstanding-issues-inbox/applied/71d61764-9d93-43bd-a3d3-230f5ad78418.json
 rename docs/outstanding-issues-inbox/{ => applied}/7268da45-5b77-4583-a3cb-27e5ec7067b1.json (100%)
 rename docs/outstanding-issues-inbox/{ => applied}/74edc91b-042b-4e73-911c-286d0b38da45.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/7f5e6922-8d0b-424a-b359-12bed3a4e315.json
 create mode 100644 docs/outstanding-issues-inbox/applied/81845ded-27a8-43d8-9a56-d85a5515935b.json
 create mode 100644 docs/outstanding-issues-inbox/applied/83ec71cf-db94-4110-ada8-ec7e730e5154.json
 create mode 100644 docs/outstanding-issues-inbox/applied/8c133c4e-23e7-427f-b1b8-6d6a64dfd381.json
 create mode 100644 docs/outstanding-issues-inbox/applied/9792c896-78d8-46ab-b194-6a52b7fd7cab.json
 create mode 100644 docs/outstanding-issues-inbox/applied/97e7beeb-97e5-43a6-b238-065b42070969.json
 create mode 100644 docs/outstanding-issues-inbox/applied/9b67dd0e-f11e-423e-be63-7e4d91f4dd82.json
 create mode 100644 docs/outstanding-issues-inbox/applied/a780ce8a-a373-4c95-974f-0692af775ff6.json
 rename docs/outstanding-issues-inbox/{ => applied}/a860ce7a-5ecf-4f30-a3b9-5c22d1d914b9.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/b53c5e20-2c6f-41da-a202-bcf5c7609938.json
 rename docs/outstanding-issues-inbox/{ => applied}/b5f28517-89c9-455d-a4b4-202608141940.json (100%)
 rename docs/outstanding-issues-inbox/{ => applied}/b7a5bee9-bddc-4a7a-9614-a49301c00cc8.json (100%)
 rename docs/outstanding-issues-inbox/{ => applied}/b7c0f9f6-c95d-413f-9bdd-6b6ad9cbcb91.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/b935dad0-394c-435a-acc5-21df750c7e52.json
 create mode 100644 docs/outstanding-issues-inbox/applied/bbf21714-0ef9-4c2f-942f-1b8d7e328ac8.json
 create mode 100644 docs/outstanding-issues-inbox/applied/bcea44bc-5738-41b8-96f1-e96b1488ab29.json
 create mode 100644 docs/outstanding-issues-inbox/applied/bd11cfe9-1627-425f-a8f7-e0e202b980a4.json
 create mode 100644 docs/outstanding-issues-inbox/applied/c3622ee1-872f-4476-8b12-20e97057c5d5.json
 create mode 100644 docs/outstanding-issues-inbox/applied/c3d91fce-52e5-41ed-8648-b2bf5e95b32c.json
 create mode 100644 docs/outstanding-issues-inbox/applied/c5e84848-9a84-442e-a818-1b53df5693fa.json
 create mode 100644 docs/outstanding-issues-inbox/applied/c63161f6-21b8-40ec-927c-684e22791066.json
 rename docs/outstanding-issues-inbox/{ => applied}/ce304701-1e01-4cfb-bf9c-202608141940.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/d194f4ec-568c-4689-a411-22447c59fb53.json
 create mode 100644 docs/outstanding-issues-inbox/applied/d226dce3-76a2-4ccc-9723-5e7ca03a6c5d.json
 create mode 100644 docs/outstanding-issues-inbox/applied/d229e6b5-a31a-44a9-8a7b-536e7f8ccf50.json
 create mode 100644 docs/outstanding-issues-inbox/applied/d2e60a94-b12a-4502-a8b9-3dc8406cc8c8.json
 rename docs/outstanding-issues-inbox/{ => applied}/d3b2fe49-3282-4756-9135-7c555dede447.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/d52dbc3d-6759-4f6e-9089-24059830ed5a.json
 create mode 100644 docs/outstanding-issues-inbox/applied/d656dcb5-3228-4ab8-b40c-b0377e63cb94.json
 rename docs/outstanding-issues-inbox/{ => applied}/d9a7e3fc-06e9-45ca-ab2a-202608141940.json (100%)
 rename docs/outstanding-issues-inbox/{ => applied}/dcb09280-0436-4651-a707-b0007e872d7b.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/ddef5391-d476-417f-b0c8-662e44c54f8b.json
 rename docs/outstanding-issues-inbox/{ => applied}/ded27e2f-5c71-43b8-99dc-ffffa6294ba3.json (100%)
 rename docs/outstanding-issues-inbox/{ => applied}/e4a11465-348c-49e5-8a0a-202608141941.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/e684a311-2a0d-4c21-ba18-13afde3b62f8.json
 create mode 100644 docs/outstanding-issues-inbox/applied/ec6d0c23-2f19-4159-9c73-49bdc103b61e.json
 create mode 100644 docs/outstanding-issues-inbox/applied/ef62d13b-6852-4a12-a1d3-4d7e22ec1232.json
 create mode 100644 docs/outstanding-issues-inbox/applied/f3b63187-c295-4f6a-8ecd-602f348835c4.json
 rename docs/outstanding-issues-inbox/{ => applied}/f825f6b9-94ec-4af1-929c-202608141941.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/f86a3002-5019-4ae4-93fb-d01a05a7bae6.json
 rename docs/outstanding-issues-inbox/{ => applied}/f9f40594-a816-45a8-954a-3fcecf6d5d05.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/fbfe982f-cd2f-49c9-a94e-908a99efa6b8.json
 rename docs/outstanding-issues-inbox/{ => applied}/fc23f1ec-c597-4690-b256-2263ecf73c86.json (100%)
 create mode 100644 docs/outstanding-issues-inbox/applied/fd42e1f9-4012-4296-b7c2-102c7d199738.json
 create mode 100644 docs/outstanding-issues-inbox/applied/fd548180-f031-44d8-bd70-24c3b03c5f21.json
 create mode 100644 docs/outstanding-issues-inbox/e54f04f8-09bb-4887-b3e4-a5cd99958798.json
 create mode 100644 docs/plans/edge-ingestion-overhaul-3pr-plan.md
 create mode 100644 docs/pr-handoff-stop-cross-agent-gap.md
 create mode 100644 scripts/audit-merge-loss.mjs
 create mode 100644 scripts/issue-id.mjs
 create mode 100644 src/app/mockups/accessible-table-browser-fixture/page.tsx
 create mode 100644 src/components/calculators/calculator-filters.ts
 create mode 100644 src/components/calculators/home-page.tsx
 create mode 100644 src/components/clinical-dashboard/answer-evidence-preview.tsx
 create mode 100644 src/components/clinical-dashboard/answer-request.ts
 delete mode 100644 src/components/clinical-dashboard/favourites-library-nav.tsx
 delete mode 100644 src/components/services/service-group-nav.tsx
 create mode 100644 src/lib/rag/rag-row-contracts.ts
 create mode 100644 tests/answer-evidence-preview.dom.test.tsx
 create mode 100644 tests/answer-request.test.ts
 create mode 100644 tests/api-list-response.test.ts
 create mode 100644 tests/calculators-mode.dom.test.tsx
 create mode 100644 tests/helpers/source-contract.ts
 create mode 100644 tests/ledger-inbox-cancellation.test.ts
 create mode 100644 tests/ledger-write-discipline.test.ts
 create mode 100644 tests/live-drift-workflow.test.ts
 create mode 100644 tests/merge-loss-audit.test.ts
 create mode 100644 tests/mobile-sheet-safe-area-contract.test.ts
 create mode 100644 tests/rag-retrieval-row-contract.test.ts
 create mode 100644 tests/registry-service-facets.test.ts
 create mode 100644 tests/services-bookmark-readiness.dom.test.tsx
 create mode 100644 tests/source-contract-helper.test.ts
 create mode 100644 tests/ui-tools-show-all.spec.ts

diff --git a/.claude/hooks/issues-surface.sh b/.claude/hooks/issues-surface.sh
index 933b801ce6..5206c40ec9 100755
--- a/.claude/hooks/issues-surface.sh
+++ b/.claude/hooks/issues-surface.sh
@@ -32,10 +32,11 @@ source_val="$(printf '%s' "$payload" \
 rows="$(awk '
   /^## Open items/       { inopen=1; next }
   /^## /                 { if (inopen) inopen=0 }
-  inopen && /^\| #[0-9]/  {
+  inopen && /^\| #[0-9A-HJKMNP-TV-Z]/  {
     n=split($0, c, "|")
     id=c[2]; pri=c[3]; typ=c[4]; sum=c[5]
     gsub(/^[ \t]+|[ \t]+$/, "", id)
+    sub(/[ \t]+<!--[ \t]*issue-ulid:[^>]+-->[ \t]*$/, "", id)
     gsub(/^[ \t]+|[ \t]+$/, "", pri)
     gsub(/^[ \t]+|[ \t]+$/, "", typ)
     gsub(/^[ \t]+|[ \t]+$/, "", sum)
@@ -63,10 +64,11 @@ queue_rows="$(awk '
   NR==FNR {
     if ($0 ~ /^## Open items/)                  { inopen=1; next }
     if ($0 ~ /^## /)                            { inopen=0 }
-    if (inopen && $0 ~ /^\| #[0-9]/) {
+    if (inopen && $0 ~ /^\| #[0-9A-HJKMNP-TV-Z]/) {
       split($0, oc, "|")
       oid=oc[2]; odetail=oc[6]
       gsub(/^[ \t]+|[ \t]+$/, "", oid)
+      sub(/[ \t]+<!--[ \t]*issue-ulid:[^>]+-->[ \t]*$/, "", oid)
       gsub(/^[ \t]+|[ \t]+$/, "", odetail)
       detail[oid]=odetail
     }
@@ -114,7 +116,7 @@ fi
 
 # Keep the priority summary complementary to the queue instead of repeating
 # the same recommended IDs in both sections.
-queued_ids=" $(printf '%s\n' "$queue_rows" | grep -oE '#[0-9]+' | tr '\n' ' ' || true)"
+queued_ids=" $(printf '%s\n' "$queue_rows" | grep -oE '#([0-9A-HJKMNP-TV-Z]{6,16}|[0-9]{3,})' | tr '\n' ' ' || true)"
 unqueued_rows="$(printf '%s\n' "$rows" | awk -F'\t' -v queued="$queued_ids" '
   index(queued, " " $2 " ") == 0
 ' || true)"
diff --git a/.claude/skills/handoff/SKILL.md b/.claude/skills/handoff/SKILL.md
index a78c5adddc..120f408d39 100644
--- a/.claude/skills/handoff/SKILL.md
+++ b/.claude/skills/handoff/SKILL.md
@@ -63,6 +63,14 @@ force-push, or discard work.
    `head`, or another command that can mask its status. Confirm the remote tip equals local HEAD
    with `git ls-remote` before reporting success. The pre-push guards run
    (auto-merge sentinel, format, drift) — heed a block rather than overriding blindly.
+
+   **Restarting a branch whose PR already merged:** GitHub deletes the remote branch on merge,
+   so the local `origin/<branch>` ref is stale and `--force-with-lease` fails with `stale info`
+   before it ever reaches the remote. That is not a lease violation to override — run
+   `git remote prune origin` and push normally. There is nothing to force: the branch no longer
+   exists remotely, so the push creates it fresh. Observed 2026-08-14 restarting this branch
+   after PR #1944 merged.
+
 6. **Open a PR** with `gh pr create --base main`, body ending with the Claude Code
    attribution line. Write the body from `.github/pull_request_template.md` in full normal
    prose — exact `## Summary` / `## Verification` / `## Risk and rollout` / (when clinical-risk
diff --git a/.claude/skills/issues/SKILL.md b/.claude/skills/issues/SKILL.md
index 9abfecc8d8..87d9e98847 100644
--- a/.claude/skills/issues/SKILL.md
+++ b/.claude/skills/issues/SKILL.md
@@ -118,6 +118,12 @@ report that the Markdown source is current and the visual artifact is stale. Sti
 reconciliation handoff — a stale visual artifact must not invalidate a successful canonical
 transaction.
 
+**This step is unavailable off the operator's Windows machine.** The script and the artifact are
+both absolute Windows paths, so a Linux, container, or cloud session cannot run it and cannot
+verify it — the artifact drifts silently from the moment such a session reconciles. Do not
+improvise a substitute renderer or write the HTML by hand; report the register as stale, name the
+reconciliation commit that made it so, and leave the refresh to the operator.
+
 ## Persist the memory (commit)
 
 When the user explicitly asks for a commit, commit only the newly created request file(s), never
diff --git a/.claude/skills/newtask/SKILL.md b/.claude/skills/newtask/SKILL.md
index 45ae42b99c..4990c3d836 100644
--- a/.claude/skills/newtask/SKILL.md
+++ b/.claude/skills/newtask/SKILL.md
@@ -33,6 +33,14 @@ than opening a second branch. This is one GitHub read (`mcp__github__list_pull_r
 boundary. If GitHub is unreachable, treat it as a warning and continue — an offline session
 must still be able to start work. Recorded as `#292`.
 
+**If the PR-handoff stop hook has already armed in this session, that read is denied** — a
+session that opened its own PR and then picks up another queued item cannot call
+`list_pull_requests` or `gh pr list` at all (see `docs/pr-handoff-stop-cross-agent-gap.md`).
+Do not unlock the hook for this; fall back to `git ls-remote --heads origin`, which needs no
+provider tool and still answers the question, because a session building the same surface
+almost always has a pushed branch named after it. Report which check you used. Observed
+2026-08-14 on PR #1956.
+
 ## Steps
 
 1. **Sync main.** `git fetch --quiet origin main`.
diff --git a/.design-sync/config.json b/.design-sync/config.json
index dac2e77d79..46df2b8d8a 100644
--- a/.design-sync/config.json
+++ b/.design-sync/config.json
@@ -59,7 +59,7 @@
     "SearchField": "about?: string; accept?: string; accessKey?: string; alt?: string; \"aria-activedescendant\"?: string; \"aria-atomic\"?: (boolean | \"true\" | \"false\"); \"aria-autocomplete\"?: \"none\" | \"list\" | \"inline\" | \"both\"; \"aria-braillelabel\"?: string; \"aria-brailleroledescription\"?: string; \"aria-busy\"?: (boolean | \"true\" | \"false\"); \"aria-checked\"?: boolean | \"true\" | \"false\" | \"mixed\"; \"aria-colcount\"?: number; \"aria-colindex\"?: number; \"aria-colindextext\"?: string; \"aria-colspan\"?: number; \"aria-controls\"?: string; \"aria-current\"?: boolean | \"true\" | \"false\" | \"page\" | \"step\" | \"location\" | \"date\" | \"time\"; \"aria-describedby\"?: string; \"aria-description\"?: string; \"aria-details\"?: string; \"aria-disabled\"?: (boolean | \"true\" | \"false\"); \"aria-dropeffect\"?: \"none\" | \"link\" | \"copy\" | \"execute\" | \"move\" | \"popup\"; \"aria-errormessage\"?: string; \"aria-expanded\"?: (boolean | \"true\" | \"false\"); \"aria-flowto\"?: string; \"aria-grabbed\"?: (boolean | \"true\" | \"false\"); \"aria-haspopup\"?: boolean | \"true\" | \"false\" | \"dialog\" | \"grid\" | \"listbox\" | \"menu\" | \"tree\"; \"aria-hidden\"?: (boolean | \"true\" | \"false\"); \"aria-invalid\"?: boolean | \"true\" | \"false\" | \"grammar\" | \"spelling\"; \"aria-keyshortcuts\"?: string; \"aria-label\"?: string; \"aria-labelledby\"?: string; \"aria-level\"?: number; \"aria-live\"?: \"off\" | \"assertive\" | \"polite\"; \"aria-modal\"?: (boolean | \"true\" | \"false\"); \"aria-multiline\"?: (boolean | \"true\" | \"false\"); \"aria-multiselectable\"?: (boolean | \"true\" | \"false\"); \"aria-orientation\"?: \"horizontal\" | \"vertical\"; \"aria-owns\"?: string; \"aria-placeholder\"?: string; \"aria-posinset\"?: number; \"aria-pressed\"?: boolean | \"true\" | \"false\" | \"mixed\"; \"aria-readonly\"?: (boolean | \"true\" | \"false\"); \"aria-relevant\"?: \"text\" | \"additions\" | \"additions removals\" | \"additions text\" | \"all\" | \"removals\" | \"removals additions\" | \"removals text\" | \"text additions\" | \"text removals\"; \"aria-required\"?: (boolean | \"true\" | \"false\"); \"aria-roledescription\"?: string; \"aria-rowcount\"?: number; \"aria-rowindex\"?: number; \"aria-rowindextext\"?: string; \"aria-rowspan\"?: number; \"aria-selected\"?: (boolean | \"true\" | \"false\"); \"aria-setsize\"?: number; \"aria-sort\"?: \"none\" | \"ascending\" | \"descending\" | \"other\"; \"aria-valuemax\"?: number; \"aria-valuemin\"?: number; \"aria-valuenow\"?: number; \"aria-valuetext\"?: string; autoCapitalize?: \"off\" | \"none\" | \"on\" | \"sentences\" | \"words\" | \"characters\" | (string & {}); autoComplete?: import(\"react\").HTMLInputAutoCompleteAttribute; autoCorrect?: string; autoFocus?: boolean; autoSave?: string; capture?: boolean | \"user\" | \"environment\"; checked?: boolean; children?: import(\"react\").ReactNode; className?: string; clearLabel?: string; color?: string; content?: string; contentEditable?: (boolean | \"true\" | \"false\") | \"inherit\" | \"plaintext-only\"; contextMenu?: string; dangerouslySetInnerHTML?: { __html: string | TrustedHTML; }; datatype?: string; defaultChecked?: boolean; defaultValue?: string | number | readonly string[]; dir?: string; disabled?: boolean; draggable?: (boolean | \"true\" | \"false\"); enterKeyHint?: \"enter\" | \"done\" | \"go\" | \"next\" | \"previous\" | \"search\" | \"send\"; error?: string; exportparts?: string; fieldClassName?: string; form?: string; formAction?: string | ((formData: FormData) => void | Promise<void>); formEncType?: string; formMethod?: string; formNoValidate?: boolean; formTarget?: string; height?: string | number; hidden?: boolean; hideLabel?: boolean; hint?: string; id?: string; inert?: boolean; inlist?: any; inputMode?: \"none\" | \"search\" | \"text\" | \"tel\" | \"url\" | \"email\" | \"numeric\" | \"decimal\"; is?: string; itemID?: string; itemProp?: string; itemRef?: string; itemScope?: boolean; itemType?: string; label: string; lang?: string; list?: string; max?: string | number; maxLength?: number; min?: string | number; minLength?: number; multiple?: boolean; name?: string; nonce?: string; onAbort?: import(\"react\").ReactEventHandler<HTMLInputElement>; onAbortCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onAnimationEnd?: import(\"react\").AnimationEventHandler<HTMLInputElement>; onAnimationEndCapture?: import(\"react\").AnimationEventHandler<HTMLInputElement>; onAnimationIteration?: import(\"react\").AnimationEventHandler<HTMLInputElement>; onAnimationIterationCapture?: import(\"react\").AnimationEventHandler<HTMLInputElement>; onAnimationStart?: import(\"react\").AnimationEventHandler<HTMLInputElement>; onAnimationStartCapture?: import(\"react\").AnimationEventHandler<HTMLInputElement>; onAuxClick?: import(\"react\").MouseEventHandler<HTMLInputElement>; onAuxClickCapture?: import(\"react\").MouseEventHandler<HTMLInputElement>; onBeforeInput?: import(\"react\").InputEventHandler<HTMLInputElement>; onBeforeInputCapture?: import(\"react\").InputEventHandler<HTMLInputElement>; onBeforeToggle?: import(\"react\").ToggleEventHandler<HTMLInputElement>; onBlur?: import(\"react\").FocusEventHandler<HTMLInputElement>; onBlurCapture?: import(\"react\").FocusEventHandler<HTMLInputElement>; onCanPlay?: import(\"react\").ReactEventHandler<HTMLInputElement>; onCanPlayCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onCanPlayThrough?: import(\"react\").ReactEventHandler<HTMLInputElement>; onCanPlayThroughCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onChange?: import(\"react\").ChangeEventHandler<HTMLInputElement, HTMLInputElement>; onChangeCapture?: import(\"react\").ChangeEventHandler<HTMLInputElement, Element>; onClear?: (() => void); onClick?: import(\"react\").MouseEventHandler<HTMLInputElement>; onClickCapture?: import(\"react\").MouseEventHandler<HTMLInputElement>; onCompositionEnd?: import(\"react\").CompositionEventHandler<HTMLInputElement>; onCompositionEndCapture?: import(\"react\").CompositionEventHandler<HTMLInputElement>; onCompositionStart?: import(\"react\").CompositionEventHandler<HTMLInputElement>; onCompositionStartCapture?: import(\"react\").CompositionEventHandler<HTMLInputElement>; onCompositionUpdate?: import(\"react\").CompositionEventHandler<HTMLInputElement>; onCompositionUpdateCapture?: import(\"react\").CompositionEventHandler<HTMLInputElement>; onContextMenu?: import(\"react\").MouseEventHandler<HTMLInputElement>; onContextMenuCapture?: import(\"react\").MouseEventHandler<HTMLInputElement>; onCopy?: import(\"react\").ClipboardEventHandler<HTMLInputElement>; onCopyCapture?: import(\"react\").ClipboardEventHandler<HTMLInputElement>; onCut?: import(\"react\").ClipboardEventHandler<HTMLInputElement>; onCutCapture?: import(\"react\").ClipboardEventHandler<HTMLInputElement>; onDoubleClick?: import(\"react\").MouseEventHandler<HTMLInputElement>; onDoubleClickCapture?: import(\"react\").MouseEventHandler<HTMLInputElement>; onDrag?: import(\"react\").DragEventHandler<HTMLInputElement>; onDragCapture?: import(\"react\").DragEventHandler<HTMLInputElement>; onDragEnd?: import(\"react\").DragEventHandler<HTMLInputElement>; onDragEndCapture?: import(\"react\").DragEventHandler<HTMLInputElement>; onDragEnter?: import(\"react\").DragEventHandler<HTMLInputElement>; onDragEnterCapture?: import(\"react\").DragEventHandler<HTMLInputElement>; onDragExit?: import(\"react\").DragEventHandler<HTMLInputElement>; onDragExitCapture?: import(\"react\").DragEventHandler<HTMLInputElement>; onDragLeave?: import(\"react\").DragEventHandler<HTMLInputElement>; onDragLeaveCapture?: import(\"react\").DragEventHandler<HTMLInputElement>; onDragOver?: import(\"react\").DragEventHandler<HTMLInputElement>; onDragOverCapture?: import(\"react\").DragEventHandler<HTMLInputElement>; onDragStart?: import(\"react\").DragEventHandler<HTMLInputElement>; onDragStartCapture?: import(\"react\").DragEventHandler<HTMLInputElement>; onDrop?: import(\"react\").DragEventHandler<HTMLInputElement>; onDropCapture?: import(\"react\").DragEventHandler<HTMLInputElement>; onDurationChange?: import(\"react\").ReactEventHandler<HTMLInputElement>; onDurationChangeCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onEmptied?: import(\"react\").ReactEventHandler<HTMLInputElement>; onEmptiedCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onEncrypted?: import(\"react\").ReactEventHandler<HTMLInputElement>; onEncryptedCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onEnded?: import(\"react\").ReactEventHandler<HTMLInputElement>; onEndedCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onError?: import(\"react\").ReactEventHandler<HTMLInputElement>; onErrorCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onFocus?: import(\"react\").FocusEventHandler<HTMLInputElement>; onFocusCapture?: import(\"react\").FocusEventHandler<HTMLInputElement>; onGotPointerCapture?: import(\"react\").PointerEventHandler<HTMLInputElement>; onGotPointerCaptureCapture?: import(\"react\").PointerEventHandler<HTMLInputElement>; onInput?: import(\"react\").InputEventHandler<HTMLInputElement>; onInputCapture?: import(\"react\").InputEventHandler<HTMLInputElement>; onInvalid?: import(\"react\").ReactEventHandler<HTMLInputElement>; onInvalidCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onKeyDown?: import(\"react\").KeyboardEventHandler<HTMLInputElement>; onKeyDownCapture?: import(\"react\").KeyboardEventHandler<HTMLInputElement>; onKeyPress?: import(\"react\").KeyboardEventHandler<HTMLInputElement>; onKeyPressCapture?: import(\"react\").KeyboardEventHandler<HTMLInputElement>; onKeyUp?: import(\"react\").KeyboardEventHandler<HTMLInputElement>; onKeyUpCapture?: import(\"react\").KeyboardEventHandler<HTMLInputElement>; onLoad?: import(\"react\").ReactEventHandler<HTMLInputElement>; onLoadCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onLoadedData?: import(\"react\").ReactEventHandler<HTMLInputElement>; onLoadedDataCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onLoadedMetadata?: import(\"react\").ReactEventHandler<HTMLInputElement>; onLoadedMetadataCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onLoadStart?: import(\"react\").ReactEventHandler<HTMLInputElement>; onLoadStartCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onLostPointerCapture?: import(\"react\").PointerEventHandler<HTMLInputElement>; onLostPointerCaptureCapture?: import(\"react\").PointerEventHandler<HTMLInputElement>; onMouseDown?: import(\"react\").MouseEventHandler<HTMLInputElement>; onMouseDownCapture?: import(\"react\").MouseEventHandler<HTMLInputElement>; onMouseEnter?: import(\"react\").MouseEventHandler<HTMLInputElement>; onMouseLeave?: import(\"react\").MouseEventHandler<HTMLInputElement>; onMouseMove?: import(\"react\").MouseEventHandler<HTMLInputElement>; onMouseMoveCapture?: import(\"react\").MouseEventHandler<HTMLInputElement>; onMouseOut?: import(\"react\").MouseEventHandler<HTMLInputElement>; onMouseOutCapture?: import(\"react\").MouseEventHandler<HTMLInputElement>; onMouseOver?: import(\"react\").MouseEventHandler<HTMLInputElement>; onMouseOverCapture?: import(\"react\").MouseEventHandler<HTMLInputElement>; onMouseUp?: import(\"react\").MouseEventHandler<HTMLInputElement>; onMouseUpCapture?: import(\"react\").MouseEventHandler<HTMLInputElement>; onPaste?: import(\"react\").ClipboardEventHandler<HTMLInputElement>; onPasteCapture?: import(\"react\").ClipboardEventHandler<HTMLInputElement>; onPause?: import(\"react\").ReactEventHandler<HTMLInputElement>; onPauseCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onPlay?: import(\"react\").ReactEventHandler<HTMLInputElement>; onPlayCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onPlaying?: import(\"react\").ReactEventHandler<HTMLInputElement>; onPlayingCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onPointerCancel?: import(\"react\").PointerEventHandler<HTMLInputElement>; onPointerCancelCapture?: import(\"react\").PointerEventHandler<HTMLInputElement>; onPointerDown?: import(\"react\").PointerEventHandler<HTMLInputElement>; onPointerDownCapture?: import(\"react\").PointerEventHandler<HTMLInputElement>; onPointerEnter?: import(\"react\").PointerEventHandler<HTMLInputElement>; onPointerLeave?: import(\"react\").PointerEventHandler<HTMLInputElement>; onPointerMove?: import(\"react\").PointerEventHandler<HTMLInputElement>; onPointerMoveCapture?: import(\"react\").PointerEventHandler<HTMLInputElement>; onPointerOut?: import(\"react\").PointerEventHandler<HTMLInputElement>; onPointerOutCapture?: import(\"react\").PointerEventHandler<HTMLInputElement>; onPointerOver?: import(\"react\").PointerEventHandler<HTMLInputElement>; onPointerOverCapture?: import(\"react\").PointerEventHandler<HTMLInputElement>; onPointerUp?: import(\"react\").PointerEventHandler<HTMLInputElement>; onPointerUpCapture?: import(\"react\").PointerEventHandler<HTMLInputElement>; onProgress?: import(\"react\").ReactEventHandler<HTMLInputElement>; onProgressCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onRateChange?: import(\"react\").ReactEventHandler<HTMLInputElement>; onRateChangeCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onReset?: import(\"react\").ReactEventHandler<HTMLInputElement>; onResetCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onScroll?: import(\"react\").UIEventHandler<HTMLInputElement>; onScrollCapture?: import(\"react\").UIEventHandler<HTMLInputElement>; onScrollEnd?: import(\"react\").UIEventHandler<HTMLInputElement>; onScrollEndCapture?: import(\"react\").UIEventHandler<HTMLInputElement>; onSeeked?: import(\"react\").ReactEventHandler<HTMLInputElement>; onSeekedCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onSeeking?: import(\"react\").ReactEventHandler<HTMLInputElement>; onSeekingCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onSelect?: import(\"react\").ReactEventHandler<HTMLInputElement>; onSelectCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onStalled?: import(\"react\").ReactEventHandler<HTMLInputElement>; onStalledCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onSubmit?: import(\"react\").SubmitEventHandler<HTMLInputElement>; onSubmitCapture?: import(\"react\").SubmitEventHandler<HTMLInputElement>; onSuspend?: import(\"react\").ReactEventHandler<HTMLInputElement>; onSuspendCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onTimeUpdate?: import(\"react\").ReactEventHandler<HTMLInputElement>; onTimeUpdateCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onToggle?: import(\"react\").ToggleEventHandler<HTMLInputElement>; onTouchCancel?: import(\"react\").TouchEventHandler<HTMLInputElement>; onTouchCancelCapture?: import(\"react\").TouchEventHandler<HTMLInputElement>; onTouchEnd?: import(\"react\").TouchEventHandler<HTMLInputElement>; onTouchEndCapture?: import(\"react\").TouchEventHandler<HTMLInputElement>; onTouchMove?: import(\"react\").TouchEventHandler<HTMLInputElement>; onTouchMoveCapture?: import(\"react\").TouchEventHandler<HTMLInputElement>; onTouchStart?: import(\"react\").TouchEventHandler<HTMLInputElement>; onTouchStartCapture?: import(\"react\").TouchEventHandler<HTMLInputElement>; onTransitionCancel?: import(\"react\").TransitionEventHandler<HTMLInputElement>; onTransitionCancelCapture?: import(\"react\").TransitionEventHandler<HTMLInputElement>; onTransitionEnd?: import(\"react\").TransitionEventHandler<HTMLInputElement>; onTransitionEndCapture?: import(\"react\").TransitionEventHandler<HTMLInputElement>; onTransitionRun?: import(\"react\").TransitionEventHandler<HTMLInputElement>; onTransitionRunCapture?: import(\"react\").TransitionEventHandler<HTMLInputElement>; onTransitionStart?: import(\"react\").TransitionEventHandler<HTMLInputElement>; onTransitionStartCapture?: import(\"react\").TransitionEventHandler<HTMLInputElement>; onVolumeChange?: import(\"react\").ReactEventHandler<HTMLInputElement>; onVolumeChangeCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onWaiting?: import(\"react\").ReactEventHandler<HTMLInputElement>; onWaitingCapture?: import(\"react\").ReactEventHandler<HTMLInputElement>; onWheel?: import(\"react\").WheelEventHandler<HTMLInputElement>; onWheelCapture?: import(\"react\").WheelEventHandler<HTMLInputElement>; part?: string; pattern?: string; placeholder?: string; popover?: \"\" | \"auto\" | \"manual\" | \"hint\"; popoverTarget?: string; popoverTargetAction?: \"toggle\" | \"show\" | \"hide\"; prefix?: string; property?: string; radioGroup?: string; readOnly?: boolean; ref?: Ref<HTMLInputElement>; rel?: string; required?: boolean; resource?: string; results?: number; rev?: string; role?: import(\"react\").AriaRole; security?: string; size?: number; slot?: string; spellCheck?: (boolean | \"true\" | \"false\"); src?: string; step?: string | number; style?: import(\"react\").CSSProperties; suppressContentEditableWarning?: boolean; suppressHydrationWarning?: boolean; tabIndex?: number; title?: string; translate?: \"yes\" | \"no\"; typeof?: string; unselectable?: \"off\" | \"on\"; value?: string | number | readonly string[]; vocab?: string; width?: string | number;",
     "SegmentedControl": "ariaControls?: string; ariaDescribedBy?: string; ariaLabelledBy?: string; className?: string; label?: string; layout?: \"fit\" | \"equal\"; onChange: (value: string) => void; options: readonly SegmentedControlOption<string>[]; value: string;",
     "Select": "about?: string; accessKey?: string; \"aria-activedescendant\"?: string; \"aria-atomic\"?: (boolean | \"true\" | \"false\"); \"aria-autocomplete\"?: \"none\" | \"list\" | \"inline\" | \"both\"; \"aria-braillelabel\"?: string; \"aria-brailleroledescription\"?: string; \"aria-busy\"?: (boolean | \"true\" | \"false\"); \"aria-checked\"?: boolean | \"true\" | \"false\" | \"mixed\"; \"aria-colcount\"?: number; \"aria-colindex\"?: number; \"aria-colindextext\"?: string; \"aria-colspan\"?: number; \"aria-controls\"?: string; \"aria-current\"?: boolean | \"true\" | \"false\" | \"page\" | \"step\" | \"location\" | \"date\" | \"time\"; \"aria-describedby\"?: string; \"aria-description\"?: string; \"aria-details\"?: string; \"aria-disabled\"?: (boolean | \"true\" | \"false\"); \"aria-dropeffect\"?: \"none\" | \"link\" | \"copy\" | \"execute\" | \"move\" | \"popup\"; \"aria-errormessage\"?: string; \"aria-expanded\"?: (boolean | \"true\" | \"false\"); \"aria-flowto\"?: string; \"aria-grabbed\"?: (boolean | \"true\" | \"false\"); \"aria-haspopup\"?: boolean | \"true\" | \"false\" | \"dialog\" | \"grid\" | \"listbox\" | \"menu\" | \"tree\"; \"aria-hidden\"?: (boolean | \"true\" | \"false\"); \"aria-invalid\"?: boolean | \"true\" | \"false\" | \"grammar\" | \"spelling\"; \"aria-keyshortcuts\"?: string; \"aria-label\"?: string; \"aria-labelledby\"?: string; \"aria-level\"?: number; \"aria-live\"?: \"off\" | \"assertive\" | \"polite\"; \"aria-modal\"?: (boolean | \"true\" | \"false\"); \"aria-multiline\"?: (boolean | \"true\" | \"false\"); \"aria-multiselectable\"?: (boolean | \"true\" | \"false\"); \"aria-orientation\"?: \"horizontal\" | \"vertical\"; \"aria-owns\"?: string; \"aria-placeholder\"?: string; \"aria-posinset\"?: number; \"aria-pressed\"?: boolean | \"true\" | \"false\" | \"mixed\"; \"aria-readonly\"?: (boolean | \"true\" | \"false\"); \"aria-relevant\"?: \"text\" | \"additions\" | \"additions removals\" | \"additions text\" | \"all\" | \"removals\" | \"removals additions\" | \"removals text\" | \"text additions\" | \"text removals\"; \"aria-required\"?: (boolean | \"true\" | \"false\"); \"aria-roledescription\"?: string; \"aria-rowcount\"?: number; \"aria-rowindex\"?: number; \"aria-rowindextext\"?: string; \"aria-rowspan\"?: number; \"aria-selected\"?: (boolean | \"true\" | \"false\"); \"aria-setsize\"?: number; \"aria-sort\"?: \"none\" | \"ascending\" | \"descending\" | \"other\"; \"aria-valuemax\"?: number; \"aria-valuemin\"?: number; \"aria-valuenow\"?: number; \"aria-valuetext\"?: string; autoCapitalize?: \"off\" | \"none\" | \"on\" | \"sentences\" | \"words\" | \"characters\" | (string & {}); autoComplete?: string; autoCorrect?: string; autoFocus?: boolean; autoSave?: string; className?: string; color?: string; content?: string; contentEditable?: (boolean | \"true\" | \"false\") | \"inherit\" | \"plaintext-only\"; contextMenu?: string; dangerouslySetInnerHTML?: { __html: string | TrustedHTML; }; datatype?: string; defaultChecked?: boolean; defaultValue?: string | number | readonly string[]; dir?: string; disabled?: boolean; draggable?: (boolean | \"true\" | \"false\"); enterKeyHint?: \"enter\" | \"done\" | \"go\" | \"next\" | \"previous\" | \"search\" | \"send\"; error?: string; exportparts?: string; fieldClassName?: string; form?: string; hidden?: boolean; hideLabel?: boolean; hint?: string; id?: string; inert?: boolean; inlist?: any; inputMode?: \"none\" | \"search\" | \"text\" | \"tel\" | \"url\" | \"email\" | \"numeric\" | \"decimal\"; is?: string; itemID?: string; itemProp?: string; itemRef?: string; itemScope?: boolean; itemType?: string; label: string; lang?: string; multiple?: boolean; name?: string; nonce?: string; onAbort?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onAbortCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onAnimationEnd?: import(\"react\").AnimationEventHandler<HTMLSelectElement>; onAnimationEndCapture?: import(\"react\").AnimationEventHandler<HTMLSelectElement>; onAnimationIteration?: import(\"react\").AnimationEventHandler<HTMLSelectElement>; onAnimationIterationCapture?: import(\"react\").AnimationEventHandler<HTMLSelectElement>; onAnimationStart?: import(\"react\").AnimationEventHandler<HTMLSelectElement>; onAnimationStartCapture?: import(\"react\").AnimationEventHandler<HTMLSelectElement>; onAuxClick?: import(\"react\").MouseEventHandler<HTMLSelectElement>; onAuxClickCapture?: import(\"react\").MouseEventHandler<HTMLSelectElement>; onBeforeInput?: import(\"react\").InputEventHandler<HTMLSelectElement>; onBeforeInputCapture?: import(\"react\").InputEventHandler<HTMLSelectElement>; onBeforeToggle?: import(\"react\").ToggleEventHandler<HTMLSelectElement>; onBlur?: import(\"react\").FocusEventHandler<HTMLSelectElement>; onBlurCapture?: import(\"react\").FocusEventHandler<HTMLSelectElement>; onCanPlay?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onCanPlayCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onCanPlayThrough?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onCanPlayThroughCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onChange?: import(\"react\").ChangeEventHandler<HTMLSelectElement, HTMLSelectElement>; onChangeCapture?: import(\"react\").ChangeEventHandler<HTMLSelectElement, Element>; onClick?: import(\"react\").MouseEventHandler<HTMLSelectElement>; onClickCapture?: import(\"react\").MouseEventHandler<HTMLSelectElement>; onCompositionEnd?: import(\"react\").CompositionEventHandler<HTMLSelectElement>; onCompositionEndCapture?: import(\"react\").CompositionEventHandler<HTMLSelectElement>; onCompositionStart?: import(\"react\").CompositionEventHandler<HTMLSelectElement>; onCompositionStartCapture?: import(\"react\").CompositionEventHandler<HTMLSelectElement>; onCompositionUpdate?: import(\"react\").CompositionEventHandler<HTMLSelectElement>; onCompositionUpdateCapture?: import(\"react\").CompositionEventHandler<HTMLSelectElement>; onContextMenu?: import(\"react\").MouseEventHandler<HTMLSelectElement>; onContextMenuCapture?: import(\"react\").MouseEventHandler<HTMLSelectElement>; onCopy?: import(\"react\").ClipboardEventHandler<HTMLSelectElement>; onCopyCapture?: import(\"react\").ClipboardEventHandler<HTMLSelectElement>; onCut?: import(\"react\").ClipboardEventHandler<HTMLSelectElement>; onCutCapture?: import(\"react\").ClipboardEventHandler<HTMLSelectElement>; onDoubleClick?: import(\"react\").MouseEventHandler<HTMLSelectElement>; onDoubleClickCapture?: import(\"react\").MouseEventHandler<HTMLSelectElement>; onDrag?: import(\"react\").DragEventHandler<HTMLSelectElement>; onDragCapture?: import(\"react\").DragEventHandler<HTMLSelectElement>; onDragEnd?: import(\"react\").DragEventHandler<HTMLSelectElement>; onDragEndCapture?: import(\"react\").DragEventHandler<HTMLSelectElement>; onDragEnter?: import(\"react\").DragEventHandler<HTMLSelectElement>; onDragEnterCapture?: import(\"react\").DragEventHandler<HTMLSelectElement>; onDragExit?: import(\"react\").DragEventHandler<HTMLSelectElement>; onDragExitCapture?: import(\"react\").DragEventHandler<HTMLSelectElement>; onDragLeave?: import(\"react\").DragEventHandler<HTMLSelectElement>; onDragLeaveCapture?: import(\"react\").DragEventHandler<HTMLSelectElement>; onDragOver?: import(\"react\").DragEventHandler<HTMLSelectElement>; onDragOverCapture?: import(\"react\").DragEventHandler<HTMLSelectElement>; onDragStart?: import(\"react\").DragEventHandler<HTMLSelectElement>; onDragStartCapture?: import(\"react\").DragEventHandler<HTMLSelectElement>; onDrop?: import(\"react\").DragEventHandler<HTMLSelectElement>; onDropCapture?: import(\"react\").DragEventHandler<HTMLSelectElement>; onDurationChange?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onDurationChangeCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onEmptied?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onEmptiedCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onEncrypted?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onEncryptedCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onEnded?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onEndedCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onError?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onErrorCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onFocus?: import(\"react\").FocusEventHandler<HTMLSelectElement>; onFocusCapture?: import(\"react\").FocusEventHandler<HTMLSelectElement>; onGotPointerCapture?: import(\"react\").PointerEventHandler<HTMLSelectElement>; onGotPointerCaptureCapture?: import(\"react\").PointerEventHandler<HTMLSelectElement>; onInput?: import(\"react\").InputEventHandler<HTMLSelectElement>; onInputCapture?: import(\"react\").InputEventHandler<HTMLSelectElement>; onInvalid?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onInvalidCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onKeyDown?: import(\"react\").KeyboardEventHandler<HTMLSelectElement>; onKeyDownCapture?: import(\"react\").KeyboardEventHandler<HTMLSelectElement>; onKeyPress?: import(\"react\").KeyboardEventHandler<HTMLSelectElement>; onKeyPressCapture?: import(\"react\").KeyboardEventHandler<HTMLSelectElement>; onKeyUp?: import(\"react\").KeyboardEventHandler<HTMLSelectElement>; onKeyUpCapture?: import(\"react\").KeyboardEventHandler<HTMLSelectElement>; onLoad?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onLoadCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onLoadedData?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onLoadedDataCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onLoadedMetadata?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onLoadedMetadataCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onLoadStart?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onLoadStartCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onLostPointerCapture?: import(\"react\").PointerEventHandler<HTMLSelectElement>; onLostPointerCaptureCapture?: import(\"react\").PointerEventHandler<HTMLSelectElement>; onMouseDown?: import(\"react\").MouseEventHandler<HTMLSelectElement>; onMouseDownCapture?: import(\"react\").MouseEventHandler<HTMLSelectElement>; onMouseEnter?: import(\"react\").MouseEventHandler<HTMLSelectElement>; onMouseLeave?: import(\"react\").MouseEventHandler<HTMLSelectElement>; onMouseMove?: import(\"react\").MouseEventHandler<HTMLSelectElement>; onMouseMoveCapture?: import(\"react\").MouseEventHandler<HTMLSelectElement>; onMouseOut?: import(\"react\").MouseEventHandler<HTMLSelectElement>; onMouseOutCapture?: import(\"react\").MouseEventHandler<HTMLSelectElement>; onMouseOver?: import(\"react\").MouseEventHandler<HTMLSelectElement>; onMouseOverCapture?: import(\"react\").MouseEventHandler<HTMLSelectElement>; onMouseUp?: import(\"react\").MouseEventHandler<HTMLSelectElement>; onMouseUpCapture?: import(\"react\").MouseEventHandler<HTMLSelectElement>; onPaste?: import(\"react\").ClipboardEventHandler<HTMLSelectElement>; onPasteCapture?: import(\"react\").ClipboardEventHandler<HTMLSelectElement>; onPause?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onPauseCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onPlay?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onPlayCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onPlaying?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onPlayingCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onPointerCancel?: import(\"react\").PointerEventHandler<HTMLSelectElement>; onPointerCancelCapture?: import(\"react\").PointerEventHandler<HTMLSelectElement>; onPointerDown?: import(\"react\").PointerEventHandler<HTMLSelectElement>; onPointerDownCapture?: import(\"react\").PointerEventHandler<HTMLSelectElement>; onPointerEnter?: import(\"react\").PointerEventHandler<HTMLSelectElement>; onPointerLeave?: import(\"react\").PointerEventHandler<HTMLSelectElement>; onPointerMove?: import(\"react\").PointerEventHandler<HTMLSelectElement>; onPointerMoveCapture?: import(\"react\").PointerEventHandler<HTMLSelectElement>; onPointerOut?: import(\"react\").PointerEventHandler<HTMLSelectElement>; onPointerOutCapture?: import(\"react\").PointerEventHandler<HTMLSelectElement>; onPointerOver?: import(\"react\").PointerEventHandler<HTMLSelectElement>; onPointerOverCapture?: import(\"react\").PointerEventHandler<HTMLSelectElement>; onPointerUp?: import(\"react\").PointerEventHandler<HTMLSelectElement>; onPointerUpCapture?: import(\"react\").PointerEventHandler<HTMLSelectElement>; onProgress?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onProgressCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onRateChange?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onRateChangeCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onReset?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onResetCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onScroll?: import(\"react\").UIEventHandler<HTMLSelectElement>; onScrollCapture?: import(\"react\").UIEventHandler<HTMLSelectElement>; onScrollEnd?: import(\"react\").UIEventHandler<HTMLSelectElement>; onScrollEndCapture?: import(\"react\").UIEventHandler<HTMLSelectElement>; onSeeked?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onSeekedCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onSeeking?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onSeekingCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onSelect?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onSelectCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onStalled?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onStalledCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onSubmit?: import(\"react\").SubmitEventHandler<HTMLSelectElement>; onSubmitCapture?: import(\"react\").SubmitEventHandler<HTMLSelectElement>; onSuspend?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onSuspendCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onTimeUpdate?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onTimeUpdateCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onToggle?: import(\"react\").ToggleEventHandler<HTMLSelectElement>; onTouchCancel?: import(\"react\").TouchEventHandler<HTMLSelectElement>; onTouchCancelCapture?: import(\"react\").TouchEventHandler<HTMLSelectElement>; onTouchEnd?: import(\"react\").TouchEventHandler<HTMLSelectElement>; onTouchEndCapture?: import(\"react\").TouchEventHandler<HTMLSelectElement>; onTouchMove?: import(\"react\").TouchEventHandler<HTMLSelectElement>; onTouchMoveCapture?: import(\"react\").TouchEventHandler<HTMLSelectElement>; onTouchStart?: import(\"react\").TouchEventHandler<HTMLSelectElement>; onTouchStartCapture?: import(\"react\").TouchEventHandler<HTMLSelectElement>; onTransitionCancel?: import(\"react\").TransitionEventHandler<HTMLSelectElement>; onTransitionCancelCapture?: import(\"react\").TransitionEventHandler<HTMLSelectElement>; onTransitionEnd?: import(\"react\").TransitionEventHandler<HTMLSelectElement>; onTransitionEndCapture?: import(\"react\").TransitionEventHandler<HTMLSelectElement>; onTransitionRun?: import(\"react\").TransitionEventHandler<HTMLSelectElement>; onTransitionRunCapture?: import(\"react\").TransitionEventHandler<HTMLSelectElement>; onTransitionStart?: import(\"react\").TransitionEventHandler<HTMLSelectElement>; onTransitionStartCapture?: import(\"react\").TransitionEventHandler<HTMLSelectElement>; onVolumeChange?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onVolumeChangeCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onWaiting?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onWaitingCapture?: import(\"react\").ReactEventHandler<HTMLSelectElement>; onWheel?: import(\"react\").WheelEventHandler<HTMLSelectElement>; onWheelCapture?: import(\"react\").WheelEventHandler<HTMLSelectElement>; options: SelectOption[]; part?: string; placeholder?: string; popover?: \"\" | \"auto\" | \"manual\" | \"hint\"; popoverTarget?: string; popoverTargetAction?: \"toggle\" | \"show\" | \"hide\"; prefix?: string; property?: string; radioGroup?: string; ref?: Ref<HTMLSelectElement>; rel?: string; required?: boolean; resource?: string; results?: number; rev?: string; role?: import(\"react\").AriaRole; security?: string; size?: number; slot?: string; spellCheck?: (boolean | \"true\" | \"false\"); style?: import(\"react\").CSSProperties; suppressContentEditableWarning?: boolean; suppressHydrationWarning?: boolean; tabIndex?: number; title?: string; translate?: \"yes\" | \"no\"; typeof?: string; unselectable?: \"off\" | \"on\"; value?: string | number | readonly string[]; vocab?: string;",
-    "Sheet": "ariaLabel?: string; bodyClassName?: string; children: ReactNode; closeButtonClassName?: string; closeLabel?: string; contentClassName?: string; contentStyle?: CSSProperties; description?: string; descriptionContent?: ReactNode; desktopBackdropClassName?: string; footer?: ReactNode; headerActions?: ReactNode; headerClassName?: string; headerLeading?: ReactNode; id?: string; initialFocusRef?: RefObject<HTMLElement | null>; labelledBy?: string; mobilePlacement?: \"bottom\" | \"top\" | \"fullscreen\"; mobileSize?: SheetMobileSize; onClose: () => void; open: boolean; placement?: \"default\" | \"left\"; portal?: boolean; resolveReturnFocusTarget?: (() => HTMLElement | null); returnFocusRef?: RefObject<HTMLElement | null>; testId?: string; title?: string; titleAccessory?: ReactNode; titleClassName?: string;",
+    "Sheet": "ariaLabel?: string; bodyClassName?: string; bodyRef?: RefObject<HTMLDivElement | null>; children: ReactNode; closeButtonClassName?: string; closeLabel?: string; contentClassName?: string; contentStyle?: CSSProperties; description?: string; descriptionContent?: ReactNode; desktopBackdropClassName?: string; footer?: ReactNode; footerClassName?: string; headerActions?: ReactNode; headerClassName?: string; headerLeading?: ReactNode; id?: string; initialFocusRef?: RefObject<HTMLElement | null>; labelledBy?: string; mobileHeaderSafeArea?: SheetMobileHeaderSafeArea; mobilePlacement?: \"bottom\" | \"top\" | \"fullscreen\"; mobileSize?: SheetMobileSize; onBodyScroll?: UIEventHandler<HTMLDivElement>; onClose: () => void; open: boolean; placement?: \"default\" | \"left\"; portal?: boolean; resolveReturnFocusTarget?: (() => HTMLElement | null); returnFocusRef?: RefObject<HTMLElement | null>; testId?: string; title?: string; titleAccessory?: ReactNode; titleClassName?: string;",
     "Skeleton": "about?: string; accessKey?: string; animationDelay?: string; \"aria-activedescendant\"?: string; \"aria-atomic\"?: (boolean | \"true\" | \"false\"); \"aria-autocomplete\"?: \"none\" | \"list\" | \"inline\" | \"both\"; \"aria-braillelabel\"?: string; \"aria-brailleroledescription\"?: string; \"aria-busy\"?: (boolean | \"true\" | \"false\"); \"aria-checked\"?: boolean | \"true\" | \"false\" | \"mixed\"; \"aria-colcount\"?: number; \"aria-colindex\"?: number; \"aria-colindextext\"?: string; \"aria-colspan\"?: number; \"aria-controls\"?: string; \"aria-current\"?: boolean | \"true\" | \"false\" | \"page\" | \"step\" | \"location\" | \"date\" | \"time\"; \"aria-describedby\"?: string; \"aria-description\"?: string; \"aria-details\"?: string; \"aria-disabled\"?: (boolean | \"true\" | \"false\"); \"aria-dropeffect\"?: \"none\" | \"link\" | \"copy\" | \"execute\" | \"move\" | \"popup\"; \"aria-errormessage\"?: string; \"aria-expanded\"?: (boolean | \"true\" | \"false\"); \"aria-flowto\"?: string; \"aria-grabbed\"?: (boolean | \"true\" | \"false\"); \"aria-haspopup\"?: boolean | \"true\" | \"false\" | \"dialog\" | \"grid\" | \"listbox\" | \"menu\" | \"tree\"; \"aria-hidden\"?: (boolean | \"true\" | \"false\"); \"aria-invalid\"?: boolean | \"true\" | \"false\" | \"grammar\" | \"spelling\"; \"aria-keyshortcuts\"?: string; \"aria-label\"?: string; \"aria-labelledby\"?: string; \"aria-level\"?: number; \"aria-live\"?: \"off\" | \"assertive\" | \"polite\"; \"aria-modal\"?: (boolean | \"true\" | \"false\"); \"aria-multiline\"?: (boolean | \"true\" | \"false\"); \"aria-multiselectable\"?: (boolean | \"true\" | \"false\"); \"aria-orientation\"?: \"horizontal\" | \"vertical\"; \"aria-owns\"?: string; \"aria-placeholder\"?: string; \"aria-posinset\"?: number; \"aria-pressed\"?: boolean | \"true\" | \"false\" | \"mixed\"; \"aria-readonly\"?: (boolean | \"true\" | \"false\"); \"aria-relevant\"?: \"text\" | \"additions\" | \"additions removals\" | \"additions text\" | \"all\" | \"removals\" | \"removals additions\" | \"removals text\" | \"text additions\" | \"text removals\"; \"aria-required\"?: (boolean | \"true\" | \"false\"); \"aria-roledescription\"?: string; \"aria-rowcount\"?: number; \"aria-rowindex\"?: number; \"aria-rowindextext\"?: string; \"aria-rowspan\"?: number; \"aria-selected\"?: (boolean | \"true\" | \"false\"); \"aria-setsize\"?: number; \"aria-sort\"?: \"none\" | \"ascending\" | \"descending\" | \"other\"; \"aria-valuemax\"?: number; \"aria-valuemin\"?: number; \"aria-valuenow\"?: number; \"aria-valuetext\"?: string; autoCapitalize?: \"off\" | \"none\" | \"on\" | \"sentences\" | \"words\" | \"characters\" | (string & {}); autoCorrect?: string; autoFocus?: boolean; autoSave?: string; children?: ReactNode; className?: string; color?: string; content?: string; contentEditable?: (boolean | \"true\" | \"false\") | \"inherit\" | \"plaintext-only\"; contextMenu?: string; dangerouslySetInnerHTML?: { __html: string | TrustedHTML; }; datatype?: string; defaultChecked?: boolean; defaultValue?: string | number | readonly string[]; dir?: string; draggable?: (boolean | \"true\" | \"false\"); enterKeyHint?: \"enter\" | \"done\" | \"go\" | \"next\" | \"previous\" | \"search\" | \"send\"; exportparts?: string; hidden?: boolean; id?: string; inert?: boolean; inlist?: any; inputMode?: \"none\" | \"search\" | \"text\" | \"tel\" | \"url\" | \"email\" | \"numeric\" | \"decimal\"; is?: string; itemID?: string; itemProp?: string; itemRef?: string; itemScope?: boolean; itemType?: string; lang?: string; nonce?: string; onAbort?: import(\"react\").ReactEventHandler<HTMLDivElement>; onAbortCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onAnimationEnd?: import(\"react\").AnimationEventHandler<HTMLDivElement>; onAnimationEndCapture?: import(\"react\").AnimationEventHandler<HTMLDivElement>; onAnimationIteration?: import(\"react\").AnimationEventHandler<HTMLDivElement>; onAnimationIterationCapture?: import(\"react\").AnimationEventHandler<HTMLDivElement>; onAnimationStart?: import(\"react\").AnimationEventHandler<HTMLDivElement>; onAnimationStartCapture?: import(\"react\").AnimationEventHandler<HTMLDivElement>; onAuxClick?: import(\"react\").MouseEventHandler<HTMLDivElement>; onAuxClickCapture?: import(\"react\").MouseEventHandler<HTMLDivElement>; onBeforeInput?: import(\"react\").InputEventHandler<HTMLDivElement>; onBeforeInputCapture?: import(\"react\").InputEventHandler<HTMLDivElement>; onBeforeToggle?: import(\"react\").ToggleEventHandler<HTMLDivElement>; onBlur?: import(\"react\").FocusEventHandler<HTMLDivElement>; onBlurCapture?: import(\"react\").FocusEventHandler<HTMLDivElement>; onCanPlay?: import(\"react\").ReactEventHandler<HTMLDivElement>; onCanPlayCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onCanPlayThrough?: import(\"react\").ReactEventHandler<HTMLDivElement>; onCanPlayThroughCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onChange?: import(\"react\").ChangeEventHandler<HTMLDivElement, Element>; onChangeCapture?: import(\"react\").ChangeEventHandler<HTMLDivElement, Element>; onClick?: import(\"react\").MouseEventHandler<HTMLDivElement>; onClickCapture?: import(\"react\").MouseEventHandler<HTMLDivElement>; onCompositionEnd?: import(\"react\").CompositionEventHandler<HTMLDivElement>; onCompositionEndCapture?: import(\"react\").CompositionEventHandler<HTMLDivElement>; onCompositionStart?: import(\"react\").CompositionEventHandler<HTMLDivElement>; onCompositionStartCapture?: import(\"react\").CompositionEventHandler<HTMLDivElement>; onCompositionUpdate?: import(\"react\").CompositionEventHandler<HTMLDivElement>; onCompositionUpdateCapture?: import(\"react\").CompositionEventHandler<HTMLDivElement>; onContextMenu?: import(\"react\").MouseEventHandler<HTMLDivElement>; onContextMenuCapture?: import(\"react\").MouseEventHandler<HTMLDivElement>; onCopy?: import(\"react\").ClipboardEventHandler<HTMLDivElement>; onCopyCapture?: import(\"react\").ClipboardEventHandler<HTMLDivElement>; onCut?: import(\"react\").ClipboardEventHandler<HTMLDivElement>; onCutCapture?: import(\"react\").ClipboardEventHandler<HTMLDivElement>; onDoubleClick?: import(\"react\").MouseEventHandler<HTMLDivElement>; onDoubleClickCapture?: import(\"react\").MouseEventHandler<HTMLDivElement>; onDrag?: import(\"react\").DragEventHandler<HTMLDivElement>; onDragCapture?: import(\"react\").DragEventHandler<HTMLDivElement>; onDragEnd?: import(\"react\").DragEventHandler<HTMLDivElement>; onDragEndCapture?: import(\"react\").DragEventHandler<HTMLDivElement>; onDragEnter?: import(\"react\").DragEventHandler<HTMLDivElement>; onDragEnterCapture?: import(\"react\").DragEventHandler<HTMLDivElement>; onDragExit?: import(\"react\").DragEventHandler<HTMLDivElement>; onDragExitCapture?: import(\"react\").DragEventHandler<HTMLDivElement>; onDragLeave?: import(\"react\").DragEventHandler<HTMLDivElement>; onDragLeaveCapture?: import(\"react\").DragEventHandler<HTMLDivElement>; onDragOver?: import(\"react\").DragEventHandler<HTMLDivElement>; onDragOverCapture?: import(\"react\").DragEventHandler<HTMLDivElement>; onDragStart?: import(\"react\").DragEventHandler<HTMLDivElement>; onDragStartCapture?: import(\"react\").DragEventHandler<HTMLDivElement>; onDrop?: import(\"react\").DragEventHandler<HTMLDivElement>; onDropCapture?: import(\"react\").DragEventHandler<HTMLDivElement>; onDurationChange?: import(\"react\").ReactEventHandler<HTMLDivElement>; onDurationChangeCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onEmptied?: import(\"react\").ReactEventHandler<HTMLDivElement>; onEmptiedCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onEncrypted?: import(\"react\").ReactEventHandler<HTMLDivElement>; onEncryptedCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onEnded?: import(\"react\").ReactEventHandler<HTMLDivElement>; onEndedCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onError?: import(\"react\").ReactEventHandler<HTMLDivElement>; onErrorCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onFocus?: import(\"react\").FocusEventHandler<HTMLDivElement>; onFocusCapture?: import(\"react\").FocusEventHandler<HTMLDivElement>; onGotPointerCapture?: import(\"react\").PointerEventHandler<HTMLDivElement>; onGotPointerCaptureCapture?: import(\"react\").PointerEventHandler<HTMLDivElement>; onInput?: import(\"react\").InputEventHandler<HTMLDivElement>; onInputCapture?: import(\"react\").InputEventHandler<HTMLDivElement>; onInvalid?: import(\"react\").ReactEventHandler<HTMLDivElement>; onInvalidCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onKeyDown?: import(\"react\").KeyboardEventHandler<HTMLDivElement>; onKeyDownCapture?: import(\"react\").KeyboardEventHandler<HTMLDivElement>; onKeyPress?: import(\"react\").KeyboardEventHandler<HTMLDivElement>; onKeyPressCapture?: import(\"react\").KeyboardEventHandler<HTMLDivElement>; onKeyUp?: import(\"react\").KeyboardEventHandler<HTMLDivElement>; onKeyUpCapture?: import(\"react\").KeyboardEventHandler<HTMLDivElement>; onLoad?: import(\"react\").ReactEventHandler<HTMLDivElement>; onLoadCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onLoadedData?: import(\"react\").ReactEventHandler<HTMLDivElement>; onLoadedDataCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onLoadedMetadata?: import(\"react\").ReactEventHandler<HTMLDivElement>; onLoadedMetadataCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onLoadStart?: import(\"react\").ReactEventHandler<HTMLDivElement>; onLoadStartCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onLostPointerCapture?: import(\"react\").PointerEventHandler<HTMLDivElement>; onLostPointerCaptureCapture?: import(\"react\").PointerEventHandler<HTMLDivElement>; onMouseDown?: import(\"react\").MouseEventHandler<HTMLDivElement>; onMouseDownCapture?: import(\"react\").MouseEventHandler<HTMLDivElement>; onMouseEnter?: import(\"react\").MouseEventHandler<HTMLDivElement>; onMouseLeave?: import(\"react\").MouseEventHandler<HTMLDivElement>; onMouseMove?: import(\"react\").MouseEventHandler<HTMLDivElement>; onMouseMoveCapture?: import(\"react\").MouseEventHandler<HTMLDivElement>; onMouseOut?: import(\"react\").MouseEventHandler<HTMLDivElement>; onMouseOutCapture?: import(\"react\").MouseEventHandler<HTMLDivElement>; onMouseOver?: import(\"react\").MouseEventHandler<HTMLDivElement>; onMouseOverCapture?: import(\"react\").MouseEventHandler<HTMLDivElement>; onMouseUp?: import(\"react\").MouseEventHandler<HTMLDivElement>; onMouseUpCapture?: import(\"react\").MouseEventHandler<HTMLDivElement>; onPaste?: import(\"react\").ClipboardEventHandler<HTMLDivElement>; onPasteCapture?: import(\"react\").ClipboardEventHandler<HTMLDivElement>; onPause?: import(\"react\").ReactEventHandler<HTMLDivElement>; onPauseCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onPlay?: import(\"react\").ReactEventHandler<HTMLDivElement>; onPlayCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onPlaying?: import(\"react\").ReactEventHandler<HTMLDivElement>; onPlayingCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onPointerCancel?: import(\"react\").PointerEventHandler<HTMLDivElement>; onPointerCancelCapture?: import(\"react\").PointerEventHandler<HTMLDivElement>; onPointerDown?: import(\"react\").PointerEventHandler<HTMLDivElement>; onPointerDownCapture?: import(\"react\").PointerEventHandler<HTMLDivElement>; onPointerEnter?: import(\"react\").PointerEventHandler<HTMLDivElement>; onPointerLeave?: import(\"react\").PointerEventHandler<HTMLDivElement>; onPointerMove?: import(\"react\").PointerEventHandler<HTMLDivElement>; onPointerMoveCapture?: import(\"react\").PointerEventHandler<HTMLDivElement>; onPointerOut?: import(\"react\").PointerEventHandler<HTMLDivElement>; onPointerOutCapture?: import(\"react\").PointerEventHandler<HTMLDivElement>; onPointerOver?: import(\"react\").PointerEventHandler<HTMLDivElement>; onPointerOverCapture?: import(\"react\").PointerEventHandler<HTMLDivElement>; onPointerUp?: import(\"react\").PointerEventHandler<HTMLDivElement>; onPointerUpCapture?: import(\"react\").PointerEventHandler<HTMLDivElement>; onProgress?: import(\"react\").ReactEventHandler<HTMLDivElement>; onProgressCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onRateChange?: import(\"react\").ReactEventHandler<HTMLDivElement>; onRateChangeCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onReset?: import(\"react\").ReactEventHandler<HTMLDivElement>; onResetCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onScroll?: import(\"react\").UIEventHandler<HTMLDivElement>; onScrollCapture?: import(\"react\").UIEventHandler<HTMLDivElement>; onScrollEnd?: import(\"react\").UIEventHandler<HTMLDivElement>; onScrollEndCapture?: import(\"react\").UIEventHandler<HTMLDivElement>; onSeeked?: import(\"react\").ReactEventHandler<HTMLDivElement>; onSeekedCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onSeeking?: import(\"react\").ReactEventHandler<HTMLDivElement>; onSeekingCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onSelect?: import(\"react\").ReactEventHandler<HTMLDivElement>; onSelectCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onStalled?: import(\"react\").ReactEventHandler<HTMLDivElement>; onStalledCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onSubmit?: import(\"react\").SubmitEventHandler<HTMLDivElement>; onSubmitCapture?: import(\"react\").SubmitEventHandler<HTMLDivElement>; onSuspend?: import(\"react\").ReactEventHandler<HTMLDivElement>; onSuspendCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onTimeUpdate?: import(\"react\").ReactEventHandler<HTMLDivElement>; onTimeUpdateCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onToggle?: import(\"react\").ToggleEventHandler<HTMLDivElement>; onTouchCancel?: import(\"react\").TouchEventHandler<HTMLDivElement>; onTouchCancelCapture?: import(\"react\").TouchEventHandler<HTMLDivElement>; onTouchEnd?: import(\"react\").TouchEventHandler<HTMLDivElement>; onTouchEndCapture?: import(\"react\").TouchEventHandler<HTMLDivElement>; onTouchMove?: import(\"react\").TouchEventHandler<HTMLDivElement>; onTouchMoveCapture?: import(\"react\").TouchEventHandler<HTMLDivElement>; onTouchStart?: import(\"react\").TouchEventHandler<HTMLDivElement>; onTouchStartCapture?: import(\"react\").TouchEventHandler<HTMLDivElement>; onTransitionCancel?: import(\"react\").TransitionEventHandler<HTMLDivElement>; onTransitionCancelCapture?: import(\"react\").TransitionEventHandler<HTMLDivElement>; onTransitionEnd?: import(\"react\").TransitionEventHandler<HTMLDivElement>; onTransitionEndCapture?: import(\"react\").TransitionEventHandler<HTMLDivElement>; onTransitionRun?: import(\"react\").TransitionEventHandler<HTMLDivElement>; onTransitionRunCapture?: import(\"react\").TransitionEventHandler<HTMLDivElement>; onTransitionStart?: import(\"react\").TransitionEventHandler<HTMLDivElement>; onTransitionStartCapture?: import(\"react\").TransitionEventHandler<HTMLDivElement>; onVolumeChange?: import(\"react\").ReactEventHandler<HTMLDivElement>; onVolumeChangeCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onWaiting?: import(\"react\").ReactEventHandler<HTMLDivElement>; onWaitingCapture?: import(\"react\").ReactEventHandler<HTMLDivElement>; onWheel?: import(\"react\").WheelEventHandler<HTMLDivElement>; onWheelCapture?: import(\"react\").WheelEventHandler<HTMLDivElement>; part?: string; popover?: \"\" | \"auto\" | \"manual\" | \"hint\"; popoverTarget?: string; popoverTargetAction?: \"toggle\" | \"show\" | \"hide\"; prefix?: string; property?: string; radioGroup?: string; rel?: string; resource?: string; results?: number; rev?: string; role?: import(\"react\").AriaRole; security?: string; slot?: string; spellCheck?: (boolean | \"true\" | \"false\"); style?: import(\"react\").CSSProperties; suppressContentEditableWarning?: boolean; suppressHydrationWarning?: boolean; tabIndex?: number; title?: string; translate?: \"yes\" | \"no\"; typeof?: string; unselectable?: \"off\" | \"on\"; vocab?: string;",
     "SourceDesignationBadge": "className?: string; metadata?: SourceMetadataInput;",
     "SourceProvenance": "metadata?: SourceMetadataInput;",
diff --git a/.env.example b/.env.example
index 1f32a51988..ffe8b0b352 100644
--- a/.env.example
+++ b/.env.example
@@ -145,6 +145,9 @@ SENTRY_ENVIRONMENT=production
 # on the answer stream. Server emission flag; client rendering ships separately. Keep false
 # until the offline contract proof has landed and enablement is deliberately staged.
 RAG_INCREMENTAL_EVIDENCE_PREVIEW=false
+# #100 Phase 1 client rendering gate. This NEXT_PUBLIC value is inlined at build time;
+# keep it off until focused browser, accessibility, and clinical-governance proof is accepted.
+#NEXT_PUBLIC_RAG_INCREMENTAL_EVIDENCE_PREVIEW_RENDER=false
 # Ambiguity-only structured semantic reranking. Keep false until the retrieval canary is approved.
 RAG_SEMANTIC_RERANK_ENABLED=false
 # Append OR-relaxed recall behind weak-but-nonzero strict text matches (P8b extension).
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ad4aa2ba01..5e76a606ee 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -188,6 +188,14 @@ jobs:
         if: needs.changes.outputs.static_heavy_changed == 'true'
         run: npm run check:upload-limit-parity
 
+      # The generated lexicon review is a clinical-facing artefact. It was in the
+      # local verify:pr-local chain but in no CI job, so it rotted on main and
+      # failed every local preflight while every required check stayed green
+      # (#333). Same static-heavy condition verify-pr-local.mjs already uses.
+      - name: Medication lexicon report freshness
+        if: needs.changes.outputs.static_heavy_changed == 'true'
+        run: npm run check:medication-lexicon-report
+
       - name: GitHub Actions pin check
         if: needs.changes.outputs.workflow_changed == 'true'
         run: npm run check:github-actions
diff --git a/docs/README.md b/docs/README.md
index 34779ed651..98666d3134 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -93,6 +93,9 @@ npm run docs:check-links
 ## Plans and workstreams (living)
 
 - [maturity-backlog-workorders.md](maturity-backlog-workorders.md) — actionable work orders tracking the repository-maturity audit backlog
+- [no-unchecked-indexed-access-migration-plan.md](no-unchecked-indexed-access-migration-plan.md) — staged multi-PR rollout for the `noUncheckedIndexedAccess` TypeScript flag (ledger `#211`)
+- [ledger-id-scheme-proposal.md](ledger-id-scheme-proposal.md) — design for collision-free outstanding-issue ids so concurrent sessions stop contending on `issues:next-id` (ledger `#168`)
+- [pr-handoff-stop-cross-agent-gap.md](pr-handoff-stop-cross-agent-gap.md) — why the PR-handoff stop rule is hook-enforced for Claude Code but prose-only for Codex and Cursor, and what parity would require (ledger `#258`)
 - [framework-dependency-modernization-checklist.md](framework-dependency-modernization-checklist.md) — ordered Next.js 16, runtime, dependency, Turbopack, and verification migration program
 - [search-rag-master-plan.md](search-rag-master-plan.md) / [search-rag-master-context.md](search-rag-master-context.md) — search/RAG roadmap and shared context
 - [rag-improvement/README.md](rag-improvement/README.md) — reviewed/updated RAG improvement programme: answer-quality track (intent-aware related information, length) + corrected eval/safety infra track
diff --git a/docs/audit/live-drift-forensics-2026-08.md b/docs/audit/live-drift-forensics-2026-08.md
index 19e0317ca4..6005d58299 100644
--- a/docs/audit/live-drift-forensics-2026-08.md
+++ b/docs/audit/live-drift-forensics-2026-08.md
@@ -27,33 +27,188 @@ runs on pushes to `main` touching `supabase/migrations/**` or `supabase/schema.s
 `workflow_dispatch`, the secret preflight, and `concurrency.cancel-in-progress: false` were kept
 unchanged. No hosted Supabase call was made.
 
-Outstanding for the operator: dispatch `live-drift` once to confirm a real failure produces the
-pinned issue (provider-backed — not run from the authoring session), and add
-`SUPABASE_ACCESS_TOKEN` to environment secrets per plan step 0.3 and ledger `#183`.
+_2026-08-14, forced-dispatch proof (owner-authorized)._ `live-drift` dispatched on `main`
+(Actions run `31813064485`). The definition-of-done behaviour was observed end-to-end:
+
+- `live-drift` job **failed** at `Compare live schema drift`, as intended for this proof.
+- `Capture drift and migration-history findings` still ran (`if: always()`), and
+  `Align migration history for Supabase Preview` correctly **skipped** after the failing step.
+- The separate `drift-routing` job then ran (`if: ${{ !cancelled() }}`) and **succeeded**,
+  creating issue **#1963 "Live drift check failing"** with label `live-drift-failure`, the run
+  URL, `Job result: failure`, `Trigger: workflow_dispatch`, and the full findings block.
+
+That run also supersedes the stale 2026-08-09 figures this file was opened with. Measured
+2026-08-14, `UNEXPECTED DRIFT (32)`:
+
+| Category                                 | 2026-08-09 | 2026-08-14         |
+| ---------------------------------------- | ---------- | ------------------ |
+| `match_*` function `def_hash` mismatches | 10         | **10 — unchanged** |
+| `missing_live` indexes                   | 21         | **20**             |
+| `unexpected_live` indexes                | 2          | **2 — unchanged**  |
+
+`documents_title_trgm_idx` and `document_chunks_content_trgm_idx` are absent from the missing
+list, independently corroborating the Phase 4 restoration below (verified separately by
+read-only query against `sjrfecxgysukkwxsowpy`: both `indisvalid`/`indisready`, 648 kB and
+68 MB). The 10 RPC mismatches are untouched, so **Phase 3 remains entirely outstanding** and is
+the next step per the plan's ordering.
+
+Routing is also covered offline by `tests/live-drift-workflow.test.ts` (mutation-verified), so a
+future regression fails a test rather than waiting for a live failure to be mishandled.
+
+Outstanding for the operator: add `SUPABASE_ACCESS_TOKEN` to environment secrets per plan step
+0.3 and ledger `#183` (dashboard work; names only, never values).
 
 ## Phase 1 — Read-only forensics
 
-_Not yet run. Requires an approved read-only production window._
+_Partially run 2026-08-14 in an owner-authorized incident window, then extended the same day in a
+read-only connector session. 1.2 is enumerated and noise-separated but its per-function diff hunks,
+the remaining index sizing, and the dashboard audit-history pairing remain pending._
 
 ### 1.1 Migration-history fingerprint
 
-_Pending._ Record every `statements IS NULL` version with its name, and state explicitly whether
-`20260705180000` carries that signal — then pair it with audit history to distinguish a
-mark-applied/repair history from indexes that were created and later dropped. Do not close `#248`
-on the fingerprint alone.
+_2026-08-14 (owner-authorized Supabase connector session, incident-driven partial run)._
+Full `schema_migrations` fingerprint captured. Decisive rows:
+
+- `20260705180000 reconcile_search_health_indexes` — `no_statements = false`, **stmt_count 14**.
+  It does **not** carry the mark-applied signal: its DDL was recorded as executed.
+- `20260804110240 restore_rag_search_health_indexes` (the guard) — applied with its statement on
+  2026-08-04. Note (per PR #1960 review): that guard validates four **other** indexes and never
+  checks this pair, so its application gives **no** existence bound for
+  `documents_title_trgm_idx` / `document_chunks_content_trgm_idx`.
+- Rows with the mark-applied signal (`statements IS NULL` or empty): the 2026-07-01…07-02 cluster
+  (`fix_chunks_hybrid_perf_and_ambiguity`, `fix_remaining_hybrid_perf_and_ambiguity`,
+  `schema_health_hybrid_execution_smoke`, `drop_dead_drifted_hybrid_variants`,
+  `clinical_query_term_trgm_correction`, `commit_generation_preserve_legacy_artifacts`,
+  `add_claim_ingestion_jobs_comment`, `drop_redundant_indexes`, `rag_retrieval_logs_retention`,
+  `storage_cleanup_jobs_document_fk`, `fix_reset_document_index_duplicate`,
+  `documents_owner_covering_index`, `fix_invoke_agent_url_to_guc`,
+  `promote_index_generation_id_columns`) and the 2026-07-12 reconciliation batch
+  (`reconcile_ingestion_index_shapes` … `add_legacy_index_health_batch_repair`, stmt_count 0).
+
+**Conclusion for the two retrieval-critical indexes:** their creation was recorded as executed on
+2026-07-05 (`20260705180000`, 14 statements), and both were reported missing by the live-drift
+runs of 2026-08-02 (Actions 30763871562) and 2026-08-09 (31330856982), with the weekly check red
+since 2026-07-26 — so the drop happened **between 2026-07-05 and 2026-08-02** (likely by
+2026-07-26). No app/worker/edge-function code issues `DROP INDEX` (repo grep, this session), so a
+manual/dashboard action — e.g. an accepted "unused index" advisor suggestion — is the leading
+**inference, not an established attribution**; pairing with the dashboard audit/query history for
+that window remains **pending** (owner action). `#248` stays open.
 
 ### 1.2 RPC divergence dossier
 
-_Pending._ One entry per mismatched `match_*` function, each classified **live-ahead**,
-**repo-ahead**, **normalization noise**, or **UNCLASSIFIED**, quoting the decisive diff hunk.
-Protected RAG surface: an ambiguous diff is recorded as UNCLASSIFIED and escalated, never guessed.
+One entry per mismatched `match_*` function, each classified **live-ahead**, **repo-ahead**,
+**normalization noise**, or **UNCLASSIFIED**, quoting the decisive diff hunk. Protected RAG
+surface: an ambiguous diff is recorded as UNCLASSIFIED and escalated, never guessed.
+
+_2026-08-14 (owner-authorized read-only connector session) — enumeration and noise-separation
+complete; per-function diff hunks still pending._
+
+All 93 `public` functions were compared by the manifest's own rule (`pg_get_functiondef`, block
+and line comments stripped, whitespace stripped, md5) against `supabase/drift-manifest.json`.
+Result: **0 missing on live, 0 extra on live, 16 hash mismatches** — every one a `match_document_*`
+retrieval RPC.
+
+**Six of the sixteen are normalization noise and are now closed.** A live session renders
+`regprocedure` and body types unqualified (`vector`), while the manifest was generated where they
+render schema-qualified (`extensions.vector`). Re-qualifying `vector` → `extensions.vector` before
+hashing reproduces the manifest hash **exactly** for these six, so their bodies are byte-identical
+to the repo:
+
+| Function                                                           | Classification      | Evidence                                                             |
+| ------------------------------------------------------------------ | ------------------- | -------------------------------------------------------------------- |
+| `match_document_chunks(vector,integer,double precision,uuid,uuid)` | normalization noise | re-qualified hash `cdf9d685c98bc8ff731a0422c29a47a4` = manifest hash |
+| `match_document_chunks_v2(vector,…,boolean)`                       | normalization noise | re-qualified hash matches manifest                                   |
+| `match_document_chunks_hybrid_v2(vector,…,boolean)`                | normalization noise | re-qualified hash matches manifest                                   |
+| `match_document_embedding_fields_hybrid_v2(vector,…,boolean)`      | normalization noise | re-qualified hash matches manifest                                   |
+| `match_document_index_units_hybrid_scoped(vector,…,boolean)`       | normalization noise | re-qualified hash matches manifest                                   |
+| `match_document_memory_cards_hybrid_v3(vector,…,boolean)`          | normalization noise | re-qualified hash matches manifest                                   |
+
+**The remaining ten are unresolved hash mismatches and are UNCLASSIFIED.** They do not match the
+manifest under the raw hash, the `extensions.`-stripped hash, or the re-qualified hash. That rules
+out the tested `extensions.vector` rendering variants, but does not establish a body difference:
+`pg_get_functiondef` also carries declarations and attributes, and other normalization differences
+remain possible. Per the rule above they are recorded UNCLASSIFIED rather than guessed — deciding
+whether there is a body difference, and then live-ahead vs repo-ahead, needs the decisive hunk:
+
+`match_document_chunks_text`, `match_document_chunks_text_v2`, `match_document_chunks_hybrid`,
+`match_document_embedding_fields_hybrid`, `match_document_index_units_hybrid`,
+`match_document_index_units_hybrid_v2`, `match_document_lookup_chunks_text`,
+`match_document_memory_cards_hybrid`, `match_document_memory_cards_hybrid_v2`,
+`match_document_table_facts_text`.
+
+This confirms ten unresolved retrieval-RPC hash mismatches after excluding the six proven
+qualification artefacts. It does **not** yet confirm that ten RPC bodies diverge.
+
+**Method trap, recorded so the next run does not repeat it.** Joining manifest signatures to live
+`p.oid::regprocedure::text` directly reports **all 93** functions as simultaneously missing _and_
+extra, because the manifest stores `public.fn(extensions.vector,…)` and the live session renders
+`fn(vector,…)`. That is a join failure, not a finding. Normalize both sides (strip the `public.`
+prefix, fold `extensions.vector` → `vector`) before comparing, then test each surviving mismatch
+against the qualification variants before calling it divergence.
 
 ### 1.3 Index inventory, sizing, and EXPLAIN baselines
 
-_Pending._ Owning-table `pg_relation_size` for the 21 missing and 2 unexpected indexes, plus
-`EXPLAIN (ANALYZE, BUFFERS)` baselines for the `documents` title ILIKE query, the `document_chunks`
-content search, and the `rag_retrieval_logs` miss scan. These are the before-measurements for
-Phases 4 and 5.
+_2026-08-14 (partial — retrieval-critical scope only)._ Live inventory of the ten
+`20260705180000` indexes: **exactly two missing** — `documents_title_trgm_idx` and
+`document_chunks_content_trgm_idx`; the other eight present (labels/summaries trgm, table-facts,
+index-units, pages, sections, both `rag_retrieval_logs` indexes). Owning tables at repair time:
+`document_chunks` 1562 MB / 70,120 live rows; `documents` 18 MB / 3,301 rows.
+
+Before-measurements came from live production probes rather than raw EXPLAIN (the incident was
+end-to-end visible): `/api/search` semantic query 2026-08-14 → total 37.7 s,
+`supabase_rpc_latency_ms` **31,610**; a second semantic probe 29.9 s / 21,757. The remaining
+missing-index sizing and the `rag_retrieval_logs` miss-scan baseline are **pending**.
+
+**Whole-schema inventory — 2026-08-14, after the repair above (owner-authorized read-only
+connector session).** The scope above is the ten `20260705180000` indexes; this is the full
+`public` schema, and it is **additive to the incident, not a restatement of it**. Both repaired
+indexes (`documents_title_trgm_idx`, `document_chunks_content_trgm_idx`) are confirmed **present**
+on live now.
+
+|                           Side |  Count | Source                                                                      |
+| -----------------------------: | -----: | --------------------------------------------------------------------------- |
+|                   Repo-defined |    210 | `supabase/drift-manifest.json` `snapshot.indexes`                           |
+|                           Live |    192 | `pg_indexes`, schema `public`                                               |
+|           **Absent from live** | **20** | full outer join by name                                                     |
+| Orphaned on live (not in repo) |      2 | `document_table_facts_document_id_idx`, `storage_cleanup_jobs_owner_id_idx` |
+
+210 − 20 + 2 = 192, so neither side is a partial read. The 20 absent, retrieval-relevant ones
+first:
+
+`document_chunks_anchor_idx`, `document_index_units_heading_path_idx`, `rag_aliases_type_enabled_idx`,
+`rag_queries_source_chunk_ids_gin_idx`, `rag_query_misses_aliases_idx`,
+`documents_registry_projection_lookup_idx`, `document_images_structured_profile_gin_idx`,
+`image_caption_cache_owner_hash_idx`, `api_rate_limits_bucket_updated_idx`,
+`audit_logs_action_created_idx`, `audit_logs_owner_created_idx`, `document_images_hash_idx`,
+`document_images_visual_intelligence_version_idx`, `document_index_quality_owner_score_idx`,
+`document_publication_approvals_document_idx`, `document_summaries_owner_idx`,
+`indexing_v3_agent_jobs_locked_at_idx`, `ingestion_job_stages_job_stage_started_idx`,
+`medication_records_owner_category_idx`, `storage_cleanup_jobs_owner_status_idx`.
+
+**None is invalid-but-present.** `pg_index` filtered on `indisvalid = false or indisready = false`
+returns **zero rows** across the whole `public` schema, so the failed-`CREATE INDEX CONCURRENTLY`
+class documented in `docs/database-drift-detection.md` explains none of the 20. The objects are
+absent, not broken.
+
+**Five covered creating migrations recorded executed DDL.** Extending the §1.1 fingerprint to the
+four further migrations in this sampled set found that none carries the mark-applied signal:
+
+| Migration                                              | `stmt_count` | Mark-applied? |
+| ------------------------------------------------------ | -----------: | ------------- |
+| `20260528007000 database_hardening_before_import`      |           32 | no            |
+| `20260608001000 index_accuracy_usability_improvements` |           36 | no            |
+| `20260705180000 reconcile_search_health_indexes`       |           14 | no (per §1.1) |
+| `20260712165211 reconcile_missing_operational_indexes` |           27 | no            |
+| `20260717170000 registry_projection_cleanup`           |           11 | no            |
+
+This establishes recorded-executed-but-absent evidence across five migrations from 2026-05-28 to
+2026-07-17, including one named `reconcile_missing_operational_indexes`; it does **not** cover the
+creating migrations for `document_publication_approvals_document_idx`,
+`indexing_v3_agent_jobs_locked_at_idx`, or `medication_records_owner_category_idx`. Fingerprint
+those histories before classifying those three absences as created-then-dropped. **Root cause
+remains unestablished** — §1.1's manual/dashboard-drop inference is the leading hypothesis and the
+dashboard audit-history pairing is still the owner action that would confirm or refute it. This
+inventory widens what that pairing has to explain; it does not by itself attribute anything.
 
 ## Phase 2 — Staging parity rehearsal
 
@@ -73,17 +228,49 @@ behaviour-changing deploy.
 
 ## Phase 4 — Index restoration
 
-_Not yet run. Requires an approved off-peak production window._
+_2026-08-14 (partial, incident-driven: the two retrieval-critical indexes only, owner-approved
+"i authorise" in-session)._ Executed via the owner-authorized Supabase connector:
 
-_Pending._ PITR restore point, per-index `CREATE INDEX CONCURRENTLY` result with its
-`indisvalid`/`indisready` verification, disposition of the 2 unexpected live indexes with reasons,
-the guard migrations landed, and the green live-drift dispatch output.
+- `create index concurrently if not exists documents_title_trgm_idx …` — definition verbatim from
+  `20260705180000`. Result: `indisvalid = true`, `indisready = true`, 648 kB.
+- `create index concurrently if not exists document_chunks_content_trgm_idx …` — same source.
+  Result: `indisvalid = true`, `indisready = true`, 68 MB.
+- `ANALYZE public.documents; ANALYZE public.document_chunks;` after both builds.
+- Canonical-shape validation (per PR #1960 review — `IF NOT EXISTS` could otherwise no-op on a
+  same-named index; here the prior inventory proved both absent, and post-build `pg_indexes`
+  returns the canonical normalized definitions verbatim):
+  `CREATE INDEX document_chunks_content_trgm_idx ON public.document_chunks USING gin (lower(((COALESCE(section_heading, ''::text) || ' '::text) || COALESCE(content, ''::text))) gin_trgm_ops)` and
+  `CREATE INDEX documents_title_trgm_idx ON public.documents USING gin (lower(((COALESCE(title, ''::text) || ' '::text) || COALESCE(file_name, ''::text))) gin_trgm_ops)` —
+  both matching `20260705180000` / `schema.sql`.
+
+Deviation from the phase template, recorded honestly: no PITR restore point was captured first —
+the operation was additive index creation with a one-statement rollback
+(`drop index concurrently`), no data-loss surface. No migration was added in the incident window:
+the definitions are already codified in `20260705180000` + `schema.sql`, and this was the
+documented operator prebuild for a drifted hosted target. **Outstanding phase debt (PR #1960
+review):** plan phase 4.4 still requires a fail-fast reconcile/guard migration for this repaired
+pair (the `20260804110240` pattern names four other indexes only), so a later replay cannot
+silently proceed if either index disappears again — queued as follow-up work for the full Phase 4
+batch, deliberately not bundled into this docs-only PR because migrations are an operational-risk
+surface with their own replay gates. The other 19 drift findings, the 2 unexpected live indexes,
+and the green live-drift dispatch also remain **pending** for the full phase.
 
 ## Phase 5 — Measure and close the loop
 
-_Not yet run. Requires a read-only production window (plus eval approval only if Phase 3 changed
-behaviour)._
+_Partially run 2026-08-14 (incident scope); full close-out still requires the remaining phases._
+
+_2026-08-14 (partial)._ Before/after production probes (identical endpoint and query style):
+
+| Measurement                                                         | Before               | After restore + ANALYZE |
+| ------------------------------------------------------------------- | -------------------- | ----------------------- |
+| Semantic query, text fast path — total / `supabase_rpc_latency_ms`  | 37.7 s / 31,610      | 4.8 s / **1,535**       |
+| Semantic query, hybrid strategy — total / `supabase_rpc_latency_ms` | 29.9 s / 21,757      | 17.2 s / 8,519          |
+| `match_document_chunks_text_v2` single call                         | (dominated the 31 s) | 14 ms                   |
 
-_Pending._ Before/after `EXPLAIN` table against the Phase 1.3 baselines showing plan flips and
-timings, the evidence-backed verdict on ledger `#231`'s 25 s fast-route budget, and the
-`check:production-readiness` output.
+**#231 verdict from this evidence:** the 25 s fast-route budget was being consumed by retrieval
+itself while the two trigram indexes were missing — pre-generation latency was the binding cause
+of semantic-query source-only fallbacks in this window (README §A1 ladder rung 2, now measured).
+The A1/S1 packet must re-verify `generation_quality_gate:*` dominance on healthy latency before
+choosing any code mitigation. Residual: hybrid fan-out still costs ~8.5 s worst-observed — owned
+by the remaining remediation phases, not a route-budget change (`#231`'s stop condition stands).
+`check:production-readiness` on the final state is **pending**.
diff --git a/docs/branch-review-records/00d268a6cf6a1beeb904826b9f82a104ab62d03663c70e87ffdf0209fa2e5790.record.md b/docs/branch-review-records/00d268a6cf6a1beeb904826b9f82a104ab62d03663c70e87ffdf0209fa2e5790.record.md
new file mode 100644
index 0000000000..d4986d1661
--- /dev/null
+++ b/docs/branch-review-records/00d268a6cf6a1beeb904826b9f82a104ab62d03663c70e87ffdf0209fa2e5790.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/ledger-review-triage-yi63ao | 02d2e7fc839cf370b512f66b255d5f9e9b42f377 | required base sync through main 17402395 | Approved — required main update merged; previous ledger issue-closure verification remains applicable with no PR-path conflict | git diff --check; ci-change-scope self-test; ledger/inbox/outstanding/discipline guards passed |
diff --git a/docs/branch-review-records/01671f1a4ca2796caf84922f73bc373f30c8fad36ffc94a1bafd0d5ca55693a7.record.md b/docs/branch-review-records/01671f1a4ca2796caf84922f73bc373f30c8fad36ffc94a1bafd0d5ca55693a7.record.md
new file mode 100644
index 0000000000..ffd59fa430
--- /dev/null
+++ b/docs/branch-review-records/01671f1a4ca2796caf84922f73bc373f30c8fad36ffc94a1bafd0d5ca55693a7.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/differential-results-ui-20260814 | 8bba4d60586c102a8d42e208c7bd73fb0b52046b | Differentials results evidence-state, clinical-cue, and ranking presentation | Fixed three validated P2 findings: evidence-gated best-match success styling, clinical-cue-only labels, and A–Z display rank. | git diff --check; direct Node source-contract assertions; targeted Vitest attempted but unavailable because this isolated worktree has no node_modules/vitest |
diff --git a/docs/branch-review-records/023564085ea84fa8f81b78f3ec3e137053c64dbd30e5af948b0b041bd6ba537b.record.md b/docs/branch-review-records/023564085ea84fa8f81b78f3ec3e137053c64dbd30e5af948b0b041bd6ba537b.record.md
new file mode 100644
index 0000000000..0343aa24eb
--- /dev/null
+++ b/docs/branch-review-records/023564085ea84fa8f81b78f3ec3e137053c64dbd30e5af948b0b041bd6ba537b.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | PR-1964 | 1dfc0c9b984152f6518060712ab050311f3f77c9 | vitest.config.mts, docs/maturity-backlog-workorders.md (ledger #192 / maturity X6 coverage floors) | APPROVED — coverage-threshold re-ratchet, no RAG/clinical behaviour change; verify:pr-local green except pre-existing unrelated check:medication-lexicon-report staleness | test:coverage,verify:pr-local |
diff --git a/docs/branch-review-records/05b6c633adabd9647962f315da24d8e079183c4c8cd7d6d8303dba20a80489f4.record.md b/docs/branch-review-records/05b6c633adabd9647962f315da24d8e079183c4c8cd7d6d8303dba20a80489f4.record.md
new file mode 100644
index 0000000000..7648ec0f91
--- /dev/null
+++ b/docs/branch-review-records/05b6c633adabd9647962f315da24d8e079183c4c8cd7d6d8303dba20a80489f4.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | codex/improve-guide-layout-and-fix-bugs | c577a4b47c22ee6734e18af0da41d757d374aaca | PR #1948 review-and-fix | fixed confirmed mobile footer keyboard-accessibility and hidden padding defects; merged latest main | offline: Prettier changed files; git diff --check; check:maintainability-budgets; check:base-freshness; targeted Vitest unavailable (isolated worktree has no node_modules); browser smoke covered in CI |
diff --git a/docs/branch-review-records/06df711430759e1dddd2be8983c0188aae2c97681ffc7179731785beb78b5a6a.record.md b/docs/branch-review-records/06df711430759e1dddd2be8983c0188aae2c97681ffc7179731785beb78b5a6a.record.md
new file mode 100644
index 0000000000..8aae9d2953
--- /dev/null
+++ b/docs/branch-review-records/06df711430759e1dddd2be8983c0188aae2c97681ffc7179731785beb78b5a6a.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | PR-1955 | 752d1af54f0cbfdef70390af913693671fbf95b7 | PR #1955 full review, design-system fix, and required base sync | fixed CI-blocking design-system contract regressions; merged latest main | git diff --check; native design-system remediation assertion; node scripts/check-docs-links.mjs; node scripts/ledger-inbox.mjs check; node scripts/check-ledger-write-discipline.mjs --self-test; full design-system/Vitest/UI checks unavailable (node_modules absent) |
diff --git a/docs/branch-review-records/09f7a6223d2cc9cf801d28f42c84347fb6e8fe8167098620126ddf8a61a1994e.record.md b/docs/branch-review-records/09f7a6223d2cc9cf801d28f42c84347fb6e8fe8167098620126ddf8a61a1994e.record.md
new file mode 100644
index 0000000000..98b0809764
--- /dev/null
+++ b/docs/branch-review-records/09f7a6223d2cc9cf801d28f42c84347fb6e8fe8167098620126ddf8a61a1994e.record.md
@@ -0,0 +1 @@
+| 2026-08-17 | 2018 | a4338471f29c12c4f98b5abf4910aaf6f461d992 | merge-conflict resolution + review fixes for PR #2009 (docs/filter-contract.md, scripts/check-outstanding-issues.mjs, scripts/ledger-inbox.mjs, src/components/clinical-dashboard/account-setup-dialog.tsx, tests/ui-smoke.spec.ts, tests/ui-tools.spec.ts) | reviewed and fixed: resolved 6-file merge conflict against main, fixed 2 CodeRabbit findings (fingerprint case-sensitivity, URL regex boundary), left 2 findings unaddressed (fingerprint-mandatory migration risk, design-token nitpick) | check-outstanding-issues self-test, ledger-inbox self-test, check:outstanding-issues, check-ledger-write-discipline, focused vitest (outstanding-issues-writer, repo-hygiene, ledger-inbox-cancellation, favourites-auth-gate), prettier --check, typecheck, eslint |
diff --git a/docs/branch-review-records/0ab0fabc55b3958783c42bcd3a18b865415668919f9bc7f081bedf9fe16aecdf.record.md b/docs/branch-review-records/0ab0fabc55b3958783c42bcd3a18b865415668919f9bc7f081bedf9fe16aecdf.record.md
new file mode 100644
index 0000000000..dba4be1fb9
--- /dev/null
+++ b/docs/branch-review-records/0ab0fabc55b3958783c42bcd3a18b865415668919f9bc7f081bedf9fe16aecdf.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | PR-1951 | 7d70c74cc5449d577df3895aa766ad31f3204045 | tests/live-drift-workflow.test.ts; docs/outstanding-issues-inbox; docs/branch-review-records | preserved prior test fixes; merged latest main; cancelled superseded #331/#333 ledger mutations to restore deterministic queue application | manual adversarial review; current thread verification; docs links passed; ledger inbox passed; ledger guards passed; git merge-tree; git diff --check; focused Vitest unavailable (node_modules absent) |
diff --git a/docs/branch-review-records/0bd6e78104f1efb528b8a02e6ce07cb58545f45e9ac5efe70e8e97e97233dfa6.record.md b/docs/branch-review-records/0bd6e78104f1efb528b8a02e6ce07cb58545f45e9ac5efe70e8e97e97233dfa6.record.md
new file mode 100644
index 0000000000..a95e83b072
--- /dev/null
+++ b/docs/branch-review-records/0bd6e78104f1efb528b8a02e6ce07cb58545f45e9ac5efe70e8e97e97233dfa6.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | PR #1966 / claude/ledger-review-triage-yi63ao | fd8e0fd55dd1a49e98039bd0057fb9221e644a93 | unblocking PR review-and-fix | No confirmed PR-introduced P0-P2 defect. Merged current main cleanly; prior ledger-closure concerns are superseded by current-main evidence. | ledger-inbox check PASS; outstanding-issues PASS; branch-review-ledger PASS; JSON parse 11/11; current-main claim probes PASS; diff --check PASS; npm setup unavailable (npm cache sandbox). |
diff --git a/docs/branch-review-records/0cf1eff09758f402a2e5b6d928c83a1455ccff9c97fc5f4a99286d566142b192.record.md b/docs/branch-review-records/0cf1eff09758f402a2e5b6d928c83a1455ccff9c97fc5f4a99286d566142b192.record.md
new file mode 100644
index 0000000000..2c92a3970a
--- /dev/null
+++ b/docs/branch-review-records/0cf1eff09758f402a2e5b6d928c83a1455ccff9c97fc5f4a99286d566142b192.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/rag-zod-hardening-tranche2 | f4bc9033d5482922de60681d764eb5e6c6ebb73f | rag-candidate-sources.ts signal-row Zod contracts (ledger #212 tranche 2) + 2 ledger captures | Approved — 3 unchecked RPC-result casts replaced with validated assertions; similarity_origin item deliberately excluded as a clinical-output behaviour change; no ranking/ordering/scoring logic touched | verify:pr-local all 18 steps green, zero failures; contract + rag-imputation-contract pins 21 passed; typecheck exit 0 |
diff --git a/docs/branch-review-records/115a1304ff998fd0eeaee128b93a1b624eceaa07712147fdfb1fd71dcf2603d5.record.md b/docs/branch-review-records/115a1304ff998fd0eeaee128b93a1b624eceaa07712147fdfb1fd71dcf2603d5.record.md
new file mode 100644
index 0000000000..9dc6569ae8
--- /dev/null
+++ b/docs/branch-review-records/115a1304ff998fd0eeaee128b93a1b624eceaa07712147fdfb1fd71dcf2603d5.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/differential-results-ui-20260814 | d12e0217c4adc057e27ad92fb5dad144ba38995a | Differentials formatter blocker remediation (supersedes 2026-08-15) | Supersedes immutable record 74e47bb0fd4e2b3ff3ec524606a00b573db356d6b17cf68b4829a19643b9b71a: factored the preceding non-best count into a Prettier-stable expression after exact-head CI rejected both wrapped and one-line forms. | git diff --check b7d2bbcc75f8e3aadf498575b2ae4c44ebd3cc79; node scripts/ledger-inbox.mjs check; node scripts/check-outstanding-issues.mjs; node scripts/check-branch-review-ledger.mjs; node scripts/check-ledger-write-discipline.mjs 6f7b7deefaf7e0cd062b748f18fc6ca8988093f6 HEAD; node scripts/ci-change-scope.mjs --self-test; exact-head static failure reviewed |
diff --git a/docs/branch-review-records/11809456723dae8154679a80157654f47f67b4c39e333654499b933d49b6b0f4.record.md b/docs/branch-review-records/11809456723dae8154679a80157654f47f67b4c39e333654499b933d49b6b0f4.record.md
new file mode 100644
index 0000000000..18872a1390
--- /dev/null
+++ b/docs/branch-review-records/11809456723dae8154679a80157654f47f67b4c39e333654499b933d49b6b0f4.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | claude/capture-drift-phase1-evidence | 00f5612ccf982441cf98ec6ca1c51d68ba2add6a | docs/audit/live-drift-forensics-2026-08.md + inbox — Phase 1.2/1.3 evidence capture | Filled 1.2 (was Pending): 93 functions compared, 0 missing/0 extra/16 mismatches, 6 proven normalization noise, 10 real and UNCLASSIFIED, confirming #316's figure of 10. Extended 1.3: 210 repo vs 192 live indexes, 20 still absent after the incident repair, zero invalid indexes, all five creating migrations recorded executed DDL. Root cause left unestablished. #316/#248 queued as inbox requests. Read-only throughout; no writes to the database. | verify:pr-local (11 completed, 0 failed) |
diff --git a/docs/branch-review-records/123580c2767d327b59ab4f6cc62bb75263a92e5d288897225e5e48dfe6822ca8.record.md b/docs/branch-review-records/123580c2767d327b59ab4f6cc62bb75263a92e5d288897225e5e48dfe6822ca8.record.md
new file mode 100644
index 0000000000..30b17fe1f4
--- /dev/null
+++ b/docs/branch-review-records/123580c2767d327b59ab4f6cc62bb75263a92e5d288897225e5e48dfe6822ca8.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/fix-cover-repair | 316018b41177e34612f08339bf4baf37055abf00 | cover repair script formatter follow-up | Formatted the stale-candidate guard reported by the changed-file formatter. Verified syntax with node --check; live Supabase execution intentionally not run. | node --check scripts/archive/backfill-document-covers.mjs; git diff --check; ledger-inbox; outstanding-issues; branch-review-ledger; ledger-write-discipline; ci-change-scope --self-test |
diff --git a/docs/branch-review-records/140eabfb61f0822b5fb955d0c1d8d7fd924563215dd96f29802abdb3f093fc41.record.md b/docs/branch-review-records/140eabfb61f0822b5fb955d0c1d8d7fd924563215dd96f29802abdb3f093fc41.record.md
new file mode 100644
index 0000000000..480a1e7e14
--- /dev/null
+++ b/docs/branch-review-records/140eabfb61f0822b5fb955d0c1d8d7fd924563215dd96f29802abdb3f093fc41.record.md
@@ -0,0 +1 @@
+| 2026-08-16 | codex/chat-service-facets-317-service-facets-317 | c957fc16e36381d775ce2fa068ec7cada68b4810 | PR #2004 registry service facet contract test | P2 false-negative contract guard fixed: compare restored tags with the raw fixture payload so a parser regression cannot agree with itself; no runtime defects found | Manual mutation proof reproduced the false negative; c957fc16 exact-head CI, static checks, unit coverage, safety/config, SAST, and secret scan passed; fix committed with ledger for exact-head CI rerun |
diff --git a/docs/branch-review-records/149dbe376e6d9fa6eac0edcdb578b65c526366619d6e858107ca0fe108f95382.record.md b/docs/branch-review-records/149dbe376e6d9fa6eac0edcdb578b65c526366619d6e858107ca0fe108f95382.record.md
new file mode 100644
index 0000000000..e87cf17b6c
--- /dev/null
+++ b/docs/branch-review-records/149dbe376e6d9fa6eac0edcdb578b65c526366619d6e858107ca0fe108f95382.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/differential-results-ui-20260814 | d12e0217c4adc057e27ad92fb5dad144ba38995a | PR #1971 base sync | Merged main 6f7b7deefaf7e0cd062b748f18fc6ca8988093f6 into the reviewed PR head; merge tree was clean. | git merge-tree --write-tree exact-head main: clean; git diff --check; ledger guards. |
diff --git a/docs/branch-review-records/150c95562bf34c0fc9a79c97c63bbacb3bac3f9a436acc5b0336b62533ab1c54.record.md b/docs/branch-review-records/150c95562bf34c0fc9a79c97c63bbacb3bac3f9a436acc5b0336b62533ab1c54.record.md
new file mode 100644
index 0000000000..c9aa58217a
--- /dev/null
+++ b/docs/branch-review-records/150c95562bf34c0fc9a79c97c63bbacb3bac3f9a436acc5b0336b62533ab1c54.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/rag-zod-hardening-tranche2 | 690204f669db3be9995b6c658ad2eb35befbdace | PR #1981 base sync | Merged main 6f7b7deefaf7e0cd062b748f18fc6ca8988093f6 into the reviewed PR head; merge tree was clean. | git merge-tree --write-tree exact-head main: clean; git diff --check; ledger guards. |
diff --git a/docs/branch-review-records/1750578822f17106f9029aa52fbe2ba972c2610971d057b366f68f12bc87baba.record.md b/docs/branch-review-records/1750578822f17106f9029aa52fbe2ba972c2610971d057b366f68f12bc87baba.record.md
new file mode 100644
index 0000000000..6025d3ff54
--- /dev/null
+++ b/docs/branch-review-records/1750578822f17106f9029aa52fbe2ba972c2610971d057b366f68f12bc87baba.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | PR #1991 | 18a5f42dad73695f95301574a3bb08c1341d025f | docs/medication-lexicon-review-worklist.md + one #318 inbox request (46750cbf); no lexicon, catalogue or sign-off change | Authored handoff. Worklist prepared for the #318 clinician pass; row stays OPEN and UNREVIEWED. Verified two of the row's three cited defects are already closed (ARB/Carbapenem guarded; lithium reachable) and only the Warfarin split remains, with zero interaction rows in common between the two records. Three new findings not surfaced by the sheet: tcas selects dead slug dothiepin so Dosulepin (FATAL in OD) fires none of 20 severe rows; nsaids subclass match excludes Celecoxib/Parecoxib from 38 severe rows; maois subclass match excludes Moclobemide (RIMA) from 17 severe rows. Also found two blind spots in the review instrument itself - missedClassMembers() skips sub-4-char stems so the check cannot fire for tcas or arbs, and it never reads tag - so the sheet's 'checks ran clean' line is overstated for two terms. One near-miss corrected before publication: Omeprazole was not a catalogue record, it was a substring hit inside Esomeprazole. | verify:pr-local low-risk docs route, 11 checks completed, failed: (none); check:ledger-write-discipline passed 806918834b43..HEAD; check:outstanding-issues passed 341 rows; medications:lexicon-report regenerated byte-identical. verify:ui NOT run - Playwright chromium-1194 vs pinned 1234 (#255/#312) fails closed in this container; no browser coverage claimed. |
diff --git a/docs/branch-review-records/1798e0af4644bdccaa00cfc3bd7fedeb56a5a019e93f3966580d3d41434e2a47.record.md b/docs/branch-review-records/1798e0af4644bdccaa00cfc3bd7fedeb56a5a019e93f3966580d3d41434e2a47.record.md
new file mode 100644
index 0000000000..88903cd3a0
--- /dev/null
+++ b/docs/branch-review-records/1798e0af4644bdccaa00cfc3bd7fedeb56a5a019e93f3966580d3d41434e2a47.record.md
@@ -0,0 +1 @@
+| 2026-08-16 | PR-1993 | 0df502749540c4e4de789bfad12837726b1944d8 | PR #1993 Tools phone footer search review | Fixed: preserved the tappable standalone-home suggestion ticker while retaining the Tools phone shared-footer placement. | Static phone-home truth table passed; exact one-line fix diff verified; prior exact-head CI isolated to the audit assertion; distinct manual adversarial pass found no additional high-confidence defects. |
diff --git a/docs/branch-review-records/180f5d9460a80283fbf5730d32a11b9a4d99c4075a36d42378e4fe7717a9b02f.record.md b/docs/branch-review-records/180f5d9460a80283fbf5730d32a11b9a4d99c4075a36d42378e4fe7717a9b02f.record.md
new file mode 100644
index 0000000000..f4c90b06ab
--- /dev/null
+++ b/docs/branch-review-records/180f5d9460a80283fbf5730d32a11b9a4d99c4075a36d42378e4fe7717a9b02f.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | PR-1961 | ed6ad9a0f81b079568534db78283fec93b956c67 | PR #1961 base-preserving reconciliation sync | Required base sync retained the current canonical ledger: all 35 reconciliation records and the #310 correction were already present upstream; preserved only the branch’s new pending Prettier-version-trap request. | docs link check passed: 1775 repo path references resolve; Ledger inbox check passed: 23 pending request(s), 138 applied; branch-review-ledger self-test passed; Branch review ledger guard passed: 880 live table records + 1206 archived + 99 immutable; verify:pr-local unavailable: tsx/cli absent from isolated worktree (Node v24.14.0). |
diff --git a/docs/branch-review-records/18503906b6f41b6151d7298f2a14ba993d7b2f39f39414b70103aab3a0a8fcc0.record.md b/docs/branch-review-records/18503906b6f41b6151d7298f2a14ba993d7b2f39f39414b70103aab3a0a8fcc0.record.md
new file mode 100644
index 0000000000..b174725707
--- /dev/null
+++ b/docs/branch-review-records/18503906b6f41b6151d7298f2a14ba993d7b2f39f39414b70103aab3a0a8fcc0.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/calculators-mode | 1e3d9278fbddda7d36d12e5645429b33d2a374ce | Calculators first-class mode | Resolved the current-base documentation conflict; prior P2 local-search and options-menu corrections remain present; no further confirmed P0-P2 findings. | git diff --check; ledger inbox/outstanding-issues/branch-ledger/discipline guards; calculator static contracts; focused Vitest attempted but unavailable because the isolated worktree has no node_modules |
diff --git a/docs/branch-review-records/192997fbab4a8e3383dccff432e693a8c22f231e8ebb30f3023eb4a5956ceef8.record.md b/docs/branch-review-records/192997fbab4a8e3383dccff432e693a8c22f231e8ebb30f3023eb4a5956ceef8.record.md
new file mode 100644
index 0000000000..8ae3d108d2
--- /dev/null
+++ b/docs/branch-review-records/192997fbab4a8e3383dccff432e693a8c22f231e8ebb30f3023eb4a5956ceef8.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/rag-zod-hardening-tranche2 | 87a8886f1f761bdab92324e0d5ea5e11d3111bb9 | review-and-fix | P1 CI blocker fixed: formatted retrieval row contract test; no additional P0-P2 findings in adversarial review; merged latest main | targeted Vitest 134 pass; RAG fixtures 36 pass; offline RAG 579 pass; issue and ledger guards pass; Prettier pass |
diff --git a/docs/branch-review-records/19d9b5ccfa4a8c3a52744d24cfc3bb7906a309c9f0d6beb92203bdd5717f47b3.record.md b/docs/branch-review-records/19d9b5ccfa4a8c3a52744d24cfc3bb7906a309c9f0d6beb92203bdd5717f47b3.record.md
new file mode 100644
index 0000000000..e15e14f0b1
--- /dev/null
+++ b/docs/branch-review-records/19d9b5ccfa4a8c3a52744d24cfc3bb7906a309c9f0d6beb92203bdd5717f47b3.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/ds-ratchet-tighten | 41a1bd73749564954d7bf11143fd6541402f7691 | Tighten seven design-system ratchets to measured values after the #1982-#1986 merges | 17 units of stale headroom removed; no metric relaxed | check:design-system-contract passed at the tightened values (sub-floor min-heights 40, edge conflicts 19, legacy shadow aliases 114); mutation-verified — min-h-9 on the shortlist Clear button now fails 'increased from 40 to 41' plus the per-path line, which the old pin of 43 allowed silently; check:gate-manifest OK; verify:pr-local 17 gates, unit suite 611 files / 6647 passed |
diff --git a/docs/branch-review-records/1bcd7481c03879170cc5f4dc265e6b1e647dac6fb84d348f6b12fea7f87e7968.record.md b/docs/branch-review-records/1bcd7481c03879170cc5f4dc265e6b1e647dac6fb84d348f6b12fea7f87e7968.record.md
new file mode 100644
index 0000000000..ce510798d3
--- /dev/null
+++ b/docs/branch-review-records/1bcd7481c03879170cc5f4dc265e6b1e647dac6fb84d348f6b12fea7f87e7968.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/calculators-mode | 1938a6bc5f1845c67c85584ded78b3be1c8a961a | Calculators first-class mode | Merged the latest required base after the final freshness check; calculator local-search and action-menu P2 corrections remain intact. | git diff --check; ledger inbox/outstanding-issues/branch-ledger/discipline guards; reconciled search-chrome contract assertion; focused Vitest remains unavailable because this isolated worktree has no node_modules |
diff --git a/docs/branch-review-records/1cd9399241d3cbac65652b1b8008514d5c4f4b2c2e82254fec86eb5c50ee6784.record.md b/docs/branch-review-records/1cd9399241d3cbac65652b1b8008514d5c4f4b2c2e82254fec86eb5c50ee6784.record.md
new file mode 100644
index 0000000000..94e188293b
--- /dev/null
+++ b/docs/branch-review-records/1cd9399241d3cbac65652b1b8008514d5c4f4b2c2e82254fec86eb5c50ee6784.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | PR #1965 (claude/playwright-browser-revision-check) | 24e8fd040949564e2c07fccfe6d243e386815b6e | scripts/check-playwright-browser-revision.mjs, tests/check-playwright-browser-revision.test.ts — ledger #312 fix | authored — verified real Chromium binary presence check on disk; reproduced original false-OK bug live against this session's /opt/pw-browsers container (chromium-1194 present, pinned revision 1234 missing) | verify:pr-local (runtime, lock-parity, format, lint, typecheck, test 602 files/6518 passed/4 skipped, rag:fixtures, medication-interactions PASS; medication-lexicon-report pre-existing unrelated FAIL); focused vitest check-playwright-browser-revision.test.ts 10/10, playwright-browser-preflight.test.ts 12/12 |
diff --git a/docs/branch-review-records/1eb170403cacbc03de02adf5632f19f46b5c09228a76c7dcb950557c88123401.record.md b/docs/branch-review-records/1eb170403cacbc03de02adf5632f19f46b5c09228a76c7dcb950557c88123401.record.md
new file mode 100644
index 0000000000..e4df4ab962
--- /dev/null
+++ b/docs/branch-review-records/1eb170403cacbc03de02adf5632f19f46b5c09228a76c7dcb950557c88123401.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | claude/live-drift-routing-lnhvja | 61b53680ad49196a392dea91e1a4a7345d88c522 | live-drift workflow failure routing + post-migration trigger (#316 phase 0) | PR #1939 open | check:github-actions pass; verify:pr-local failed:(none); test:ci-workflows pass |
diff --git a/docs/branch-review-records/1f2f64dc3b528b7149b664c65dc98e4b7e10477e73f22ca8c1ccfe02d4b84f50.record.md b/docs/branch-review-records/1f2f64dc3b528b7149b664c65dc98e4b7e10477e73f22ca8c1ccfe02d4b84f50.record.md
new file mode 100644
index 0000000000..3022e100c7
--- /dev/null
+++ b/docs/branch-review-records/1f2f64dc3b528b7149b664c65dc98e4b7e10477e73f22ca8c1ccfe02d4b84f50.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/calculators-mode | bbf2207102a0b40b5ba048e8e9a04f37add9bf2c | required base sync through main 3824095 | Approved — required main update merged after calculator command follow-ups; no PR-path conflict | git diff --check; ci-change-scope self-test; ledger/inbox/outstanding/discipline guards passed |
diff --git a/docs/branch-review-records/1f3d777e83828ea67eb00c77229eafceb41a6841e644b036b1b0f9f54b118f37.record.md b/docs/branch-review-records/1f3d777e83828ea67eb00c77229eafceb41a6841e644b036b1b0f9f54b118f37.record.md
new file mode 100644
index 0000000000..99a0e40663
--- /dev/null
+++ b/docs/branch-review-records/1f3d777e83828ea67eb00c77229eafceb41a6841e644b036b1b0f9f54b118f37.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | 1975 | c18199dec009ff252d4c6ed895d6b401685b897c | review-and-fix | Fixed fail-open cover probes, concurrent metadata clobber, ambiguous rollback deletion, and duplicate-cover recovery; merged latest main. | Focused Vitest 10/10, format, lint, typecheck passed. verify:pr-local partial: 6583 passed, 6 known origin/main Windows/tooling baseline failures; later fixture stages not reached. production-readiness environment-gated: 2 pass, 5 warn, 2 missing-config failures; no live provider calls. |
diff --git a/docs/branch-review-records/2151c86f85ae9cbf8e2e8530ac02019ce737d1565612b12828818d2377162c38.record.md b/docs/branch-review-records/2151c86f85ae9cbf8e2e8530ac02019ce737d1565612b12828818d2377162c38.record.md
new file mode 100644
index 0000000000..a648f6f38c
--- /dev/null
+++ b/docs/branch-review-records/2151c86f85ae9cbf8e2e8530ac02019ce737d1565612b12828818d2377162c38.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | claude/ledger-reconcile-batch-2 | af68b3271922656ef97312dae513a3f6906aec76 | docs/outstanding-issues.md + inbox — second serial reconciliation of 35 queued requests | Applied 25 active mutations (13 done, 6 add, 6 update) plus 5 cancellation decisions. Ledger 106 open/222 archived -> 99/235; inbox 0 pending/129 applied. Three closures queued in PR #1940 (#235 #237 #238) were cancelled by review and stay open: each asked for visual or browser proof and had been closed on executable evidence. Zero live same-target collisions verified before applying. | issues:reconcile --dry-run; verify:pr-local (11 completed, 0 failed); check:ledger-write-discipline |
diff --git a/docs/branch-review-records/216a72e41232d90b9641c9a9cf0446c884067c3339f7a2f50cd5c5e642b9988e.record.md b/docs/branch-review-records/216a72e41232d90b9641c9a9cf0446c884067c3339f7a2f50cd5c5e642b9988e.record.md
new file mode 100644
index 0000000000..1a42fed151
--- /dev/null
+++ b/docs/branch-review-records/216a72e41232d90b9641c9a9cf0446c884067c3339f7a2f50cd5c5e642b9988e.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/services-search-redesign-163 | 720e7027a9f08e518eb6344e74dfde35d78d5981 | Fix service bookmark readiness and mutation race; merge current main | fixed | git diff --check; focused DOM test blocked without node_modules; ledger and issue guards |
diff --git a/docs/branch-review-records/21c77c3c5582a1424f204ead318b9b780ef55dcb9d41bac400841a83eb4564f3.record.md b/docs/branch-review-records/21c77c3c5582a1424f204ead318b9b780ef55dcb9d41bac400841a83eb4564f3.record.md
new file mode 100644
index 0000000000..a0675df92d
--- /dev/null
+++ b/docs/branch-review-records/21c77c3c5582a1424f204ead318b9b780ef55dcb9d41bac400841a83eb4564f3.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | claude/db-remediation-phase-0-wfaiyl | 20228faa6002da009e290bc398345a47d2cd7a02 | PR #1951 review-and-fix | reviewed live-drift routing workflow contract and Phase 0 records; fixed no PR-introduced defect; merged latest main | offline: routing-script stub exercise; check-outstanding-issues; ledger-inbox check; Prettier changed files; check:github-actions; check:gate-manifest; check:verification-plan; maintainability budgets; targeted Vitest unavailable (isolated worktree has no node_modules); manual adversarial pass |
diff --git a/docs/branch-review-records/23787765990717e03f13cc7032add47d5a8e7d5b869c94ad78c36a062211e4e5.record.md b/docs/branch-review-records/23787765990717e03f13cc7032add47d5a8e7d5b869c94ad78c36a062211e4e5.record.md
new file mode 100644
index 0000000000..cb84bc9742
--- /dev/null
+++ b/docs/branch-review-records/23787765990717e03f13cc7032add47d5a8e7d5b869c94ad78c36a062211e4e5.record.md
@@ -0,0 +1 @@
+| 2026-08-17 | 2014 | 1c88ada9c023918764dcf2a01914829e3b93e902 | PR #2014 review-and-fix | High-confidence defects fixed; review threads resolved | audit-merge-loss --self-test + --since; prettier check; npm run check:branch-review-ledger; npm run check-outstanding-issues; required CI SUCCESS |
diff --git a/docs/branch-review-records/24336297cd7a192b04d348313e763ff4a51012c6de6ec22028f0f2b600adeaa7.record.md b/docs/branch-review-records/24336297cd7a192b04d348313e763ff4a51012c6de6ec22028f0f2b600adeaa7.record.md
new file mode 100644
index 0000000000..bd396c8cb4
--- /dev/null
+++ b/docs/branch-review-records/24336297cd7a192b04d348313e763ff4a51012c6de6ec22028f0f2b600adeaa7.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/calculators-mode | 3b896be3f5f6ea67df10c991257aeb05b41af619 | Fix calculator regression tests from exact-head CI and merge main d301d8f4 | fixed | git diff --check; static ledger guards; focused tests blocked without node_modules |
diff --git a/docs/branch-review-records/248b36b92b06adf7c5c774b595dbdd7338816418b90abb2584b88d3d49962c5d.record.md b/docs/branch-review-records/248b36b92b06adf7c5c774b595dbdd7338816418b90abb2584b88d3d49962c5d.record.md
new file mode 100644
index 0000000000..5577d0b845
--- /dev/null
+++ b/docs/branch-review-records/248b36b92b06adf7c5c774b595dbdd7338816418b90abb2584b88d3d49962c5d.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | PR-1951 | 4c55ec05875dcf063555e71021adb9d1f1a42f5c | PR #1951 full review and unblock | fixed | workflow permission-map parser; GitHub Issue API owner/repo assertions; node scripts/check-docs-links.mjs; node scripts/ledger-inbox.mjs check; node scripts/check-ledger-write-discipline.mjs --self-test; Vitest unavailable: node_modules absent |
diff --git a/docs/branch-review-records/26cca9a8fb9d8d74d7f1ee7930cfbe94b1ad5125cb1551eb036da361229c79c6.record.md b/docs/branch-review-records/26cca9a8fb9d8d74d7f1ee7930cfbe94b1ad5125cb1551eb036da361229c79c6.record.md
new file mode 100644
index 0000000000..2537fe48c1
--- /dev/null
+++ b/docs/branch-review-records/26cca9a8fb9d8d74d7f1ee7930cfbe94b1ad5125cb1551eb036da361229c79c6.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | PR-1956 | 40be0b6fd37beb39f2cd10599d5455a4ed74ceef | ledger reconciliation review, current-main merge, and duplicate-follow-up queueing | FIXED: merged current main cleanly; preserved canonical-ledger discipline; queued the two confirmed duplicate consolidations with immutable cancellation records for later serial reconciliation. | offline: ledger write-discipline; outstanding-issues; branch-review-ledger; docs links; skills; pr-policy; ci-scope; merge-loss self-test; manual adversarial review |
diff --git a/docs/branch-review-records/28051a48f8acb8c67da3f5d43e867ed46a9dbfa89fdd249cead35fa563bd9119.record.md b/docs/branch-review-records/28051a48f8acb8c67da3f5d43e867ed46a9dbfa89fdd249cead35fa563bd9119.record.md
new file mode 100644
index 0000000000..c775fff880
--- /dev/null
+++ b/docs/branch-review-records/28051a48f8acb8c67da3f5d43e867ed46a9dbfa89fdd249cead35fa563bd9119.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | PR-1951 | 809c50bf4ca8ede8c2c0ec49df9371cd4d56c517 | PR #1951 CI format repair | fixed the exact-head Changed-file format check failure in live-drift workflow coverage | Prettier 3.9.6; All matched files use Prettier code style!; Tests 15 passed (15); git diff --check passed; docs link check passed: 1775 repo path references resolve.; Ledger inbox check passed: 22 pending request(s), 138 applied.; ledger write discipline self-test passed.; Branch review ledger guard passed: 880 live table records + 1206 archived + 91 immutable |
diff --git a/docs/branch-review-records/2ac50f7ddcdaa1190c9965f50d2bd503aa45acffe5c1fd6c10a285564b8465e6.record.md b/docs/branch-review-records/2ac50f7ddcdaa1190c9965f50d2bd503aa45acffe5c1fd6c10a285564b8465e6.record.md
new file mode 100644
index 0000000000..a6cfb879d8
--- /dev/null
+++ b/docs/branch-review-records/2ac50f7ddcdaa1190c9965f50d2bd503aa45acffe5c1fd6c10a285564b8465e6.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/differential-results-ui-20260814 | b19ade499d7fa77b9f8c6b540f9baaf088284b4a | Required base sync through main d301d8f4 | approved | git diff --check; CI scope self-test; ledger and issue guards |
diff --git a/docs/branch-review-records/2cdb103223cd78c8d29b3a26ffae52f385cd5e9fa87be7bbcb0fe5f75c369912.record.md b/docs/branch-review-records/2cdb103223cd78c8d29b3a26ffae52f385cd5e9fa87be7bbcb0fe5f75c369912.record.md
new file mode 100644
index 0000000000..d30dd131a1
--- /dev/null
+++ b/docs/branch-review-records/2cdb103223cd78c8d29b3a26ffae52f385cd5e9fa87be7bbcb0fe5f75c369912.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | PR-1959 | 428fa8772198817e17ef6330c63f7f5e47e090b0 | PR #1959 base-preserving reconciliation review | Required base sync resolved the sole ledger conflict with main: all four inbox requests were already applied upstream; preserved main’s newer #231 evidence and retained the existing immutable historical record. | docs link check passed: 1776 repo path references resolve; Ledger inbox check passed: 12 pending request(s), 138 applied; branch-review-ledger self-test passed; Branch review ledger guard passed: 880 live table records + 1206 archived + 92 immutable; verify:pr-local unavailable: tsx/cli absent from isolated worktree (Node v24.14.0). |
diff --git a/docs/branch-review-records/2f102c68fe61b45d4dbfd9b43a1ca1d14a753cf9a1522a6298f9286d8835adfd.record.md b/docs/branch-review-records/2f102c68fe61b45d4dbfd9b43a1ca1d14a753cf9a1522a6298f9286d8835adfd.record.md
new file mode 100644
index 0000000000..e3d39922ce
--- /dev/null
+++ b/docs/branch-review-records/2f102c68fe61b45d4dbfd9b43a1ca1d14a753cf9a1522a6298f9286d8835adfd.record.md
@@ -0,0 +1 @@
+| 2026-08-16 | codex/chat-search-error-342-search-error-342 | 019281ae9c8a6883737691438feba82117335e14 | PR #2002 universal NDJSON stream error propagation review | Fixed reproducible P2: structured error rejection now cancels an open response body so upstream stream work is released; no P0/P1 findings | Manual adversarial pass; consumer Web Streams harness 4/4; server stream harness 3/3; pre-fix exact-head unit coverage, static checks, SAST and secret scan passed |
diff --git a/docs/branch-review-records/2fed40a238cbd6e5803e25f6c4778648494337db0a6927d4b2f55c077e60c173.record.md b/docs/branch-review-records/2fed40a238cbd6e5803e25f6c4778648494337db0a6927d4b2f55c077e60c173.record.md
new file mode 100644
index 0000000000..306888f4ff
--- /dev/null
+++ b/docs/branch-review-records/2fed40a238cbd6e5803e25f6c4778648494337db0a6927d4b2f55c077e60c173.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/pwa-install-polish-20260815 | 6a1ef9ef020ff41165a9d02245367052a68bd7b3 | PWA mobile root CLS budget remediation | Narrowed install-sheet root-content repositioning from all phone widths to the documented <=359px compact layout, preserving the 320px overflow safeguard while avoiding the confirmed mobile-root shift. | git diff --check; Lighthouse CI log diagnosis: mobile-root CLS +0.105 confirmed in 3/3 samples; local Lighthouse intentionally not run |
diff --git a/docs/branch-review-records/332ea83963cbf2857a64df609c9722ca734364de32bf354d9092762d7a6e4786.record.md b/docs/branch-review-records/332ea83963cbf2857a64df609c9722ca734364de32bf354d9092762d7a6e4786.record.md
new file mode 100644
index 0000000000..f159c6f610
--- /dev/null
+++ b/docs/branch-review-records/332ea83963cbf2857a64df609c9722ca734364de32bf354d9092762d7a6e4786.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | claude/ledger-reconcile-batch-3 | be94fbbb31843f4593783b9ca388ee0526b74e84 | docs/outstanding-issues.md + inbox — reconcile the four rejected-closure corrections | Applied 4 update requests from PR #1957, no cancellations, zero live collisions. #235/#237/#238 now carry the rejected closure, its reason and a Stop rule naming the evidence class; #231 records the probe script and the #1861 adjudication. Row counts unchanged at 99 open/235 archived by design — detail rewrites, not archives. Inbox 0 pending/133 applied. | issues:reconcile --dry-run; verify:pr-local (11 completed, 0 failed); check:ledger-write-discipline |
diff --git a/docs/branch-review-records/34ba441a8c53d4b7eaa2bb5afd846da9722498df625ff9e72b40ac86e0f75fe1.record.md b/docs/branch-review-records/34ba441a8c53d4b7eaa2bb5afd846da9722498df625ff9e72b40ac86e0f75fe1.record.md
new file mode 100644
index 0000000000..fbc7c1149d
--- /dev/null
+++ b/docs/branch-review-records/34ba441a8c53d4b7eaa2bb5afd846da9722498df625ff9e72b40ac86e0f75fe1.record.md
@@ -0,0 +1 @@
+| 2026-08-16 | codex/finalize-tooling-follow-through-documentation | d60649bbc14bfcba72d9f9a2fc65e3eff189bb41 | PR #1994 unblocking review and scope repair | P1 accidental 1035-file scope and stale-base conflict removed; invalid Context7 4.0.2 and nonexistent checklist changes dropped; current ingestion plan retained with safer execution rules; distinct manual adversarial pass completed | GitHub exact-head/tree/compare and contract inspection; official package metadata check; static Markdown and immutable-record validation; local npm gates unavailable without a checkout, deferred to exact-head CI |
diff --git a/docs/branch-review-records/3553393e685f32b5925dc037af832d38d293f56e299993ebe74b56b4ea329756.record.md b/docs/branch-review-records/3553393e685f32b5925dc037af832d38d293f56e299993ebe74b56b4ea329756.record.md
new file mode 100644
index 0000000000..d58f51d417
--- /dev/null
+++ b/docs/branch-review-records/3553393e685f32b5925dc037af832d38d293f56e299993ebe74b56b4ea329756.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | PR #1977 | 4a94fb625c305159425366a7d9f59de4bd96425b | review-and-fix | Verified issue-inbox requests; #293 closure is supported by merged PR #1962, #312 correctly remains open after PR #1965; no new defect; merged latest main | check:outstanding-issues; check:branch-review-ledger; check:ledger-write-discipline; diff-check; manual adversarial review (CodeRabbit rate-limited) |
diff --git a/docs/branch-review-records/35ae4a75db629a7a9ee8b0daf3b933bb51b159fedb9b0e5fce759cb470f06252.record.md b/docs/branch-review-records/35ae4a75db629a7a9ee8b0daf3b933bb51b159fedb9b0e5fce759cb470f06252.record.md
new file mode 100644
index 0000000000..0a36ee596e
--- /dev/null
+++ b/docs/branch-review-records/35ae4a75db629a7a9ee8b0daf3b933bb51b159fedb9b0e5fce759cb470f06252.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/calculators-mode | 1ec9eb1028bf29ac633857846fe69c91249a64c7 | calculator suggestion regression test accessibility and formatting follow-up | Fixed the focused calculator suggestion test to match the full accessible option label; corrected formatter-required nested ternary indentation. Targeted Vitest unavailable because this isolated worktree has no node_modules/vitest. | git diff --check; ledger-inbox; outstanding-issues; branch-review-ledger; ledger-write-discipline; ci-change-scope --self-test |
diff --git a/docs/branch-review-records/365fa9a7353142f52f78e4498f1a4046cd3d1bfd81cd70b816831c3d166119de.record.md b/docs/branch-review-records/365fa9a7353142f52f78e4498f1a4046cd3d1bfd81cd70b816831c3d166119de.record.md
new file mode 100644
index 0000000000..aafb013038
--- /dev/null
+++ b/docs/branch-review-records/365fa9a7353142f52f78e4498f1a4046cd3d1bfd81cd70b816831c3d166119de.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | PR-1962 | c646bcff8d8f5e6fe6bbdd410c5d87471d77ad36 | PR #1962 registry-ready Gate 2 audit fix | Fixed the Gate 2 audit to wait for the Forms tasks region so carrier enumeration cannot stabilise on the loading shell; merged latest main cleanly. | All matched files use Prettier code style; source contract confirms FormsHomePage labels the ready-only region Forms tasks; docs link check passed: 1775 repo path references resolve; Ledger inbox check passed: 23 pending request(s), 138 applied; branch-review-ledger self-test passed; Branch review ledger guard passed: 880 live table records + 1206 archived + 100 immutable; verify:pr-local unavailable: tsx/cli absent from isolated worktree (Node v24.14.0). |
diff --git a/docs/branch-review-records/39058fcc89165e68d1e7359bb28e8b83ea9adacc348db610be6494d50d6bd842.record.md b/docs/branch-review-records/39058fcc89165e68d1e7359bb28e8b83ea9adacc348db610be6494d50d6bd842.record.md
new file mode 100644
index 0000000000..ebbccb96c3
--- /dev/null
+++ b/docs/branch-review-records/39058fcc89165e68d1e7359bb28e8b83ea9adacc348db610be6494d50d6bd842.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | claude/ledger-process-tooling-50uqfc | d36914a79fa4304273429aab0d7f271010f3bb96 | ledger process tooling bundle (#313 dirty-tree gate, 829597d4 merge-loss detector, #211/#168/#258 plans) | PR #1944 — five separate commits, each independently revertible. Two code items: check-ledger-write-discipline.mjs now refuses a verdict while a governed ledger path is dirty (gated on default HEAD so guard-push.mjs explicit --head and clean CI are unaffected); new scripts/audit-merge-loss.mjs advisory blob-comparison sweep, exits 0 and asks for human confirmation, not wired into CI or verify:cheap by design. Three docs-only plans. Found and fixed during build: the shared git() helper trim() was corrupting porcelain status parsing, and JSDoc types were needed to stop TS inferring never[] for the classifier landings parameter. Noted: classifyPullRequestFiles reports operationalRisk true solely from the package.json script entry. | npm run verify:pr-local — 18 gates completed, 1 failed: check:medication-lexicon-report, reproduced identically in a clean detached worktree at origin/main d47aa6d so pre-existing and not caused here; tests/ledger-write-discipline.test.ts 9 passed; tests/merge-loss-audit.test.ts 14 passed; both script self-tests passed; audit:merge-loss --since 6 independently rediscovered the acf78bf casualties #1803/#1800/#1804/#1796/#1811 |
diff --git a/docs/branch-review-records/39296f14956e2712c76344bea1eb1d312c64370049420fc3dd6939b28780721b.record.md b/docs/branch-review-records/39296f14956e2712c76344bea1eb1d312c64370049420fc3dd6939b28780721b.record.md
new file mode 100644
index 0000000000..93f5c28cfb
--- /dev/null
+++ b/docs/branch-review-records/39296f14956e2712c76344bea1eb1d312c64370049420fc3dd6939b28780721b.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | PR-1953 | 5f6ecbd554f91a692965f7f876807d4e9e9c2c26 | PR #1953 full review and required base sync | no PR-introduced P0-P2 defect; existing P2 verified-correct; merged latest main | manual adversarial review; current thread verification; git merge-tree; git diff --check; base-sync native ledger/docs checks; focused Playwright/Next build not run (node_modules absent) |
diff --git a/docs/branch-review-records/3c872a41535a5852133f97afa60a07d554e02ec2055fd40acb890720fbcdd8c3.record.md b/docs/branch-review-records/3c872a41535a5852133f97afa60a07d554e02ec2055fd40acb890720fbcdd8c3.record.md
new file mode 100644
index 0000000000..5d0c4169bd
--- /dev/null
+++ b/docs/branch-review-records/3c872a41535a5852133f97afa60a07d554e02ec2055fd40acb890720fbcdd8c3.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | codex/calculators-mode | 8e7c9d65463ab37bc6e6cd658ec8091b4260db18 | calculators first-class mode | Clean after resolving local-only typeahead and legacy URL normalization | 20/20 focused unit/DOM; typecheck; lint; prior verify:ui 433/433; targeted browser request-interception queued then not run due coordinator contention |
diff --git a/docs/branch-review-records/3d1e296045909c10383c715b1abaa9ee7348002139c4d9b8ead0b7bfb6c1c548.record.md b/docs/branch-review-records/3d1e296045909c10383c715b1abaa9ee7348002139c4d9b8ead0b7bfb6c1c548.record.md
new file mode 100644
index 0000000000..07e2616ff7
--- /dev/null
+++ b/docs/branch-review-records/3d1e296045909c10383c715b1abaa9ee7348002139c4d9b8ead0b7bfb6c1c548.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | codex/visual-layout-polish | 63195ba3f145a08691151ed4e86c69f5d05db486 | PR #1949 review-and-fix | reviewed PWA decoding hint and desktop CLS attribution; no PR-introduced defect found; merged latest main | offline: git diff --check; check-outstanding-issues; ledger-inbox check; ledger-write-discipline; Prettier changed files; targeted Vitest unavailable (isolated worktree has no node_modules); independent manual adversarial pass |
diff --git a/docs/branch-review-records/3d45d96c0c8e97d835c1a3f6c12b320255c0164dc545dce172e67703b2be6fda.record.md b/docs/branch-review-records/3d45d96c0c8e97d835c1a3f6c12b320255c0164dc545dce172e67703b2be6fda.record.md
new file mode 100644
index 0000000000..9a3057fb96
--- /dev/null
+++ b/docs/branch-review-records/3d45d96c0c8e97d835c1a3f6c12b320255c0164dc545dce172e67703b2be6fda.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | claude/rag-zod-hardening-tranche1 | 1fb98a174e815ce2d7e105d9339d766d3f54b02b | PR #1946 review-and-fix | fixed PR-introduced maintainability blocker; strengthened retrieval provenance and visual shape validation; merged latest main | offline: git diff --check; Prettier changed files; check:maintainability-budgets; branch-review-ledger; ledger-write-discipline; docs:check-links; CI pending |
diff --git a/docs/branch-review-records/3dc49fdd6e24d09e3e6830eb12934c340fc3a9008650b6c058d34bd4d87a2afe.record.md b/docs/branch-review-records/3dc49fdd6e24d09e3e6830eb12934c340fc3a9008650b6c058d34bd4d87a2afe.record.md
new file mode 100644
index 0000000000..ff090cc29d
--- /dev/null
+++ b/docs/branch-review-records/3dc49fdd6e24d09e3e6830eb12934c340fc3a9008650b6c058d34bd4d87a2afe.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/fix-ecg-animation-on-mobile-devices | 4c789e7449613bbae0701610414214586fee177a | ECG SVG repaint on Mobile WebKit | Confirmed the focused WebKit paint-containment correction; no additional P0-P2 findings. Merged the latest required base. | git diff --check; ledger inbox/outstanding-issues/branch-ledger/discipline guards; direct ECG CSS regression assertion; focused Vitest attempted but unavailable because the isolated worktree has no node_modules |
diff --git a/docs/branch-review-records/3e31711658b047a477e82af444f00d88be075d7400770fbb25654628610cda51.record.md b/docs/branch-review-records/3e31711658b047a477e82af444f00d88be075d7400770fbb25654628610cda51.record.md
new file mode 100644
index 0000000000..8d6801530c
--- /dev/null
+++ b/docs/branch-review-records/3e31711658b047a477e82af444f00d88be075d7400770fbb25654628610cda51.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | codex/medication-info-header-20260814 | 4525fe42f74b7f16bb762d953d82e1ce7540bb76 | medication information header expansion and desktop polish | No P0-P2 findings; ready for PR handoff | DOM 38/38 and focused Chromium 1/1 passed; PR-local runtime, lock parity, formatting, and lint passed; remaining aggregate stages blocked by shared test-run contention |
diff --git a/docs/branch-review-records/3fbcef2b507598e6baa40944420519cc84a4cee33bf9c809091f21ed28f76192.record.md b/docs/branch-review-records/3fbcef2b507598e6baa40944420519cc84a4cee33bf9c809091f21ed28f76192.record.md
new file mode 100644
index 0000000000..2ab488d9f5
--- /dev/null
+++ b/docs/branch-review-records/3fbcef2b507598e6baa40944420519cc84a4cee33bf9c809091f21ed28f76192.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/services-search-redesign-163 | f9391318605f4a2cf743cc7a6b3448b61a8296d4 | Services search results: progressive referral rail, compact rows, favourites bookmark (#163) | Shipped; row re-measured as half-stale before building — no P0-P2 findings | verify:pr-local all 10 selected gates passed (runtime, lock parity, format:changed, lint, typecheck, test, build, rag fixtures, medication interactions, lexicon report); focused vitest 22/22 across services scope-empty-state, services regressions audit, band adoption, route reachability; check:design-system-contract passed at 25 edge conflicts unchanged; UI delegated to CI Production UI — chromium-1194 vs pinned 1234 (#255/#312) |
diff --git a/docs/branch-review-records/40b0c05db4e9b44c17bc78bb0246cd15d4f72e244027e5a389bee78924c450cf.record.md b/docs/branch-review-records/40b0c05db4e9b44c17bc78bb0246cd15d4f72e244027e5a389bee78924c450cf.record.md
new file mode 100644
index 0000000000..97d483cf69
--- /dev/null
+++ b/docs/branch-review-records/40b0c05db4e9b44c17bc78bb0246cd15d4f72e244027e5a389bee78924c450cf.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | PR-1953 | 98b7458ba7ef4cecc5b5f5747deccf6adbab0480 | scripts/run-playwright.mjs; docs/branch-review-records | no PR-introduced P0-P2 defect; corrected prior local-only merge record and merged latest main | manual adversarial review; current thread verification; git merge-tree; git diff --check; docs links; ledger inbox; ledger guards; focused Playwright/Next build unavailable (node_modules absent) |
diff --git a/docs/branch-review-records/417c3d2bbb8346fc650dc4bed9db149912fc13abb7aaf5fc9d7e6f75a3db0fa1.record.md b/docs/branch-review-records/417c3d2bbb8346fc650dc4bed9db149912fc13abb7aaf5fc9d7e6f75a3db0fa1.record.md
new file mode 100644
index 0000000000..a09aba63e7
--- /dev/null
+++ b/docs/branch-review-records/417c3d2bbb8346fc650dc4bed9db149912fc13abb7aaf5fc9d7e6f75a3db0fa1.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/fix-ecg-animation-on-mobile-devices | d4662baa81ba738b2278f624f213db416fde95a5 | review-and-fix | Merged latest main, resolved the CSS-test conflict, and fixed the WebKit late-notice test race | Focused Vitest 2/2; design-system contract; changed-file ESLint; typecheck; Prettier; branch-review, outstanding-issues, ledger-discipline and final-merge audit. Browser/provider gates not run locally. |
diff --git a/docs/branch-review-records/4405a36b7fedb006b4f8a9947a9e66aec8589e5a59de4871bbab616ad8a91c5c.record.md b/docs/branch-review-records/4405a36b7fedb006b4f8a9947a9e66aec8589e5a59de4871bbab616ad8a91c5c.record.md
new file mode 100644
index 0000000000..fd098b9254
--- /dev/null
+++ b/docs/branch-review-records/4405a36b7fedb006b4f8a9947a9e66aec8589e5a59de4871bbab616ad8a91c5c.record.md
@@ -0,0 +1 @@
+| 2026-08-17 | PR (branch claude/p1-ledger-324-318-316-xag5sy, #324 follow-up) | 91d3ccfcef79f02c140141eb560f941626039443 | scripts/audit-merge-loss.mjs + tests/merge-loss-audit.test.ts + one #324 inbox request (1d35d652); advisory only, no CI wiring, no schedule, exit code behaviour unchanged | Authored handoff, owner-approved scope (tab fix + mechanism classifier only). Fixed a defect that had disabled the reconciliation exemption since it was written: treeEntryReader split ls-tree on a literal backslash-t instead of a tab, keeping the path on the entry, so the cross-path inbox-to-applied comparison could never match. 14-day window before/after: 51 findings / 255 flagged files / filesExempted 0 -> 11 findings / 66 flagged / 189 exempted. Escaped originally because all tests injected entryAt directly; closed by extracting parseTreeEntry and testing it against real ls-tree output. Added classifyRemoval, which blames the oldest commit whose tree entry already matches the pre-landing entry and reports merge-resolution vs deliberate-commit vs unknown, sorting merge-resolution first. Over the window 14 of 66 flagged files were merge-resolution (13 from acf78bf) and all 52 others had explanatory single-parent subjects. Re-verified three genuine unrepaired losses against current main: #1800 (wiring and all three tests gone), #1804 (also-matches back in forms, guards reverted, apparently untracked), #1796 (Node 26 allowance gone, apparently untracked). The (a) schedule, (b) triage-owner and (c) one-tool-vs-two decisions remain OPEN and were deliberately not implemented; nothing was made blocking and no finding is auto-closed. | verify:pr-local executable scope, 9 checks completed, failed: (none) - lint, typecheck, full unit suite, check:rag:fixtures, check:medication-interactions, check:medication-lexicon-report. Focused tests/merge-loss-audit.test.ts 29 passed (was 16). Mutation-verified three ways: backslash-t reintroduction fails 3 tests + self-test; newest-first walk fails the blame-the-oldest test; unknown-as-deliberate fails 2 tests. verify:ui NOT run - Playwright chromium-1194 vs pinned 1234 (#255/#312) fails closed in this container; no browser coverage claimed and none needed for a non-UI script. |
diff --git a/docs/branch-review-records/44c2668e0a184a3856e8f614a4358bb33d033ffc179a15ef4b69248c4df83669.record.md b/docs/branch-review-records/44c2668e0a184a3856e8f614a4358bb33d033ffc179a15ef4b69248c4df83669.record.md
new file mode 100644
index 0000000000..c391fcd9bb
--- /dev/null
+++ b/docs/branch-review-records/44c2668e0a184a3856e8f614a4358bb33d033ffc179a15ef4b69248c4df83669.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/db-remediation-phase-0-wfaiyl | f390d6cd5faddd8b30320f60a082374688dc1f71 | Ledger reconciliation and push guard: final current-base merge | Verified parallel-cancellation and rewritten-history handling with isolated Git reproductions; merged latest required base with no conflicts or new P0-P2 findings | git diff --check; ledger-inbox self-test; ineffective-cancellation assertion; rewritten-history guard assertion; ledger-inbox; outstanding-issues; branch-review-ledger; ledger-write-discipline |
diff --git a/docs/branch-review-records/4575cff3b5b7591de309f5e375293bda952b5d8479ef56a45808b8fda27bba37.record.md b/docs/branch-review-records/4575cff3b5b7591de309f5e375293bda952b5d8479ef56a45808b8fda27bba37.record.md
new file mode 100644
index 0000000000..aeba78275e
--- /dev/null
+++ b/docs/branch-review-records/4575cff3b5b7591de309f5e375293bda952b5d8479ef56a45808b8fda27bba37.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | claude/ledger-process-tooling-50uqfc | d7adf35c18f6f23d9585d9442a0da99e7c90192b | PR #1944 review-and-fix | Fixed five validated P2 findings | audit self-test, targeted classifier probes, JSON parse, ledger and docs guards; Vitest unavailable: npm ci package downloads corrupted |
diff --git a/docs/branch-review-records/4859907cc6069250fcef7f0156490f1e04d0fd60e25fab0edbf33408b720efa9.record.md b/docs/branch-review-records/4859907cc6069250fcef7f0156490f1e04d0fd60e25fab0edbf33408b720efa9.record.md
new file mode 100644
index 0000000000..f1e78ee19b
--- /dev/null
+++ b/docs/branch-review-records/4859907cc6069250fcef7f0156490f1e04d0fd60e25fab0edbf33408b720efa9.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | claude/correct-rejected-closures | e4372b5b4e1e382ec28b79e326a0ae1f2a9901ba | docs/outstanding-issues-inbox — corrections for rejected closures and stale #231 | Queued 4 update requests. #235/#237/#238 record the rejected closure, its reason, and a Stop rule naming the evidence class that must not be reused; all three drop the stale IN FLIGHT prefix (PRs #1841/#1842 merged). #231 records that scripts/probe-generation-quality.ts now exists (a3bc4da) and PR #1861 was adjudicated superseded for phase 1, so the row no longer asks for an instrument that exists. | verify:pr-local (11 completed, 0 failed; first run correctly failed check:ledger-write-discipline on uncommitted edits) |
diff --git a/docs/branch-review-records/497a7b26ad6568692b3dbc9e939c1e7d35a1a50108e2c0268cbf41ee612eaa76.record.md b/docs/branch-review-records/497a7b26ad6568692b3dbc9e939c1e7d35a1a50108e2c0268cbf41ee612eaa76.record.md
new file mode 100644
index 0000000000..015bde1bc4
--- /dev/null
+++ b/docs/branch-review-records/497a7b26ad6568692b3dbc9e939c1e7d35a1a50108e2c0268cbf41ee612eaa76.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/pwa-install-polish-20260815 | c6d8c2829ddd2fc52441a3696aed56fbd0262917 | required base sync through main 17402395 | Approved — required main update merged; prior PWA lifecycle review and style-inventory repair remain applicable with no PR-path conflict | git diff --check; ci-change-scope self-test; ledger/inbox/outstanding/discipline guards passed |
diff --git a/docs/branch-review-records/4a51a80a457f85c939048278f01e3a3059d5509bfd975096af94b63ef16e825a.record.md b/docs/branch-review-records/4a51a80a457f85c939048278f01e3a3059d5509bfd975096af94b63ef16e825a.record.md
new file mode 100644
index 0000000000..1812f5505d
--- /dev/null
+++ b/docs/branch-review-records/4a51a80a457f85c939048278f01e3a3059d5509bfd975096af94b63ef16e825a.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/pwa-install-polish-20260815 | 80fd6c04afdfa30e92c1cdf2ea5ba9d3d32a02c6 | PWA style-contract formatter follow-up | Formatted the PWA style-contract exemption entries reported by changed-file formatting. Targeted registry test unavailable because this isolated worktree has no node_modules/vitest; Lighthouse was not run locally by instruction. | node --check tests/helpers/style-contracts.ts; git diff --check; ledger-inbox; outstanding-issues; branch-review-ledger; ledger-write-discipline; ci-change-scope --self-test |
diff --git a/docs/branch-review-records/4a8002d2aa8743b62a8189f3bd3621768458290b624c6b506f6fd403ad8157c0.record.md b/docs/branch-review-records/4a8002d2aa8743b62a8189f3bd3621768458290b624c6b506f6fd403ad8157c0.record.md
new file mode 100644
index 0000000000..bb31036135
--- /dev/null
+++ b/docs/branch-review-records/4a8002d2aa8743b62a8189f3bd3621768458290b624c6b506f6fd403ad8157c0.record.md
@@ -0,0 +1 @@
+| 2026-08-16 | codex/account-setup-polish-20260814 | 25a7a7ba980aaf1f99a22969d74971a496373d98 | PR #1997 Services quick-search removal | P1 scope contamination and conflicts confirmed; intended quick-search removal was already superseded by merged PR #1996; branch reconciled to latest main without retaining obsolete UI regressions | Exact-head static and build checks passed; production UI shards and unit coverage exposed stale cross-feature regressions; merged PR #1996 had 69/69 focused units, 4/4 focused Chromium scenarios, typecheck and build passing; final code tree matched main |
diff --git a/docs/branch-review-records/4dbb7f7d041801dbdbfb1360d45e46027a5b3debdb029af744345900ca5acdc1.record.md b/docs/branch-review-records/4dbb7f7d041801dbdbfb1360d45e46027a5b3debdb029af744345900ca5acdc1.record.md
new file mode 100644
index 0000000000..4fa0ca2682
--- /dev/null
+++ b/docs/branch-review-records/4dbb7f7d041801dbdbfb1360d45e46027a5b3debdb029af744345900ca5acdc1.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/calculators-mode | d8fde21e65ce010b72bc56f1e57334cdfac764c5 | required base sync through main 17402395 | Approved — required main update merged; prior calculator-mode review remains applicable with no PR-path conflict | git diff --check; ci-change-scope self-test; ledger/inbox/outstanding/discipline guards passed |
diff --git a/docs/branch-review-records/4e9b4d92a67f8938115ff0ea2b99458078ba349cd9e9f625efb537215cbf1227.record.md b/docs/branch-review-records/4e9b4d92a67f8938115ff0ea2b99458078ba349cd9e9f625efb537215cbf1227.record.md
new file mode 100644
index 0000000000..abb7f83e30
--- /dev/null
+++ b/docs/branch-review-records/4e9b4d92a67f8938115ff0ea2b99458078ba349cd9e9f625efb537215cbf1227.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | PR #1968 / claude/ledger-reconcile-batch-4 | 31cd550141e66806e53ade04965151b960964c6d | unblocking PR review-and-fix | Merged the latest base and reconciled its complete ledger batch; retained the #316 headline correction as a valid next-transaction request. | ledger write discipline; ledger inbox dry-run/check; outstanding-issues; branch-review-ledger; diff --check |
diff --git a/docs/branch-review-records/51a91c30aac9b44f7a14db23c3b96cf23b0b76a4bfd1cd9b2c9052dca555bc08.record.md b/docs/branch-review-records/51a91c30aac9b44f7a14db23c3b96cf23b0b76a4bfd1cd9b2c9052dca555bc08.record.md
new file mode 100644
index 0000000000..e33b5fe1d8
--- /dev/null
+++ b/docs/branch-review-records/51a91c30aac9b44f7a14db23c3b96cf23b0b76a4bfd1cd9b2c9052dca555bc08.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/fix-documents-without-live-images | 3aad3e221fc146560578c8d78135435550f73166 | Required base sync through main d301d8f4 | approved | git diff --check; script syntax; ledger and issue guards |
diff --git a/docs/branch-review-records/522436cc75e96c3d5ec24c4ed5206978ed6cc3c4e988daa2a9d1d5165c4a8e2e.record.md b/docs/branch-review-records/522436cc75e96c3d5ec24c4ed5206978ed6cc3c4e988daa2a9d1d5165c4a8e2e.record.md
new file mode 100644
index 0000000000..cd6ba3605e
--- /dev/null
+++ b/docs/branch-review-records/522436cc75e96c3d5ec24c4ed5206978ed6cc3c4e988daa2a9d1d5165c4a8e2e.record.md
@@ -0,0 +1 @@
+| 2026-08-16 | PR-2008 / codex/tools-show-all-20260816 | 008093943c407a3caaac65d49d5c8e80de552ef0 | PR #2008 latest-base refresh after green exact-head CI | Merged main fb8c71c94f8a45028df36aa669e3653c4f75cd2a; its durable ULID/Crockford outstanding-issues tooling and related tests, docs, and hooks do not overlap this PR's launcher or focused UI regression; no new P0/P1/P2 defects confirmed | Exact-head PR required, static, build, unit, production UI, critical UI, advisory UI, CI-managed Lighthouse budget, SAST, and secret scans passed at 99592cad854c205b2626f4d5a001956ef6e13b8f; 3f33068da16ef8a3235359ff974c9314cf79d758-to-fb8c71c94f8a45028df36aa669e3653c4f75cd2a compare reviewed; clean non-overlapping merge-tree construction |
diff --git a/docs/branch-review-records/534a1703b8963c66fe43de4889cf3f33e6bc83a7ebc8734fba8c6c71148e0d6f.record.md b/docs/branch-review-records/534a1703b8963c66fe43de4889cf3f33e6bc83a7ebc8734fba8c6c71148e0d6f.record.md
new file mode 100644
index 0000000000..1d9d2361b4
--- /dev/null
+++ b/docs/branch-review-records/534a1703b8963c66fe43de4889cf3f33e6bc83a7ebc8734fba8c6c71148e0d6f.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/pwa-install-polish-20260815 | aa041fd15f902dce172ea0d2707f3f81cb8f160c | PWA install lifecycle: final current-base merge | Merged latest required base after validated PWA registry fix; no merge conflicts | git diff --check; ledger-inbox; outstanding-issues; branch-review-ledger; ledger-write-discipline; static PWA registry assertion |
diff --git a/docs/branch-review-records/55297ab0e355af3fbf69ae0321defbaa0a097a15f8fb74a52623abe427f21421.record.md b/docs/branch-review-records/55297ab0e355af3fbf69ae0321defbaa0a097a15f8fb74a52623abe427f21421.record.md
new file mode 100644
index 0000000000..8aca52a899
--- /dev/null
+++ b/docs/branch-review-records/55297ab0e355af3fbf69ae0321defbaa0a097a15f8fb74a52623abe427f21421.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | PR #1966 | 5f5d4d141d07753b5c3882e65c0dea5de0a68804 | completed-PR ledger queue | fixed | Prettier JSON; ledger inbox check; outstanding-issues guard; ledger write discipline; independent Codex adversarial review: #098 false completion removed; stale #210/#215 corrections superseded |
diff --git a/docs/branch-review-records/5bffd23d66a7e2f1ef7b6b9a3b4188835f16432fe3243bb89a199885f6a09730.record.md b/docs/branch-review-records/5bffd23d66a7e2f1ef7b6b9a3b4188835f16432fe3243bb89a199885f6a09730.record.md
new file mode 100644
index 0000000000..18c329c702
--- /dev/null
+++ b/docs/branch-review-records/5bffd23d66a7e2f1ef7b6b9a3b4188835f16432fe3243bb89a199885f6a09730.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | PR #1968 / claude/ledger-reconcile-batch-4 | 0a49842ccf12ea4508533b43bb0b7d7a2086eac6 | unblocking PR review-and-fix | Synced current main and reconciled the base inbox; queued the verified #316 headline correction for the next serialized transaction. | ledger inbox dry-run/check; outstanding-issues and ledger write-discipline checks; diff --check (npm setup blocked by sandbox cache) |
diff --git a/docs/branch-review-records/5c0ac2f4e15f46fb39e8fd09c38c3cc169be8ad8f8459b70b86140a155a88967.record.md b/docs/branch-review-records/5c0ac2f4e15f46fb39e8fd09c38c3cc169be8ad8f8459b70b86140a155a88967.record.md
new file mode 100644
index 0000000000..19f50bb0e6
--- /dev/null
+++ b/docs/branch-review-records/5c0ac2f4e15f46fb39e8fd09c38c3cc169be8ad8f8459b70b86140a155a88967.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/calculators-mode | ff3dfa4e32e63ccf288438a6371608b42847c18e | calculator search-chrome documentation formatter follow-up | Aligned the search-chrome ownership table to the new longest mode label after the changed-file formatter reported Markdown table drift. | git diff --check; ledger-inbox; outstanding-issues; branch-review-ledger; ledger-write-discipline; ci-change-scope --self-test |
diff --git a/docs/branch-review-records/5dfd91a1c7b294fec5c2fca7834a9812e9c3055ed0b3a5f9f139a838dc8c1c2d.record.md b/docs/branch-review-records/5dfd91a1c7b294fec5c2fca7834a9812e9c3055ed0b3a5f9f139a838dc8c1c2d.record.md
new file mode 100644
index 0000000000..a08eb61655
--- /dev/null
+++ b/docs/branch-review-records/5dfd91a1c7b294fec5c2fca7834a9812e9c3055ed0b3a5f9f139a838dc8c1c2d.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | PR-1958 | d74f208924b9b5ed3a5314b29018a727f1e84b69 | PR #1958 final current-base sync | Merged the current main after the Tools-directory review; preserved the combined shared-test resolution and left a clean merge tree. | docs link check passed: 1775 repo path references resolve; Ledger inbox check passed: 23 pending request(s), 138 applied; branch-review-ledger self-test passed; Branch review ledger guard passed: 880 live table records + 1206 archived + 102 immutable; prior exact-head CI was green; current exact-head CI is pending; dependency-backed local UI checks unavailable in isolated worktree. |
diff --git a/docs/branch-review-records/5fb194b68baa840377fcf801664fdbe23fe39d02317237fbe8fe7ab43f8a459d.record.md b/docs/branch-review-records/5fb194b68baa840377fcf801664fdbe23fe39d02317237fbe8fe7ab43f8a459d.record.md
new file mode 100644
index 0000000000..5912e5cd7a
--- /dev/null
+++ b/docs/branch-review-records/5fb194b68baa840377fcf801664fdbe23fe39d02317237fbe8fe7ab43f8a459d.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/capture-ongoing-drop-question | d40e89ebb7a77f589683a6a6244fdcb84ad4c4af | Withdraw unsupported index-loss P1 after exact Action-log set comparison; merge main | fixed | git diff --check; ledger and issue guards |
diff --git a/docs/branch-review-records/60422ff1c15e4237b0b0d3028b47dde0cd7d2e44c4b79c2badd5c8be19153682.record.md b/docs/branch-review-records/60422ff1c15e4237b0b0d3028b47dde0cd7d2e44c4b79c2badd5c8be19153682.record.md
new file mode 100644
index 0000000000..9c62fd4350
--- /dev/null
+++ b/docs/branch-review-records/60422ff1c15e4237b0b0d3028b47dde0cd7d2e44c4b79c2badd5c8be19153682.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/services-search-redesign-163 | d007d4a11a0d7b52283fe0088583259ef27c0264 | Services bookmark readiness — correcting the 216a72e4 record | PRIOR RECORD WAS FALSE. Record 216a72e4 claimed 'Fix service bookmark readiness and mutation race' at head 720e7027a9f08e518eb6344e74dfde35d78d5981. That object does not exist in this repository (git cat-file fails; not an ancestor of the branch) and src/components/services/ was byte-identical between 285e12d3c939 and the then-remote tip 87e7fcc2 — no fix had landed. The named defect was real and is fixed here instead | git cat-file -t on the claimed head: object does not exist; git diff 285e12d..87e7fcc2 -- src/components/services/: empty; new DOM regression test mutation-verified (reverting the gate fails it); focused vitest 12/12; typecheck clean |
diff --git a/docs/branch-review-records/60f458bc7e118a4c0f36e12b0294e651372309f02b547300fa7ca6426587d82c.record.md b/docs/branch-review-records/60f458bc7e118a4c0f36e12b0294e651372309f02b547300fa7ca6426587d82c.record.md
new file mode 100644
index 0000000000..e037df2b02
--- /dev/null
+++ b/docs/branch-review-records/60f458bc7e118a4c0f36e12b0294e651372309f02b547300fa7ca6426587d82c.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/rag-zod-hardening-tranche2 | 18253c2bc555d424e83f987712cf528dd3910e3f | Carry validated optional RAG signal degradation fix through main d301d8f4 | fixed | git diff --check; static RAG contract inspection; ledger and issue guards; tests blocked without node_modules |
diff --git a/docs/branch-review-records/615deb9148ec106e31cf72902d4a1b2710987b3597aeef62b9a2fb964975dd5b.record.md b/docs/branch-review-records/615deb9148ec106e31cf72902d4a1b2710987b3597aeef62b9a2fb964975dd5b.record.md
new file mode 100644
index 0000000000..6a5b00ae82
--- /dev/null
+++ b/docs/branch-review-records/615deb9148ec106e31cf72902d4a1b2710987b3597aeef62b9a2fb964975dd5b.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | 1976 | 54327591bb89f6f9f25f6834fbefc277a9bff80b | review-and-fix | P2 fixed: native install prompt now avoids hero reflow, composer overlap, and prompt-induced CLS | pwa DOM 10/10; PWA Chromium 5/5; format; exact-head merge-tree |
diff --git a/docs/branch-review-records/61a53ca459551a7a2ca43dee60a4d50a4f04840076dfbb4f79fa55ab14605d71.record.md b/docs/branch-review-records/61a53ca459551a7a2ca43dee60a4d50a4f04840076dfbb4f79fa55ab14605d71.record.md
new file mode 100644
index 0000000000..5f4b04d53c
--- /dev/null
+++ b/docs/branch-review-records/61a53ca459551a7a2ca43dee60a4d50a4f04840076dfbb4f79fa55ab14605d71.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/capture-ongoing-drop-question | 367ef8e1414a3ebf81102884fa48298f16068093 | docs/outstanding-issues-inbox — capture the unreconciled drift count | Queued one P1 add request: check:drift reported missing_live 21 (2026-08-09) then 20 (2026-08-14) despite two indexes being restored between, so the expected figure was 19; the gap is consistent with an ongoing drop mechanism. Recorded as inference not fact. Carries a stop rule against beginning the restoration window until resolved. Filed as add rather than a #316 update to avoid colliding with the #316 update already queued in PR #1970. | verify:pr-local (11 completed, 0 failed) |
diff --git a/docs/branch-review-records/63bb22a3ea42c41966caaa63a61b73a2bba0026f0898a8f6e3afae6123075fce.record.md b/docs/branch-review-records/63bb22a3ea42c41966caaa63a61b73a2bba0026f0898a8f6e3afae6123075fce.record.md
new file mode 100644
index 0000000000..2162c854bd
--- /dev/null
+++ b/docs/branch-review-records/63bb22a3ea42c41966caaa63a61b73a2bba0026f0898a8f6e3afae6123075fce.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/pwa-install-polish-20260815 | 80fd6c04afdfa30e92c1cdf2ea5ba9d3d32a02c6 | PR #1976 PWA exemption formatter follow-up | Corrected two exemption descriptions that were under the 120-column formatter width and must remain single-line properties. | git diff --check; ledger/outstanding/branch-ledger/ledger-discipline guards; ci-change-scope self-test passed; npm test -- tests/style-contract-registry.test.ts unavailable: node_modules/vitest/vitest.mjs absent. |
diff --git a/docs/branch-review-records/642a0ca61b346fbb0b4dd8bda07b9e763f3acdf9d7d26bff9e0017e1cdd58c60.record.md b/docs/branch-review-records/642a0ca61b346fbb0b4dd8bda07b9e763f3acdf9d7d26bff9e0017e1cdd58c60.record.md
new file mode 100644
index 0000000000..9067dc948b
--- /dev/null
+++ b/docs/branch-review-records/642a0ca61b346fbb0b4dd8bda07b9e763f3acdf9d7d26bff9e0017e1cdd58c60.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/test-source-contract-hardening | 22aa7c627e4d3ce220c741d4246d998956249fd2 | Guarded source-slice test windows: shared helper plus three migrations (#1985) | Shipped; closes a silent-pass class in the contract tests, remainder queued | verify:pr-local all 9 selected gates passed — unit suite 6608 passed / 4 skipped; helper's own test pins the raw idiom returning out-of-window content; migrated files re-run green (17/17, 23/23) |
diff --git a/docs/branch-review-records/652d642c8900c600dd0d8e9f229c6c9f3d2e2d2709bee0f3d2e35384751e8358.record.md b/docs/branch-review-records/652d642c8900c600dd0d8e9f229c6c9f3d2e2d2709bee0f3d2e35384751e8358.record.md
new file mode 100644
index 0000000000..8966365449
--- /dev/null
+++ b/docs/branch-review-records/652d642c8900c600dd0d8e9f229c6c9f3d2e2d2709bee0f3d2e35384751e8358.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | PR #1968 / claude/ledger-reconcile-batch-4 | 10beb5ea191043e3c425aa7ff32533e93e9f68de | unblocking PR review-and-fix | Fixed #316 forensic-bound and inventory correction through the serialized ledger queue; merged current main cleanly. | ledger-inbox and outstanding-issues self-tests plus checks; ledger write discipline; diff --check (npm 11.17 setup blocked by sandbox cache) |
diff --git a/docs/branch-review-records/65bf63ffd245181d054f30ee9fc24f16ca83af0e52d784bb3860e470876e1e75.record.md b/docs/branch-review-records/65bf63ffd245181d054f30ee9fc24f16ca83af0e52d784bb3860e470876e1e75.record.md
new file mode 100644
index 0000000000..56117f05a0
--- /dev/null
+++ b/docs/branch-review-records/65bf63ffd245181d054f30ee9fc24f16ca83af0e52d784bb3860e470876e1e75.record.md
@@ -0,0 +1 @@
+| 2026-08-16 | PR-2000 / codex/chat-ledger-programme-ledger-programme | 3b544399aa4129c03e3362a16123f9cc9dfc84a3 | PR #2000 post-fix base refresh review | Required base refresh to 27f6b60429ab56a0e4a779b5b16c35e9cce630db reviewed; the base delta added only two unrelated branch-review records, a registry service-facets test, and an edge-ingestion planning document, with no overlap with this PR's outstanding-issue requests; the #098 correction remains valid | PR required, SAST, and secret scan passed at 3b544399aa4129c03e3362a16123f9cc9dfc84a3; fd3a100b9ad0d4c806c7083d01cb3a0bed601646-to-27f6b60429ab56a0e4a779b5b16c35e9cce630db compare reviewed; merge-tree verification |
diff --git a/docs/branch-review-records/667079dd07cd03821a2d3b2ec65a1d04508df0c95fc85014b6cc6546b765bf32.record.md b/docs/branch-review-records/667079dd07cd03821a2d3b2ec65a1d04508df0c95fc85014b6cc6546b765bf32.record.md
new file mode 100644
index 0000000000..4e51427bb0
--- /dev/null
+++ b/docs/branch-review-records/667079dd07cd03821a2d3b2ec65a1d04508df0c95fc85014b6cc6546b765bf32.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | PR #1969 / codex/medication-list-spacing-20260814 | 347125d4313a7517f051c1b26fc0873b7bff10f0 | unblocking PR review-and-fix | Fixed the 1024px desktop prescribing-grid clipping with a focused right-edge regression assertion; merged current main cleanly. | grid footprint contract (676px <= 876px); diff --check (Playwright unavailable: isolated worktree has no dependencies) |
diff --git a/docs/branch-review-records/6897c4836aee66827e7eec71bfa16917161e501d15805774b5446fb4c393d383.record.md b/docs/branch-review-records/6897c4836aee66827e7eec71bfa16917161e501d15805774b5446fb4c393d383.record.md
new file mode 100644
index 0000000000..fd6bdf63b3
--- /dev/null
+++ b/docs/branch-review-records/6897c4836aee66827e7eec71bfa16917161e501d15805774b5446fb4c393d383.record.md
@@ -0,0 +1 @@
+| 2026-08-16 | codex/chat-trust-boundaries-212-trust-boundaries-212 | f3b55e8555614bffff2eb335b95d342b40960b6c | PR #2003 unblocking review and base synchronization | No confirmed P0-P2 PR-introduced defects; fail-closed list parsing, generic public errors, ownership redaction, and JSON-shape contracts validated; latest main merged without conflicts; distinct manual adversarial pass completed | Exact-head f3b55e85 CI, PR required, static checks, unit coverage, build, lint, typecheck, safety/config, SAST, and secret scan passed; local npm gates unavailable without a checkout; final base-sync head requires CI rerun |
diff --git a/docs/branch-review-records/68deea2b69f60f4b52bdea24ceb748ddac6c21d3d7912bc77caa5deda23aefea.record.md b/docs/branch-review-records/68deea2b69f60f4b52bdea24ceb748ddac6c21d3d7912bc77caa5deda23aefea.record.md
new file mode 100644
index 0000000000..271ae6a0e0
--- /dev/null
+++ b/docs/branch-review-records/68deea2b69f60f4b52bdea24ceb748ddac6c21d3d7912bc77caa5deda23aefea.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/ledger-review-triage-yi63ao | 6cd9a8547714543aee7b6864c2b7c427309bc4c2 | PR #1977 base sync | Merged main 6f7b7deefaf7e0cd062b748f18fc6ca8988093f6 into the reviewed PR head; merge tree was clean. | git merge-tree --write-tree exact-head main: clean; git diff --check; ledger guards. |
diff --git a/docs/branch-review-records/6c6404a8a018cff566a2b0f00c17f87c45206350cff5c6bf2f3b86690f27c5d7.record.md b/docs/branch-review-records/6c6404a8a018cff566a2b0f00c17f87c45206350cff5c6bf2f3b86690f27c5d7.record.md
new file mode 100644
index 0000000000..8beb6e1240
--- /dev/null
+++ b/docs/branch-review-records/6c6404a8a018cff566a2b0f00c17f87c45206350cff5c6bf2f3b86690f27c5d7.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | codex/visual-layout-polish | 7490ac090fc1577c72bbf5db943126b1ceb47770 | PR #1949 CLS ledger corrective review and base-current verification | fixed the confirmed issue-update overwrite of canonical CLS measurement and stop conditions; no other high-confidence PR defect found | offline: JSON parse; ledger update semantic assertion; check-outstanding-issues; ledger-write-discipline self-test; git diff --check; manual adversarial pass |
diff --git a/docs/branch-review-records/6edbc14cf38b74d61a02ebdd3bb7c5114b56cfb2c711ec548b6aeea715b05c9f.record.md b/docs/branch-review-records/6edbc14cf38b74d61a02ebdd3bb7c5114b56cfb2c711ec548b6aeea715b05c9f.record.md
new file mode 100644
index 0000000000..bdf06e150b
--- /dev/null
+++ b/docs/branch-review-records/6edbc14cf38b74d61a02ebdd3bb7c5114b56cfb2c711ec548b6aeea715b05c9f.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/fix-documents-without-live-images | 31bf9b5855c0e7cc903a3e186f3bf785d41cc210 | Document cover audit and repair: final current-base merge | Merged latest required base after prior focused repair review; no conflicts or new confirmed P0-P2 findings | git diff --check; ledger-inbox; outstanding-issues; branch-review-ledger; ledger-write-discipline; archived cover-script syntax and generation-guard assertions |
diff --git a/docs/branch-review-records/6f2e5ab42932b76f6bc1f9e99c44558ad9edbfec91f1f75fd8ba007bdd90d979.record.md b/docs/branch-review-records/6f2e5ab42932b76f6bc1f9e99c44558ad9edbfec91f1f75fd8ba007bdd90d979.record.md
new file mode 100644
index 0000000000..fbf2dc4897
--- /dev/null
+++ b/docs/branch-review-records/6f2e5ab42932b76f6bc1f9e99c44558ad9edbfec91f1f75fd8ba007bdd90d979.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/ledger-review-triage-yi63ao | f7fdb77a66a02b5678ad14d6f196c80c8d458571 | Outstanding-issues reconciliation for #293 and #312: final current-base merge | Verified cited landings, retained #312 browser-family acceptance gap, and merged current base with no conflicts or new P0-P2 findings | git diff --check; ledger-inbox; outstanding-issues; branch-review-ledger; ledger-write-discipline; landing and request-content assertions |
diff --git a/docs/branch-review-records/6fdbf4d3fb732b73a4c56c0bb3c09278fb142e1e4e1d4b8e8d787d6abf9ea62f.record.md b/docs/branch-review-records/6fdbf4d3fb732b73a4c56c0bb3c09278fb142e1e4e1d4b8e8d787d6abf9ea62f.record.md
new file mode 100644
index 0000000000..095a5459c7
--- /dev/null
+++ b/docs/branch-review-records/6fdbf4d3fb732b73a4c56c0bb3c09278fb142e1e4e1d4b8e8d787d6abf9ea62f.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/rag-zod-hardening-tranche2 | 671b0b99f7fdd33e83e5fa55a29470690c9243f2 | RAG row-contract tranche 2 P2: unconstrained JSON provenance acceptance | Fixed P2 — index-unit source_span and metadata accept all JSON allowed by the database; non-object provenance is safely omitted from record-only downstream consumers | manual adversarial review; focused scalar/array contract regression added; git diff --check; ci-change-scope self-test; ledger/inbox/outstanding/discipline guards passed; targeted Vitest blocked: node_modules/vitest absent |
diff --git a/docs/branch-review-records/7060c1fcf1c15570212c29f7afe5379d101d7e3ada1bb102dcd1631e83d7bf55.record.md b/docs/branch-review-records/7060c1fcf1c15570212c29f7afe5379d101d7e3ada1bb102dcd1631e83d7bf55.record.md
new file mode 100644
index 0000000000..4ef15deaa1
--- /dev/null
+++ b/docs/branch-review-records/7060c1fcf1c15570212c29f7afe5379d101d7e3ada1bb102dcd1631e83d7bf55.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | PR #1965 | a535862933966cede9c0f7f11734167a93b67c62 | Playwright browser-revision preflight | fixed | Prettier; 12 focused browser-check tests passed; test-runner safety covered by exact-head CI; full local suite blocked by incomplete cached dependencies; merged main |
diff --git a/docs/branch-review-records/70ed179206c9c4c492ee7a969f0a2c5bb8119ba24d916c6cd8b8f521347ffd23.record.md b/docs/branch-review-records/70ed179206c9c4c492ee7a969f0a2c5bb8119ba24d916c6cd8b8f521347ffd23.record.md
new file mode 100644
index 0000000000..4e2c237ddc
--- /dev/null
+++ b/docs/branch-review-records/70ed179206c9c4c492ee7a969f0a2c5bb8119ba24d916c6cd8b8f521347ffd23.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/differential-results-ui-20260814 | cc68da45cf37c5fbb6e588106e9d3bf8ab8004c3 | required base sync through main 17402395 | Approved — required main update merged; prior focused UI review remains applicable with no PR-path conflict | git diff --check; ci-change-scope self-test; ledger/inbox/outstanding/discipline guards passed |
diff --git a/docs/branch-review-records/711ddbc0e2119fb166c1c4267644135f54ba5f04f0c8c06a38fc88ddc42c85e6.record.md b/docs/branch-review-records/711ddbc0e2119fb166c1c4267644135f54ba5f04f0c8c06a38fc88ddc42c85e6.record.md
new file mode 100644
index 0000000000..8dc6e9d4ff
--- /dev/null
+++ b/docs/branch-review-records/711ddbc0e2119fb166c1c4267644135f54ba5f04f0c8c06a38fc88ddc42c85e6.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/calculators-mode | 39423d88bced6494ad2eed30f43fb859ab6abefb | Calculators mode: final current-base merge | Merged latest required base after prior focused review; no conflicts or new confirmed P0-P2 findings | git diff --check; ledger-inbox; outstanding-issues; branch-review-ledger; ledger-write-discipline; calculator registration assertion |
diff --git a/docs/branch-review-records/719b4f9ab3ccc24a497b1f84a5262acd6e929cbbe76b46ab8d3a953de2b0883f.record.md b/docs/branch-review-records/719b4f9ab3ccc24a497b1f84a5262acd6e929cbbe76b46ab8d3a953de2b0883f.record.md
new file mode 100644
index 0000000000..0fd7e1802e
--- /dev/null
+++ b/docs/branch-review-records/719b4f9ab3ccc24a497b1f84a5262acd6e929cbbe76b46ab8d3a953de2b0883f.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/rag-zod-hardening-tranche2 | 1a59ce0b128fbdabb9a24c3ea95c1123299693f3 | RAG row-contract CI follow-up: optional-signal assertion narrowing | Fixed P1 — explicit local mismatch catches preserve both logged optional-signal degradation and TypeScript row narrowing | CI typecheck failure reproduced from exact-head log; git diff --check; ci-change-scope self-test; ledger/inbox/outstanding/discipline guards passed; local Vitest unavailable because node_modules/vitest is absent |
diff --git a/docs/branch-review-records/71e026951e34c888a933c97c6f0f48f3825198aad8e34f32ecc8d6381b2ce5a2.record.md b/docs/branch-review-records/71e026951e34c888a933c97c6f0f48f3825198aad8e34f32ecc8d6381b2ce5a2.record.md
new file mode 100644
index 0000000000..f9bdc61bde
--- /dev/null
+++ b/docs/branch-review-records/71e026951e34c888a933c97c6f0f48f3825198aad8e34f32ecc8d6381b2ce5a2.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | claude/live-drift-forensics-lnhvja | b9485d897dbec528b9141d3b93bbc7a067bfd010 | incident forensics + live index restore evidence (#316/#231) | PR #1960 open | verify:pr-local failed:(none) incl check:ledger-write-discipline |
diff --git a/docs/branch-review-records/73e1ce27d354653c23fc961f40f9d63232cd9e2adbed6433ed8cb4e2e04eb3aa.record.md b/docs/branch-review-records/73e1ce27d354653c23fc961f40f9d63232cd9e2adbed6433ed8cb4e2e04eb3aa.record.md
new file mode 100644
index 0000000000..430fc294f1
--- /dev/null
+++ b/docs/branch-review-records/73e1ce27d354653c23fc961f40f9d63232cd9e2adbed6433ed8cb4e2e04eb3aa.record.md
@@ -0,0 +1 @@
+| 2026-08-13 | work | a9e7331cd0b4f72b4cc7251ddf135c590d936256 | guide dialog UX, scrolling, answer verification preview, and mobile bottom action | Implemented focused fixes; no unresolved high-confidence defects in changed scope | guide DOM 9 passed; Chromium guide smoke passed; typecheck passed; manual 390x844 screenshot and scroll check passed |
diff --git a/docs/branch-review-records/74e47bb0fd4e2b3ff3ec524606a00b573db356d6b17cf68b4829a19643b9b71a.record.md b/docs/branch-review-records/74e47bb0fd4e2b3ff3ec524606a00b573db356d6b17cf68b4829a19643b9b71a.record.md
new file mode 100644
index 0000000000..f59a64c858
--- /dev/null
+++ b/docs/branch-review-records/74e47bb0fd4e2b3ff3ec524606a00b573db356d6b17cf68b4829a19643b9b71a.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/differential-results-ui-20260814 | d12e0217c4adc057e27ad92fb5dad144ba38995a | Differentials changed-file formatter blocker | Restored the single 115-column mobile rank expression after exact-head CI showed the preceding wrapped form was not Prettier-valid. | git diff --check b7d2bbcc75f8e3aadf498575b2ae4c44ebd3cc79; node scripts/ledger-inbox.mjs check; node scripts/check-outstanding-issues.mjs; node scripts/check-branch-review-ledger.mjs; node scripts/check-ledger-write-discipline.mjs origin/main HEAD; node scripts/ci-change-scope.mjs --self-test; exact-head changed-file formatter failure reviewed |
diff --git a/docs/branch-review-records/7620543101feadcebdc49427ad0395f1f4c8a0d304ec3a5251f1920d023b06c0.record.md b/docs/branch-review-records/7620543101feadcebdc49427ad0395f1f4c8a0d304ec3a5251f1920d023b06c0.record.md
new file mode 100644
index 0000000000..2e9450f621
--- /dev/null
+++ b/docs/branch-review-records/7620543101feadcebdc49427ad0395f1f4c8a0d304ec3a5251f1920d023b06c0.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | 1976 | 8bb76ce085f212d47a0918b9242cb412e8a9a3f7 | review-and-fix | fixed phone install-sheet overlap on current-base head | pwa regression 1/1; lifecycle DOM 10/10; verify:phone-chrome 437/437 UI |
diff --git a/docs/branch-review-records/771a9eb221c68c8d73f05d8831089a7b6744d11d10a1fee600ca1eac1d0354fe.record.md b/docs/branch-review-records/771a9eb221c68c8d73f05d8831089a7b6744d11d10a1fee600ca1eac1d0354fe.record.md
new file mode 100644
index 0000000000..87b3e4a96c
--- /dev/null
+++ b/docs/branch-review-records/771a9eb221c68c8d73f05d8831089a7b6744d11d10a1fee600ca1eac1d0354fe.record.md
@@ -0,0 +1 @@
+| 2026-08-16 | codex/tools-show-all-20260816 | 6b67263c9d41a598bda3329e40846425071ddf20 | PR #2008 compact Show all tools launcher review and latest-main merge | No P0/P1/P2 defects confirmed; preserved the focused launcher-to-directory control and merged latest main without conflict; PR description placement wording is stale but not a proven code defect | Manual adversarial merged-tree review; targeted source-contract assertions passed; exact pre-sync head PR required wrapper, lint, typecheck, SAST and secret scan passed |
diff --git a/docs/branch-review-records/7a1bb8ea354bbff006a1deb9148167b6bfe7cd5a364f7fd8d8da5287aa2a4e38.record.md b/docs/branch-review-records/7a1bb8ea354bbff006a1deb9148167b6bfe7cd5a364f7fd8d8da5287aa2a4e38.record.md
new file mode 100644
index 0000000000..3993c5040d
--- /dev/null
+++ b/docs/branch-review-records/7a1bb8ea354bbff006a1deb9148167b6bfe7cd5a364f7fd8d8da5287aa2a4e38.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | claude/ledger-process-tooling-50uqfc | 07b184df70e31c55e3637af875af077d2f12f129 | PR #1944 review-and-fix (supersedes 2026-08-14) | Corrected connector file encoding; retained five fixes | byte-verified blobs; audit self-test, targeted classifier probes, JSON parse, ledger and docs guards; Vitest unavailable: npm ci package downloads corrupted |
diff --git a/docs/branch-review-records/7b17944b9be99b8dfecf5a608e68fcee0660337191337c4097bc1831ccd34960.record.md b/docs/branch-review-records/7b17944b9be99b8dfecf5a608e68fcee0660337191337c4097bc1831ccd34960.record.md
new file mode 100644
index 0000000000..05625cdf94
--- /dev/null
+++ b/docs/branch-review-records/7b17944b9be99b8dfecf5a608e68fcee0660337191337c4097bc1831ccd34960.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | codex/calculators-mode | 563ce4195512b9e623df6ba98762f4a3dc1b9e8e | calculators first-class mode | P1: calculator composer invokes universal-search API despite local-only boundary | source diff review; local verification evidence inspected; verify:pr-local dry-run; provider checks not run |
diff --git a/docs/branch-review-records/7bd50bd9c4093cf764692231945db6e88a27e21ebb7545745fa66facf618d208.record.md b/docs/branch-review-records/7bd50bd9c4093cf764692231945db6e88a27e21ebb7545745fa66facf618d208.record.md
new file mode 100644
index 0000000000..fe77034cc8
--- /dev/null
+++ b/docs/branch-review-records/7bd50bd9c4093cf764692231945db6e88a27e21ebb7545745fa66facf618d208.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | PR #1978 | ef1bb2eac059d1c3ad0d4cae756bb069b5b8edb2 | review-and-fix | Fixed applied cancel-of-cancel acceptance and restored guard-push executable mode; verified rewritten-history and parallel-reconcile semantics; merged latest main | focused Vitest 39 passed, 1 Windows skip; guard self-tests; ledger and issue guards; format; manual adversarial review (CodeRabbit CLI unavailable) |
diff --git a/docs/branch-review-records/7ce860ee652bd3f4e91c56cab26f002c8fd5e5b18eee189d01baaaa18ffd432c.record.md b/docs/branch-review-records/7ce860ee652bd3f4e91c56cab26f002c8fd5e5b18eee189d01baaaa18ffd432c.record.md
new file mode 100644
index 0000000000..d2dc82c71f
--- /dev/null
+++ b/docs/branch-review-records/7ce860ee652bd3f4e91c56cab26f002c8fd5e5b18eee189d01baaaa18ffd432c.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/db-remediation-phase-0-wfaiyl | becdb68610b27e7c38e9607c8bb0210911107581 | PR #1978 base sync | Merged main 6f7b7deefaf7e0cd062b748f18fc6ca8988093f6 into the reviewed PR head; merge tree was clean. | git merge-tree --write-tree exact-head main: clean; git diff --check; ledger guards. |
diff --git a/docs/branch-review-records/801656524b713b73ce558ee09425ea5e24d3c5d61ebd572a963c9495b3745731.record.md b/docs/branch-review-records/801656524b713b73ce558ee09425ea5e24d3c5d61ebd572a963c9495b3745731.record.md
new file mode 100644
index 0000000000..62b04fc13b
--- /dev/null
+++ b/docs/branch-review-records/801656524b713b73ce558ee09425ea5e24d3c5d61ebd572a963c9495b3745731.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/ledger-review-triage-yi63ao | fa087d2aebaceb953029d7805bf2437e03de1cd7 | Required base sync through main d301d8f4 | approved | git diff --check; ledger and issue guards |
diff --git a/docs/branch-review-records/80cbe21a397bb239bbc43ceca3bf117412cf732bc2ad6e0bfc360a7a759102ed.record.md b/docs/branch-review-records/80cbe21a397bb239bbc43ceca3bf117412cf732bc2ad6e0bfc360a7a759102ed.record.md
new file mode 100644
index 0000000000..1a41f08087
--- /dev/null
+++ b/docs/branch-review-records/80cbe21a397bb239bbc43ceca3bf117412cf732bc2ad6e0bfc360a7a759102ed.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | claude/issues-reconcile-lnhvja | cabdd290b00ff81569955cdd4a1b6b6b9f8999de | serialized outstanding-issues reconciliation (9 requests, 2 cancels) | PR #1967 open | issues:reconcile applied 9; check:outstanding-issues pass; verify:pr-local failed:(none) |
diff --git a/docs/branch-review-records/8145832620703718dd3e73fb75753072cb7b441b62d2ddf6230bbc962e48a76c.record.md b/docs/branch-review-records/8145832620703718dd3e73fb75753072cb7b441b62d2ddf6230bbc962e48a76c.record.md
new file mode 100644
index 0000000000..6228813bf1
--- /dev/null
+++ b/docs/branch-review-records/8145832620703718dd3e73fb75753072cb7b441b62d2ddf6230bbc962e48a76c.record.md
@@ -0,0 +1 @@
+| 2026-08-16 | PR-2000 / codex/chat-ledger-programme-ledger-programme | b2cc119e622cce051a8c9551a839a5a93fbb45a3 | PR #2000 merged-base outstanding-issue request review | Confirmed premature closure of #098 and corrected it in the successor commit; the other seven requests were supported or appropriately left open | exact-head PR required passed at 270a0661e0812ccad0229db021cff26f4efb14a4; standalone JSON and request-schema validation; referenced commit and merged-PR audit; merge-tree verification; #237 and #238 browser evidence not independently rerun |
diff --git a/docs/branch-review-records/8243bee1cb3db8072c44ead4c341496c2ac29c430dc0d2d9fc0930d314b14c9f.record.md b/docs/branch-review-records/8243bee1cb3db8072c44ead4c341496c2ac29c430dc0d2d9fc0930d314b14c9f.record.md
new file mode 100644
index 0000000000..f93c173d5b
--- /dev/null
+++ b/docs/branch-review-records/8243bee1cb3db8072c44ead4c341496c2ac29c430dc0d2d9fc0930d314b14c9f.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | PR-1955 | 6daa3a56f5d5e20ca9f8b8fe35c33a2cc708ef60 | src/components/clinical-dashboard/account-setup-dialog.tsx; docs/branch-review-records | fixed design-system contract violations and merged latest main | manual adversarial review; source-token contract assertion; git merge-tree; git diff --check; docs links; ledger inbox; ledger guards; check-design-system-contract unavailable (node_modules absent) |
diff --git a/docs/branch-review-records/87f8cf80747ffeca51cee65f24c1a612dbaa08024e096bbcc0201a7434bbf1f3.record.md b/docs/branch-review-records/87f8cf80747ffeca51cee65f24c1a612dbaa08024e096bbcc0201a7434bbf1f3.record.md
new file mode 100644
index 0000000000..ea99615114
--- /dev/null
+++ b/docs/branch-review-records/87f8cf80747ffeca51cee65f24c1a612dbaa08024e096bbcc0201a7434bbf1f3.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | PR-1955 | 6cdf22cb0ce058c827c489b512b47d5e6084da4e | PR #1955 CI repair and current-base sync (supersedes prior non-decisive review records) | fixed the CI-blocking legacy 44px brand-tile classes with the shared tap token; merged current main | account setup tap-token source contract passed; git diff --check passed; docs link check passed: 1776 repo path references resolve.; Ledger inbox check passed: 12 pending request(s), 138 applied.; ledger write discipline self-test passed.; Branch review ledger guard passed: 880 live table records + 1206 archived + 87 immutable; npm run format unavailable: prettier: not found (exit 127); check:design-system-contract unavailable locally: node_modules is absent; exact CI required |
diff --git a/docs/branch-review-records/887618b97bf3256125def037cd1b5e87659aaa9b1439015c6354eb96e19d0c46.record.md b/docs/branch-review-records/887618b97bf3256125def037cd1b5e87659aaa9b1439015c6354eb96e19d0c46.record.md
new file mode 100644
index 0000000000..3b89e21920
--- /dev/null
+++ b/docs/branch-review-records/887618b97bf3256125def037cd1b5e87659aaa9b1439015c6354eb96e19d0c46.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/search-phone-animation-20260815 | ed29ba4b3effa6ad58f4a6ecc240b30a6a93fdd2 | Fresh phone browser and standalone-PWA loading animation defect hunt after physical-device failure report | Fixed: moved the ECG opacity pulse from an SVG path to a normal HTML compositor layer and added WebKit raster-difference coverage | CSS contract 3/3; focused production WebKit 2/2; design-system contract passed |
diff --git a/docs/branch-review-records/898e1bc7855d44ca3df03b0c0f9747960713a6a06b532505caa5548de80b814c.record.md b/docs/branch-review-records/898e1bc7855d44ca3df03b0c0f9747960713a6a06b532505caa5548de80b814c.record.md
new file mode 100644
index 0000000000..b6248747b3
--- /dev/null
+++ b/docs/branch-review-records/898e1bc7855d44ca3df03b0c0f9747960713a6a06b532505caa5548de80b814c.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/differential-results-ui-20260814 | d12e0217c4adc057e27ad92fb5dad144ba38995a | differential clinical-cue regression and formatter follow-up | Aligned the focused result-row assertion with the displayed compact-cue normalization and formatted the mobile rank calculation reported by changed-file formatting. Targeted Vitest unavailable because this isolated worktree has no node_modules/vitest. | git diff --check; ledger-inbox; outstanding-issues; branch-review-ledger; ledger-write-discipline; ci-change-scope --self-test |
diff --git a/docs/branch-review-records/8a26a9949fd0c9384acd0f0868d96374080dd7191777c1be29037b6edc8c3069.record.md b/docs/branch-review-records/8a26a9949fd0c9384acd0f0868d96374080dd7191777c1be29037b6edc8c3069.record.md
new file mode 100644
index 0000000000..87795a4a56
--- /dev/null
+++ b/docs/branch-review-records/8a26a9949fd0c9384acd0f0868d96374080dd7191777c1be29037b6edc8c3069.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | 1971 | 91fe143262fca184124b540ff06b2353aec8094f | review-and-fix | Fixed validated P2 evidence-semantics, sparse-panel, cue-deduplication, duplicate-key, and formatter blockers; immutable-record bot request dispositioned no-change. | focused Vitest 8/8 passed; format changed passed; lint passed; typecheck passed; ledger and docs guards passed; full unit gate partial with 6 Windows tooling failures reproduced identically on main; production readiness environment-gated (2 pass, 5 warn, 2 missing-config failures) |
diff --git a/docs/branch-review-records/8f593be414cd088768dc59074dcd77476f562cfdaabd4d2b23cd3a67336a02ff.record.md b/docs/branch-review-records/8f593be414cd088768dc59074dcd77476f562cfdaabd4d2b23cd3a67336a02ff.record.md
new file mode 100644
index 0000000000..594dc1b4c8
--- /dev/null
+++ b/docs/branch-review-records/8f593be414cd088768dc59074dcd77476f562cfdaabd4d2b23cd3a67336a02ff.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/rag-zod-hardening-tranche2 | 690204f669db3be9995b6c658ad2eb35befbdace | PR #1981 retrieval row contract formatter follow-up | Collapsed a formatter-stable candidate-source import after the exact-head changed-file format gate failed; retained the validated row-shape assertions. | git diff --check; ledger/outstanding/branch-ledger/ledger-discipline guards; ci-change-scope self-test passed; npm test -- tests/rag-retrieval-row-contract.test.ts unavailable: node_modules/vitest/vitest.mjs absent. |
diff --git a/docs/branch-review-records/903f043f143538cff9e2ce0043a9d2fa6822d3be129f8d506cb93ac4bc3960a3.record.md b/docs/branch-review-records/903f043f143538cff9e2ce0043a9d2fa6822d3be129f8d506cb93ac4bc3960a3.record.md
new file mode 100644
index 0000000000..dfda5288be
--- /dev/null
+++ b/docs/branch-review-records/903f043f143538cff9e2ce0043a9d2fa6822d3be129f8d506cb93ac4bc3960a3.record.md
@@ -0,0 +1 @@
+| 2026-08-16 | PR-2008 / codex/tools-show-all-20260816 | db72f545635c9e611da3c4f3bb70bbda991699a4 | PR #2008 latest-base refresh after green exact-head CI | Merged main 4b601e34f2a3398121a23e7db64a04690075ddd3; its default-off clinical answer evidence preview changes do not overlap the launcher component or dedicated Show all regression; no new P0/P1/P2 defects confirmed | Exact-head PR required, static, build, unit, production UI, critical UI, CI-managed Lighthouse budget, SAST, and secret scans passed at f34fad1f725410995fe90f1d356c7764de9b5a07; 54585e98df133c0b49cf32cc878473ea0beba46d-to-4b601e34f2a3398121a23e7db64a04690075ddd3 compare reviewed; clean non-overlapping merge-tree construction |
diff --git a/docs/branch-review-records/91679c0f8d364c93cfbe6f9c54463ec90d9dcbbfa158d1876e0ed8744f2c0162.record.md b/docs/branch-review-records/91679c0f8d364c93cfbe6f9c54463ec90d9dcbbfa158d1876e0ed8744f2c0162.record.md
new file mode 100644
index 0000000000..999a5c168f
--- /dev/null
+++ b/docs/branch-review-records/91679c0f8d364c93cfbe6f9c54463ec90d9dcbbfa158d1876e0ed8744f2c0162.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | claude/playwright-browser-revision-check | 3447238f1c66154dca9b567924fb0a2f57a28c84 | PR #1965: Playwright browser revision check | fixed | prettier; targeted Vitest 5 passed; independent Codex adversarial review: 3 P2 fixed; full Vitest unavailable (cached runtime lacks playwright-core browsers.json) |
diff --git a/docs/branch-review-records/99bf725572728b2e2a1e7b1ddcc5f08b3d10e50e1fa7091856c41a9fe03cde52.record.md b/docs/branch-review-records/99bf725572728b2e2a1e7b1ddcc5f08b3d10e50e1fa7091856c41a9fe03cde52.record.md
new file mode 100644
index 0000000000..ffedd75e47
--- /dev/null
+++ b/docs/branch-review-records/99bf725572728b2e2a1e7b1ddcc5f08b3d10e50e1fa7091856c41a9fe03cde52.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/differential-results-ui-20260814 | cc999ff537622d2bfa73df4d56be2b45b16c449a | Required base sync through main 3824095d8bf2 | approved | git diff --check; CI scope self-test; ledger and issue guards |
diff --git a/docs/branch-review-records/9b89f9091c287b15d98bcce1bbf9c687061e0b75ff2d71b8610f6b5cfd49ae43.record.md b/docs/branch-review-records/9b89f9091c287b15d98bcce1bbf9c687061e0b75ff2d71b8610f6b5cfd49ae43.record.md
new file mode 100644
index 0000000000..b61fca86ab
--- /dev/null
+++ b/docs/branch-review-records/9b89f9091c287b15d98bcce1bbf9c687061e0b75ff2d71b8610f6b5cfd49ae43.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/fix-documents-without-live-images | a42f45955ad8595ccd17ac4fea2ea0d6fd2c2f3f | required base sync through main 17402395 | Approved — required main update merged; prior document-cover repair review remains applicable with no PR-path conflict | git diff --check; ci-change-scope self-test; ledger/inbox/outstanding/discipline guards passed |
diff --git a/docs/branch-review-records/9cb91634447e60affd610471e14ffdbacf8e042b608a2c3553c5ae303b34e92b.record.md b/docs/branch-review-records/9cb91634447e60affd610471e14ffdbacf8e042b608a2c3553c5ae303b34e92b.record.md
new file mode 100644
index 0000000000..8cdd6530c8
--- /dev/null
+++ b/docs/branch-review-records/9cb91634447e60affd610471e14ffdbacf8e042b608a2c3553c5ae303b34e92b.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | PR-1951 | 6ed1fb871c7e16e89ed111a9576d502d90a765b1 | PR #1951 final base sync after formatting fix | Merged the current main including the #1959 ledger reconciliation after the targeted Prettier repair; merge tree is clean and the run-scoped workflow regression suite remains green. | All matched files use Prettier code style; Test Files 1 passed; Tests 15 passed; docs link check passed: 1775 repo path references resolve; Ledger inbox check passed: 22 pending request(s), 138 applied; branch-review-ledger self-test passed; Branch review ledger guard passed: 880 live table records + 1206 archived + 98 immutable; verify:pr-local unavailable: tsx/cli absent from isolated worktree (Node v24.14.0). |
diff --git a/docs/branch-review-records/a23d66df28dc33bad16d7d3883fb4129a9971399fe8906bfc771c3543c63b820.record.md b/docs/branch-review-records/a23d66df28dc33bad16d7d3883fb4129a9971399fe8906bfc771c3543c63b820.record.md
new file mode 100644
index 0000000000..94ac8d0c39
--- /dev/null
+++ b/docs/branch-review-records/a23d66df28dc33bad16d7d3883fb4129a9971399fe8906bfc771c3543c63b820.record.md
@@ -0,0 +1 @@
+| 2026-08-16 | PR-2008 / codex/tools-show-all-20260816 | 75028ebb9d48ae06ccd99621b3f7881af50b91f4 | PR #2008 latest-base shared UI test merge after green exact-head CI | Merged main 54585e98df133c0b49cf32cc878473ea0beba46d; kept its low-confidence AccessibleTable 320px mockup journey in the shared suite and moved this PR's Show all launcher regression to dedicated tests/ui-tools-show-all.spec.ts; no new P0/P1/P2 defects confirmed | Exact-head PR required, static, build, unit, production UI, critical UI, advisory UI, CI-managed Lighthouse budget, SAST, and secret scans passed at 4db291a50e7aad2239fe85303b886ab248978c3f; fb8c71c94f8a45028df36aa669e3653c4f75cd2a-to-54585e98df133c0b49cf32cc878473ea0beba46d compare reviewed; merged source and test contracts reviewed |
diff --git a/docs/branch-review-records/a5309edd41a122ccf51a2dacea385abdd2b404d07061df6833f1ef1289d053f3.record.md b/docs/branch-review-records/a5309edd41a122ccf51a2dacea385abdd2b404d07061df6833f1ef1289d053f3.record.md
new file mode 100644
index 0000000000..d6e8d67258
--- /dev/null
+++ b/docs/branch-review-records/a5309edd41a122ccf51a2dacea385abdd2b404d07061df6833f1ef1289d053f3.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | PR #1970 / claude/capture-drift-phase1-evidence | 6d977b02331c04398daf930acc773743355b68f5 | unblocking PR review-and-fix | Corrected four P2 forensic claims and cancelled the two unsafe queued ledger mutations; merged current main cleanly. | ledger write discipline; ledger-inbox check; forensic claim scan; diff --check |
diff --git a/docs/branch-review-records/a55dc77c0266823fc485b9f5e8b164e6f47b1ae95aae4517cd969e5cd9246fa6.record.md b/docs/branch-review-records/a55dc77c0266823fc485b9f5e8b164e6f47b1ae95aae4517cd969e5cd9246fa6.record.md
new file mode 100644
index 0000000000..803822f452
--- /dev/null
+++ b/docs/branch-review-records/a55dc77c0266823fc485b9f5e8b164e6f47b1ae95aae4517cd969e5cd9246fa6.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | PR-1958 | 02c8d4601131b40291033eabaf4b3d2e132c248e | PR #1958 current-base sync | Merged the latest base, preserving the existing Tools-directory behavior and resolving shared account-setup test updates with the combined clean merge tree. | docs link check passed: 1776 repo path references resolve; Ledger inbox check passed: 12 pending request(s), 138 applied; branch-review-ledger self-test passed; Branch review ledger guard passed: 880 live table records + 1206 archived + 94 immutable; 17 non-jsdom targeted tests passed; jsdom targets unavailable because cached Vitest dependencies lack @testing-library/react and @testing-library/jest-dom; verify:pr-local unavailable: tsx/cli absent from isolated worktree (Node v24.14.0). |
diff --git a/docs/branch-review-records/a9f750bbfb5bbb2857e2cdbb97a2dc446b1851cec993f8a91dd526fcbc750d25.record.md b/docs/branch-review-records/a9f750bbfb5bbb2857e2cdbb97a2dc446b1851cec993f8a91dd526fcbc750d25.record.md
new file mode 100644
index 0000000000..2bb54b8f69
--- /dev/null
+++ b/docs/branch-review-records/a9f750bbfb5bbb2857e2cdbb97a2dc446b1851cec993f8a91dd526fcbc750d25.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/pwa-install-polish-20260815 | dd687f20c2143466b40d51ce2831542130964af4 | PWA install lifecycle: style-contract registry and current-base merge | Fixed PR-introduced unregistered PWA visual classes; stale install-sheet exemption removed; merged current base | git diff --check; ledger-inbox; outstanding-issues; branch-review-ledger; ledger-write-discipline; static PWA registry assertion; targeted Vitest unavailable (node_modules absent) |
diff --git a/docs/branch-review-records/aa23b8cd5be8c299c1878de6b92a7b1a3256129ab978d51a792d14ad7c785d73.record.md b/docs/branch-review-records/aa23b8cd5be8c299c1878de6b92a7b1a3256129ab978d51a792d14ad7c785d73.record.md
new file mode 100644
index 0000000000..b0dca5cbc6
--- /dev/null
+++ b/docs/branch-review-records/aa23b8cd5be8c299c1878de6b92a7b1a3256129ab978d51a792d14ad7c785d73.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/medication-info-header-20260814 | 9c1bfe7154eb36e890b4d4e8d61d83da7ba6c926 | required base sync through main 17402395 | Approved — required main update merged; prior focused medication-header review remains applicable with no PR-path conflict | git diff --check; ci-change-scope self-test; ledger/inbox/outstanding/discipline guards passed |
diff --git a/docs/branch-review-records/ac537aead3881d4cf73e22512e83e1803a1c9ca11fa10969155f42bcdda2e75b.record.md b/docs/branch-review-records/ac537aead3881d4cf73e22512e83e1803a1c9ca11fa10969155f42bcdda2e75b.record.md
new file mode 100644
index 0000000000..96475375a5
--- /dev/null
+++ b/docs/branch-review-records/ac537aead3881d4cf73e22512e83e1803a1c9ca11fa10969155f42bcdda2e75b.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/fix-documents-without-live-images | 316018b41177e34612f08339bf4baf37055abf00 | PR #1975 base sync | Merged main 6f7b7deefaf7e0cd062b748f18fc6ca8988093f6 into the reviewed PR head; merge tree was clean. | git merge-tree --write-tree exact-head main: clean; git diff --check; ledger guards. |
diff --git a/docs/branch-review-records/b22a65eca447a754f2a971dae18a24a12fc5f3b7bb18a89e813bc2d9a11d1e12.record.md b/docs/branch-review-records/b22a65eca447a754f2a971dae18a24a12fc5f3b7bb18a89e813bc2d9a11d1e12.record.md
new file mode 100644
index 0000000000..da41f47c81
--- /dev/null
+++ b/docs/branch-review-records/b22a65eca447a754f2a971dae18a24a12fc5f3b7bb18a89e813bc2d9a11d1e12.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/calculators-mode | 9dc3891ee8bc30a35fdb203607cdd984d3a24cc3 | calculator command-surface P1/P2 follow-up: suggestion submit and footer ownership docs | Fixed P1/P2 — selected calculator suggestions pass their exact text into navigation; chrome ownership docs no longer describe calculators as page-owned footers | manual control-flow review; focused DOM regression added; git diff --check; ci-change-scope self-test; ledger/inbox/outstanding/discipline guards passed; focused Vitest blocked: node_modules/vitest absent |
diff --git a/docs/branch-review-records/b2482dceb2ee840589af0dfbe5f66b5f406c49c01ccd942a2c3f16bca8ae8ade.record.md b/docs/branch-review-records/b2482dceb2ee840589af0dfbe5f66b5f406c49c01ccd942a2c3f16bca8ae8ade.record.md
new file mode 100644
index 0000000000..fd9e8eddb2
--- /dev/null
+++ b/docs/branch-review-records/b2482dceb2ee840589af0dfbe5f66b5f406c49c01ccd942a2c3f16bca8ae8ade.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/db-remediation-phase-0-wfaiyl | 1a8f7ae02c2bd7aa22e51edfb3b4a7b249ede578 | required base sync through main 17402395 | Approved — required main update merged; prior ledger guard remediation review remains applicable with no PR-path conflict | git diff --check; ci-change-scope self-test; ledger/inbox/outstanding/discipline guards passed |
diff --git a/docs/branch-review-records/b3523668f8839bde68f1fae4de2e7e8275b5cabc1802d1b6511b30323adad6ad.record.md b/docs/branch-review-records/b3523668f8839bde68f1fae4de2e7e8275b5cabc1802d1b6511b30323adad6ad.record.md
new file mode 100644
index 0000000000..83b79fb206
--- /dev/null
+++ b/docs/branch-review-records/b3523668f8839bde68f1fae4de2e7e8275b5cabc1802d1b6511b30323adad6ad.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/pwa-install-polish-20260815 | 80fd6c04afdfa30e92c1cdf2ea5ba9d3d32a02c6 | PR #1976 base sync | Merged main 6f7b7deefaf7e0cd062b748f18fc6ca8988093f6 into the reviewed PR head; merge tree was clean. | git merge-tree --write-tree exact-head main: clean; git diff --check; ledger guards. |
diff --git a/docs/branch-review-records/b50552bc27edf96d286fcb2c582831863c1893c66a80b3dc38988a8ef6ef5dc0.record.md b/docs/branch-review-records/b50552bc27edf96d286fcb2c582831863c1893c66a80b3dc38988a8ef6ef5dc0.record.md
new file mode 100644
index 0000000000..3125558c77
--- /dev/null
+++ b/docs/branch-review-records/b50552bc27edf96d286fcb2c582831863c1893c66a80b3dc38988a8ef6ef5dc0.record.md
@@ -0,0 +1 @@
+| 2026-08-16 | PR-2008 / codex/tools-show-all-20260816 | e40e375dfa5346614d5b0c143e9f2e8f0fe44bd8 | PR #2008 post-review base refresh | Required base refresh to 4c52fe1dbbc921be769c31b36efbcdba798ba11b reviewed; the base delta adds only unrelated branch-review records and outstanding-issue inbox updates, with no overlap with this PR's launcher or focused UI regression files; the original review disposition remains valid | Exact-head PR required, CI, SAST, and secret scan passed at b089bf262b1aff99f57b22e45cbd941e815175c1; a96dcbb6280ab6889c3b443be4d348950786a809-to-4c52fe1dbbc921be769c31b36efbcdba798ba11b compare reviewed; clean synthetic merge-tree verification |
diff --git a/docs/branch-review-records/badab2e50d140f081e049c934ff5e1c37b7415e4213102534a21b99bb97e87fe.record.md b/docs/branch-review-records/badab2e50d140f081e049c934ff5e1c37b7415e4213102534a21b99bb97e87fe.record.md
new file mode 100644
index 0000000000..4ade101f00
--- /dev/null
+++ b/docs/branch-review-records/badab2e50d140f081e049c934ff5e1c37b7415e4213102534a21b99bb97e87fe.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/services-search-redesign-163 | 5c1befa6bc7947381b707efaa50daa6e86ca9a88 | review-and-fix | P2 fixes published: serialize result-row favourite mutations and keep failed loads state-neutral and unavailable | focused services DOM tests 8/8; typecheck; lint; format:changed; branch-review-ledger; outstanding-issues; git diff --check |
diff --git a/docs/branch-review-records/bb4cf300c0917336cbfb205dc3631242f4e32aab35d3d3bfe1d0654c41f7bf34.record.md b/docs/branch-review-records/bb4cf300c0917336cbfb205dc3631242f4e32aab35d3d3bfe1d0654c41f7bf34.record.md
new file mode 100644
index 0000000000..c0c42f5a5d
--- /dev/null
+++ b/docs/branch-review-records/bb4cf300c0917336cbfb205dc3631242f4e32aab35d3d3bfe1d0654c41f7bf34.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | claude/rag-zod-hardening-tranche1 | 0fded0878b6f8e35ef50b8c97a63af6e78e1f716 | rag.ts retrieval RPC row Zod shape contract (ledger #212 tranche 1) | Approved — 4 unchecked as SearchResult[] casts on retrieval RPC rows replaced with assertRetrievalRows; no ranking/ordering/scoring logic touched | verify:pr-local (all steps green except pre-existing check:medication-lexicon-report staleness on main); test 602 files/6517 passed; typecheck exit 0; eval:rag:offline 36 golden cases 23 suites, 579 passed |
diff --git a/docs/branch-review-records/bc83ff5f4c4f9421ec32cf4351708e95ce45c035738a63aaa40ea6ca6afcfa3d.record.md b/docs/branch-review-records/bc83ff5f4c4f9421ec32cf4351708e95ce45c035738a63aaa40ea6ca6afcfa3d.record.md
new file mode 100644
index 0000000000..3637257188
--- /dev/null
+++ b/docs/branch-review-records/bc83ff5f4c4f9421ec32cf4351708e95ce45c035738a63aaa40ea6ca6afcfa3d.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/issues-reconcile-2026-08-15 | 3381a69cba662c7dd4083c0fe8747aa04d7c9097 | Canonical ledger reconcile of 17 queued requests after the #1982/#1983/#1984/#1985 merges | Applied cleanly; inbox 0 pending / 189 applied | issues:reconcile applied 17 requests with 3 cancellation decisions; check:outstanding-issues 341 rows (97 open, 244 archived), unique ids, next-id 344 above highest, no ids deleted from base; check:ledger-write-discipline passed for 2e3ac494b8b7..HEAD (canonical diff equals the recorded transaction); verify:pr-local docs-scoped route, 11 gates, none failed |
diff --git a/docs/branch-review-records/bde56718d14d5138e7a29a72d16402b4445bd109c6f2bfcffd686c6e436d8c74.record.md b/docs/branch-review-records/bde56718d14d5138e7a29a72d16402b4445bd109c6f2bfcffd686c6e436d8c74.record.md
new file mode 100644
index 0000000000..21f4011c7a
--- /dev/null
+++ b/docs/branch-review-records/bde56718d14d5138e7a29a72d16402b4445bd109c6f2bfcffd686c6e436d8c74.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/pwa-install-polish-20260815 | 80eb8f6d1c332ee5c32a27da93eb026fb6d9b0d1 | PWA stylesheet design-token contract remediation | Replaced PR-introduced raw PWA motion, padding, radius, gap, and line-height declarations with scoped semantic roles and existing design tokens; preserved rendered values. | git diff --check; manual CSS-contract audit (no new raw guarded declarations); static gate unavailable locally: @typescript/typescript6 not installed |
diff --git a/docs/branch-review-records/beb5fe80c053cc8851671deef0ce7cd98c6faddaa53896ff35345ca396b74fc6.record.md b/docs/branch-review-records/beb5fe80c053cc8851671deef0ce7cd98c6faddaa53896ff35345ca396b74fc6.record.md
new file mode 100644
index 0000000000..3fc4349787
--- /dev/null
+++ b/docs/branch-review-records/beb5fe80c053cc8851671deef0ce7cd98c6faddaa53896ff35345ca396b74fc6.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/fix-documents-without-live-images | 5a2530ee107a1c849dafb716deca462bcaca848e | Document cover thumbnail audit and repair | Preserved generation fences and storage cleanup P2 fixes while merging the latest base; reconciled the archived repair-script path and verified no new P0-P2 finding. | git diff --check; node --check archive script; ledger inbox/outstanding-issues/branch-ledger/discipline guards; cover repair/archive static contracts; focused Vitest attempted but unavailable because the isolated worktree has no node_modules |
diff --git a/docs/branch-review-records/bef6e7b39ba0aa36284eab8596c7dc491e54c41d2868644d05d96de656d0fe06.record.md b/docs/branch-review-records/bef6e7b39ba0aa36284eab8596c7dc491e54c41d2868644d05d96de656d0fe06.record.md
new file mode 100644
index 0000000000..67b783dabb
--- /dev/null
+++ b/docs/branch-review-records/bef6e7b39ba0aa36284eab8596c7dc491e54c41d2868644d05d96de656d0fe06.record.md
@@ -0,0 +1 @@
+| 2026-08-16 | PR-2008 / codex/tools-show-all-20260816 | 74f618c8c6b3a5ec2099ab070cd198ddf70a3f1c | PR #2008 content-address repair and latest-base refresh | Corrected the malformed review-record filename to the repository-derived SHA-256 path without changing its row bytes; merged main 3f33068da16ef8a3235359ff974c9314cf79d758, whose API response-parsing changes and two review records do not overlap this PR's launcher or focused UI test; no new P0/P1/P2 defects confirmed | Exact-head CI reproduced the ledger guard failure; canonical path b50552bc27edf96d286fcb2c582831863c1893c66a80b3dc38988a8ef6ef5dc0 derived from reviewRecordPath; 4c52fe1dbbc921be769c31b36efbcdba798ba11b-to-3f33068da16ef8a3235359ff974c9314cf79d758 compare reviewed; prior b089bf262b1aff99f57b22e45cbd941e815175c1 exact-head required CI passed; final head requires rerun |
diff --git a/docs/branch-review-records/c0745ca069118cbdc5b5a01db696a7e7b68f83afb90f34c467a97b28ecf12fc0.record.md b/docs/branch-review-records/c0745ca069118cbdc5b5a01db696a7e7b68f83afb90f34c467a97b28ecf12fc0.record.md
new file mode 100644
index 0000000000..186074bfdc
--- /dev/null
+++ b/docs/branch-review-records/c0745ca069118cbdc5b5a01db696a7e7b68f83afb90f34c467a97b28ecf12fc0.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/differential-results-ui-20260814 | 80a00d0cb97194f62cb5c37170f6c30121d3b78c | Differentials mobile rank formatter correction | Restored Prettier canonical call-chain wrapping for the mobile rank calculation; no behavior change. | git diff --check; canonical formatter layout compared with retained repository review commit; focused tests unavailable locally: vitest is not installed |
diff --git a/docs/branch-review-records/c0e02ee4e90a6401ef8316af58b1bf530d74e359a217e4d91d21eae705b7ab81.record.md b/docs/branch-review-records/c0e02ee4e90a6401ef8316af58b1bf530d74e359a217e4d91d21eae705b7ab81.record.md
new file mode 100644
index 0000000000..36caa306c4
--- /dev/null
+++ b/docs/branch-review-records/c0e02ee4e90a6401ef8316af58b1bf530d74e359a217e4d91d21eae705b7ab81.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | claude/db-remediation-phase-0-wfaiyl | 08a49b316b505a5ef39d0e7fd514a7ece7993f8f | PR #1951 review-and-fix | fixed stale pending cancellation after base reconciliation; preserved only valid remaining queue mutations | offline: reproduced docs:check-links failure; docs:check-links pass after fix; check-outstanding-issues; ledger-inbox check; Prettier affected requests; git diff --check |
diff --git a/docs/branch-review-records/c56fc20eb8b758bec749726901ef79ce50012974b924d01bcc5b55b6dc00d1ad.record.md b/docs/branch-review-records/c56fc20eb8b758bec749726901ef79ce50012974b924d01bcc5b55b6dc00d1ad.record.md
new file mode 100644
index 0000000000..5487a026f4
--- /dev/null
+++ b/docs/branch-review-records/c56fc20eb8b758bec749726901ef79ce50012974b924d01bcc5b55b6dc00d1ad.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | 1976 | 81c44aee0b788a5aa93522a09092cddcd12b0bf0 | review-and-fix | CI blocker fixed: register compact native-install CSS selectors in the unlayered style inventory | style-contract registry 15/15; PWA DOM 10/10; PWA Chromium 5/5; Lighthouse exact-head green |
diff --git a/docs/branch-review-records/c7a8273f16ecbd3771d5a703a01cb219557f400ee0e274af7e1ce61963db465b.record.md b/docs/branch-review-records/c7a8273f16ecbd3771d5a703a01cb219557f400ee0e274af7e1ce61963db465b.record.md
new file mode 100644
index 0000000000..f8313b307c
--- /dev/null
+++ b/docs/branch-review-records/c7a8273f16ecbd3771d5a703a01cb219557f400ee0e274af7e1ce61963db465b.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | PR-1958 | d5acb3e677556420df94a0adf8fbeba06ce5dc73 | Tools mode navigation; shared-home route contract; docs/branch-review-records | fixed Tools preference persistence and stale CI source-contract assertion; merged latest main | manual adversarial review; targeted source contracts; git merge-tree; git diff --check; docs links; ledger inbox; ledger guards; focused Vitest unavailable (node_modules absent) |
diff --git a/docs/branch-review-records/c87cf33f8557b35b1edb08b1fc38f1a5a415ce87df2c2daba46045b0b84391ab.record.md b/docs/branch-review-records/c87cf33f8557b35b1edb08b1fc38f1a5a415ce87df2c2daba46045b0b84391ab.record.md
new file mode 100644
index 0000000000..f5594b258e
--- /dev/null
+++ b/docs/branch-review-records/c87cf33f8557b35b1edb08b1fc38f1a5a415ce87df2c2daba46045b0b84391ab.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/rag-zod-hardening-tranche2 | 20304ddc703fdc6913e1b62ad532b552ff919dac | RAG row-contract tranche 2: optional signal shape-mismatch degradation; merged main | Approved with P1 fix — malformed optional embedding-field/index-unit rows are logged and degrade to no signal candidates, preserving chunk retrieval; no ranking, ordering, or clinical-output contract changed | manual adversarial control-flow review; git diff --check; ci-change-scope self-test; ledger/inbox/outstanding/discipline guards passed; targeted Vitest blocked: node_modules/vitest absent |
diff --git a/docs/branch-review-records/c9661626e5c2a0e5f848b375b83006a00452994ad503349944c2fb345c8b42a1.record.md b/docs/branch-review-records/c9661626e5c2a0e5f848b375b83006a00452994ad503349944c2fb345c8b42a1.record.md
new file mode 100644
index 0000000000..7aa89a6953
--- /dev/null
+++ b/docs/branch-review-records/c9661626e5c2a0e5f848b375b83006a00452994ad503349944c2fb345c8b42a1.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | claude/playwright-tsconfig-isolation | a5af47d083091a44cf515bed031d7cbd1bea3ea7 | scripts/run-playwright.mjs | FIXED - isolated child tsconfig given explicit include/exclude, empirically reproduced and verified | typecheck,verify:ui-focused-repro |
diff --git a/docs/branch-review-records/c9a0488b91b894d94e2d4e04dcafc9695eafe28d82fda3e3c9386541fb3aaec0.record.md b/docs/branch-review-records/c9a0488b91b894d94e2d4e04dcafc9695eafe28d82fda3e3c9386541fb3aaec0.record.md
new file mode 100644
index 0000000000..6fa577d821
--- /dev/null
+++ b/docs/branch-review-records/c9a0488b91b894d94e2d4e04dcafc9695eafe28d82fda3e3c9386541fb3aaec0.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/medication-list-spacing-20260814 | f38d4da8bc54dbe37fae0de7602a71b4fcd1a6a6 | Medication prescribing desktop grid width and row overflow | Confirmed the prior P2 grid-width fix remains present and merged current main to keep the PR current. | git diff --check; ledger inbox/outstanding-issues/ledger-discipline guards; direct 1024px minimum-grid calculation; Playwright unavailable because this isolated worktree has no node_modules |
diff --git a/docs/branch-review-records/cc0db6b399e9168bfe40fd9cdce6209b623eaa682ce4b9524e6eed48ee04a235.record.md b/docs/branch-review-records/cc0db6b399e9168bfe40fd9cdce6209b623eaa682ce4b9524e6eed48ee04a235.record.md
new file mode 100644
index 0000000000..05cf676adc
--- /dev/null
+++ b/docs/branch-review-records/cc0db6b399e9168bfe40fd9cdce6209b623eaa682ce4b9524e6eed48ee04a235.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | claude/ledger-process-tooling-50uqfc | 893f481005a66d6e2304396284e1aec63dbf3ae0 | PR #1944 CI-blocker fix | Removed cancellation targeting an already applied inbox request | docs:check-links, check:outstanding-issues, check:ledger-write-discipline |
diff --git a/docs/branch-review-records/ccf620aa5c3871b3787e29f50511d79a9a9ba43bc3591b8d0e1bd117ed930ea5.record.md b/docs/branch-review-records/ccf620aa5c3871b3787e29f50511d79a9a9ba43bc3591b8d0e1bd117ed930ea5.record.md
new file mode 100644
index 0000000000..07da5c66ee
--- /dev/null
+++ b/docs/branch-review-records/ccf620aa5c3871b3787e29f50511d79a9a9ba43bc3591b8d0e1bd117ed930ea5.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/favourites-hybrid-164 | 02672320db5a0b5b57b589e8d19d19c8c66483d4 | Favourites search-led workspace: retire marketing H1 and library nav, live in-place filter, dashboard band (#164) | Shipped; no P0-P2 findings | verify:pr-local all 10 selected gates passed — unit suite 607 files / 6584 passed, 4 skipped; check:design-system-contract passed with edgeOwnershipConflicts 25 to 24 from the deleted nav module; UI delegated to CI Production UI — chromium-1194 vs pinned 1234 (#255/#312) |
diff --git a/docs/branch-review-records/cd495affb93b35a4c9c27292318bff9bf09cbe3e2cf670a084930b870cd6fed6.record.md b/docs/branch-review-records/cd495affb93b35a4c9c27292318bff9bf09cbe3e2cf670a084930b870cd6fed6.record.md
new file mode 100644
index 0000000000..f3efa53446
--- /dev/null
+++ b/docs/branch-review-records/cd495affb93b35a4c9c27292318bff9bf09cbe3e2cf670a084930b870cd6fed6.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/test-source-contract-hardening | 0c1459ca2985e409d330d290a6518fdf877d3255 | review-and-fix | Fixed two P2 fail-open cases in the new source-window helper: overlapping repeated starts and empty markers; merged latest main | focused Vitest 49/49; format:changed; changed-file ESLint; source typecheck; outstanding-issues and ledger guards |
diff --git a/docs/branch-review-records/cebd03715e584420f2fb63b757718fd8f04e9dfb00089261c37800f7d8edf694.record.md b/docs/branch-review-records/cebd03715e584420f2fb63b757718fd8f04e9dfb00089261c37800f7d8edf694.record.md
new file mode 100644
index 0000000000..e86692ee4a
--- /dev/null
+++ b/docs/branch-review-records/cebd03715e584420f2fb63b757718fd8f04e9dfb00089261c37800f7d8edf694.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/pwa-install-polish-20260815 | 80fd6c04afdfa30e92c1cdf2ea5ba9d3d32a02c6 | PWA phone install/composer overlap regression | Restored the shared phone composer reserve for mode-home install sheets after the exact-head production UI geometry test found a 390px overlap. | git diff --check 0dd4b7e9be293815ec3d06f3b57682a1578bafe4; node scripts/ledger-inbox.mjs check; node scripts/check-outstanding-issues.mjs; node scripts/ci-change-scope.mjs --self-test; exact-head production UI geometry failure reviewed |
diff --git a/docs/branch-review-records/d05426d18a2ed15eb393d7bc70c57358211520ff473b1e56d7fa4d4551f1c5b3.record.md b/docs/branch-review-records/d05426d18a2ed15eb393d7bc70c57358211520ff473b1e56d7fa4d4551f1c5b3.record.md
new file mode 100644
index 0000000000..422381ad83
--- /dev/null
+++ b/docs/branch-review-records/d05426d18a2ed15eb393d7bc70c57358211520ff473b1e56d7fa4d4551f1c5b3.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | claude/gate2-viewport-determinism | f3bcced51d533d28c965277b6ab6875ad947d9b7 | PR #1962: deterministic Gate 2 tap-carrier enumeration | fixed | Prettier; explicit source-contract review; independent Codex adversarial review; Playwright delegated to exact-head CI (isolated worktree lacks dependencies) |
diff --git a/docs/branch-review-records/d50a877214261c376d150342864090de1d5f90e53c3187b03f4165df702e9b5d.record.md b/docs/branch-review-records/d50a877214261c376d150342864090de1d5f90e53c3187b03f4165df702e9b5d.record.md
new file mode 100644
index 0000000000..a4f7f63491
--- /dev/null
+++ b/docs/branch-review-records/d50a877214261c376d150342864090de1d5f90e53c3187b03f4165df702e9b5d.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/ledger-guard-ci-followups | 8fe2a50b9bce29e24710fdf72ce8b5f187c0569e | Lexicon-report CI freshness and database remediation sequencing | Fixed P1 prerequisite order and P2 generated-report scope gap; merged current base with no conflicts | git diff --check; ci-change-scope direct-report classification and self-test; GitHub Actions pin check; remediation-order/workflow-contract assertions; ledger-inbox; outstanding-issues; branch-review-ledger; ledger-write-discipline; focused Vitest unavailable (node_modules absent) |
diff --git a/docs/branch-review-records/d545333169b6e7645c813d4f760bcc8d901cef851b57bccb7874d8d6ff114f54.record.md b/docs/branch-review-records/d545333169b6e7645c813d4f760bcc8d901cef851b57bccb7874d8d6ff114f54.record.md
new file mode 100644
index 0000000000..abaf23f90b
--- /dev/null
+++ b/docs/branch-review-records/d545333169b6e7645c813d4f760bcc8d901cef851b57bccb7874d8d6ff114f54.record.md
@@ -0,0 +1 @@
+| 2026-08-16 | codex/chat-browser-evidence-235-238-browser-evidence-235-238 | 2d0126d6dd3b3727e8a99549a5e0d3678039960c | PR #2006 AccessibleTable low-confidence 320px mockup journey | No high-confidence PR-introduced defects found; branch required a non-overlapping latest-main merge | Distinct manual adversarial source-contract pass and deterministic normalizer proof passed; exact-head PR required, static, build, unit coverage, Production UI, Advisory UI, SAST, and Secret Scan passed |
diff --git a/docs/branch-review-records/d566ba015a558b6a48c81f5c8d59fd2b19edd41a2f38f86c05ae354673816ce5.record.md b/docs/branch-review-records/d566ba015a558b6a48c81f5c8d59fd2b19edd41a2f38f86c05ae354673816ce5.record.md
new file mode 100644
index 0000000000..60a40dbbb8
--- /dev/null
+++ b/docs/branch-review-records/d566ba015a558b6a48c81f5c8d59fd2b19edd41a2f38f86c05ae354673816ce5.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/services-search-redesign-163 | c6247862cb109e795f73b8aeeeb971436016c6c4 | PR #1982 base sync | Merged main 6f7b7deefaf7e0cd062b748f18fc6ca8988093f6 into the reviewed PR head; merge tree was clean. | git merge-tree --write-tree exact-head main: clean; git diff --check; ledger guards. |
diff --git a/docs/branch-review-records/df5b100555e4f07ef667054d2a80ba9f10ada2f3ebe7fab5da0edc041142a1c1.record.md b/docs/branch-review-records/df5b100555e4f07ef667054d2a80ba9f10ada2f3ebe7fab5da0edc041142a1c1.record.md
new file mode 100644
index 0000000000..63c6dcebfb
--- /dev/null
+++ b/docs/branch-review-records/df5b100555e4f07ef667054d2a80ba9f10ada2f3ebe7fab5da0edc041142a1c1.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/differential-results-ui-20260814 | d12e0217c4adc057e27ad92fb5dad144ba38995a | Differentials pinned formatter exception (supersedes 2026-08-15 remediation) | Supersedes the prior formatter-remediation record: documented a one-statement Prettier exclusion after exact-head CI rejected both equivalent wraps of the rank identity predicate; no runtime behaviour changed. | git diff --check b7d2bbcc75f8e3aadf498575b2ae4c44ebd3cc79; node scripts/ledger-inbox.mjs check; node scripts/check-outstanding-issues.mjs; node scripts/check-branch-review-ledger.mjs; node scripts/check-ledger-write-discipline.mjs 6f7b7deefaf7e0cd062b748f18fc6ca8988093f6 HEAD; node scripts/ci-change-scope.mjs --self-test; exact-head static failures reviewed |
diff --git a/docs/branch-review-records/e28c56717b466a1206d6eea9b313f4a39e88a0195f76078511821ab44cc09456.record.md b/docs/branch-review-records/e28c56717b466a1206d6eea9b313f4a39e88a0195f76078511821ab44cc09456.record.md
new file mode 100644
index 0000000000..bc56f2235c
--- /dev/null
+++ b/docs/branch-review-records/e28c56717b466a1206d6eea9b313f4a39e88a0195f76078511821ab44cc09456.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/rag-zod-hardening-tranche2 | 690204f669db3be9995b6c658ad2eb35befbdace | RAG signal-row formatter follow-up | Formatted the signal-row regression assertion reported by changed-file formatting. Targeted Vitest unavailable because this isolated worktree has no node_modules/vitest. | node --check tests/rag-retrieval-row-contract.test.ts; git diff --check; ledger-inbox; outstanding-issues; branch-review-ledger; ledger-write-discipline; ci-change-scope --self-test |
diff --git a/docs/branch-review-records/ec64a2232c6a292e1ca38a08fc425f5194177a6bbdef0d1c83cfdba62a110cd4.record.md b/docs/branch-review-records/ec64a2232c6a292e1ca38a08fc425f5194177a6bbdef0d1c83cfdba62a110cd4.record.md
new file mode 100644
index 0000000000..fe1e805f44
--- /dev/null
+++ b/docs/branch-review-records/ec64a2232c6a292e1ca38a08fc425f5194177a6bbdef0d1c83cfdba62a110cd4.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | codex/medication-info-header-20260814 | 76a67c8cbd3e94f9a292dafeca7d17738ddee53b | medication information header expansion and desktop polish | Supersedes the pre-rebase review record; no P0-P2 findings and ready for PR handoff | DOM 38/38 and focused Chromium 1/1 passed; PR-local runtime, lock parity, formatting, and lint passed; remaining aggregate stages blocked by shared test-run contention |
diff --git a/docs/branch-review-records/eee79235c4e2d7ed08fd81dccf399317a3b8c870210d155da52c563fca1d97d9.record.md b/docs/branch-review-records/eee79235c4e2d7ed08fd81dccf399317a3b8c870210d155da52c563fca1d97d9.record.md
new file mode 100644
index 0000000000..ccad21b8ad
--- /dev/null
+++ b/docs/branch-review-records/eee79235c4e2d7ed08fd81dccf399317a3b8c870210d155da52c563fca1d97d9.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | work | 3d5cd7cb8b0d22fc95d3e04a495cfae8533bda17 | document search image availability and loading | Found and fixed cover audit skipping existing rows; live apply blocked by missing Supabase credentials | node --check; focused Vitest; format; live apply attempted (environment blocked) |
diff --git a/docs/branch-review-records/f0bc08ea7f5c5c924273de2608597dddb1e7c8c43197488836bb70a79c6d366b.record.md b/docs/branch-review-records/f0bc08ea7f5c5c924273de2608597dddb1e7c8c43197488836bb70a79c6d366b.record.md
new file mode 100644
index 0000000000..688e3f4f9d
--- /dev/null
+++ b/docs/branch-review-records/f0bc08ea7f5c5c924273de2608597dddb1e7c8c43197488836bb70a79c6d366b.record.md
@@ -0,0 +1 @@
+| 2026-08-16 | codex/tools-universal-footer-search | 58821ca016b39933eaa9bf2a756672a71171923f | PR #1993 Tools phone footer ownership against main 0b95d063b44712ce409d9fbfe5bf8e706b10ccaf | Confirmed and fixed dashboard Tools phone composer ownership, aligned stale responsive contracts, removed the temporary repair workflow, and kept the branch current with main. | Prettier; ESLint on changed files; TypeScript; targeted Vitest; immutable ledger validation |
diff --git a/docs/branch-review-records/f11604766bd32807910a04f2bc52664b0d8615e08db6094e54733085c7427d0c.record.md b/docs/branch-review-records/f11604766bd32807910a04f2bc52664b0d8615e08db6094e54733085c7427d0c.record.md
new file mode 100644
index 0000000000..1e324c7d07
--- /dev/null
+++ b/docs/branch-review-records/f11604766bd32807910a04f2bc52664b0d8615e08db6094e54733085c7427d0c.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/ds-gates-265 | a1e5c9e9926c59ea9a0a1875ca2ea5ba49c064f2 | review-and-fix | Fixed two P2 gate bypasses: comparable arbitrary min-heights and reachable conditional/composed branches now fail below 48px; merged latest main | focused Vitest 36/36; design-system contract; format:changed; changed-file ESLint; source typecheck; gate-manifest; outstanding-issues and ledger guards |
diff --git a/docs/branch-review-records/f1fda63bd3854860481ab01a098aff859e2c8d4ea54160fe52e351afd389f9de.record.md b/docs/branch-review-records/f1fda63bd3854860481ab01a098aff859e2c8d4ea54160fe52e351afd389f9de.record.md
new file mode 100644
index 0000000000..622fc7801c
--- /dev/null
+++ b/docs/branch-review-records/f1fda63bd3854860481ab01a098aff859e2c8d4ea54160fe52e351afd389f9de.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/ds-gates-265 | 6de09c409645cd854438c819250aa668b661568e | DS gate 2: interactiveTapFloorDeclarations ratchet closing the h-10 case, plus GATES.md figure corrections (#265) | Gate 2 closed for new use; gate 8 stopped deliberately with the reason recorded; gate 7 untouched | verify:pr-local all 17 selected gates passed — unit suite 607 files / 6585 passed, 4 skipped; check:design-system-contract mutation-verified (interactiveTapFloorDeclarations increased from 41 to 42 plus the per-path line); check:gate-manifest OK at 35 gates / 32 static; no Chromium available (chromium-1194 vs pinned 1234, #255/#312) so no browser gate was claimed |
diff --git a/docs/branch-review-records/f238bb27fa4754ee4948d68b3019e4fb8d9da4ee00a7b78131ef1396fca2dfc8.record.md b/docs/branch-review-records/f238bb27fa4754ee4948d68b3019e4fb8d9da4ee00a7b78131ef1396fca2dfc8.record.md
new file mode 100644
index 0000000000..219b4a5c9d
--- /dev/null
+++ b/docs/branch-review-records/f238bb27fa4754ee4948d68b3019e4fb8d9da4ee00a7b78131ef1396fca2dfc8.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/medication-info-header-20260814 | 3a42e16a8d582174770740a9a8210f3eb2ae377b | Medication information navigation: final current-base merge | Merged latest required base after prior focused alias correction; no conflicts or new confirmed P0-P2 findings | git diff --check; ledger-inbox; outstanding-issues; branch-review-ledger; ledger-write-discipline; responsive shadow-alias assertion |
diff --git a/docs/branch-review-records/f2f43e75cc44bf4d80d3e6bddb9f6844548e9f4d84b79b828a42a53505e3ff5c.record.md b/docs/branch-review-records/f2f43e75cc44bf4d80d3e6bddb9f6844548e9f4d84b79b828a42a53505e3ff5c.record.md
new file mode 100644
index 0000000000..6cb89df155
--- /dev/null
+++ b/docs/branch-review-records/f2f43e75cc44bf4d80d3e6bddb9f6844548e9f4d84b79b828a42a53505e3ff5c.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | claude/ledger-process-tooling-50uqfc | 93365d6e4e496c233e629d85a572f3feb08513cf | outstanding-issues reconciliation of 35 queued requests (fresh base 0011a058) | PR #1956 — one serial reconciliation transaction from a fresh origin/main base, restarting the branch after its previous PR (#1944) merged as squash 372cb13f. 35 requests applied: 17 done, 7 add, 6 update, 5 cancel; ledger 328 to 334 rows, 115 to 99 open. Machine-generated and machine-verified end to end; no request or canonical row was hand-edited. Includes the five requests PR #1944 left pending: closes #313, carries #211 forward with a re-measured 1,445 errors while keeping its deprioritisation and P3 priority, records #168 and #258 without closing either, and opens #335. One request deliberately not re-filed: cancel a8783c79, whose target 0e47904b was already consumed by the reconcile in PR #1936, making it invalid; nothing lost because the surviving #211 update folds its text forward. Visual HTML register NOT refreshed — its PowerShell refresh script is a Windows path unavailable in this Linux container; Markdown source is current, artifact is stale. | npm run verify:pr-local — 11 gates completed, 0 failed; npm run check:ledger-write-discipline printed "Ledger write discipline passed for 0011a058fd1d..HEAD", independently recomputing the transaction; check:outstanding-issues 334 rows (99 open, 235 archived), unique ids, next-id=337 above the highest, 0 pending requests, 129 applied; the pre-existing check:medication-lexicon-report failure seen on PR #1944 is gone, confirming PR #1941 fixed it at source. Note: run before committing, check:ledger-write-discipline correctly REFUSED to report a verdict and named every uncommitted request file — the guard PR #1944 shipped, working on the first real reconciliation after it landed. |
diff --git a/docs/branch-review-records/f4aa3dfaabe1e3f82d0b8e20729b1c40648e1632d2645016ce189113e6f4a1b3.record.md b/docs/branch-review-records/f4aa3dfaabe1e3f82d0b8e20729b1c40648e1632d2645016ce189113e6f4a1b3.record.md
new file mode 100644
index 0000000000..522cdea0c9
--- /dev/null
+++ b/docs/branch-review-records/f4aa3dfaabe1e3f82d0b8e20729b1c40648e1632d2645016ce189113e6f4a1b3.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/differential-results-ui-20260814 | d12e0217c4adc057e27ad92fb5dad144ba38995a | PR #1971 differential result formatter follow-up | Reverted a manual binary-expression wrap: the exact line is 115 columns and must remain inline under the repository 120-column Prettier contract. | git diff --check; ledger/outstanding/branch-ledger/ledger-discipline guards; ci-change-scope self-test passed; npm test -- tests/differentials-compare-selection.dom.test.tsx unavailable: node_modules/vitest/vitest.mjs absent. |
diff --git a/docs/branch-review-records/f502c5ed1c220bc23384ffbdff722ab7753e5c619599c803531d4bc36c6914ce.record.md b/docs/branch-review-records/f502c5ed1c220bc23384ffbdff722ab7753e5c619599c803531d4bc36c6914ce.record.md
new file mode 100644
index 0000000000..02eecd4138
--- /dev/null
+++ b/docs/branch-review-records/f502c5ed1c220bc23384ffbdff722ab7753e5c619599c803531d4bc36c6914ce.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/medication-info-header-20260814 | 815bebba630ee808b4e3a5710fdb78a8433690a6 | Medication information navigation header | Fixed the PR-introduced retired shadow alias that failed the exact-head design-system contract, then merged current main. | git diff --check; ledger inbox/outstanding-issues/ledger-discipline guards; direct replacement assertion; design-system gate attempted but unavailable because this isolated worktree has no node_modules |
diff --git a/docs/branch-review-records/f51d7e3693e266ab35c224b3c487b3173a90a7780810546df0674fb7b35b7d50.record.md b/docs/branch-review-records/f51d7e3693e266ab35c224b3c487b3173a90a7780810546df0674fb7b35b7d50.record.md
new file mode 100644
index 0000000000..1ea3827a26
--- /dev/null
+++ b/docs/branch-review-records/f51d7e3693e266ab35c224b3c487b3173a90a7780810546df0674fb7b35b7d50.record.md
@@ -0,0 +1 @@
+| 2026-08-16 | codex/chat-trust-boundaries-212-trust-boundaries-212 | 89181a5c1f5a74ac08628a750c51d8e3819512c7 | PR #2003 post-review nullish list payload fix | Confirmed CodeRabbit finding: parseListRows coerced null and undefined dependency payloads to successful empty arrays; changed validation to reject nullish values and added focused null, undefined, and explicit empty-array regression coverage | Exact-head 89181a5c PR required, unit coverage, build, static checks, lint, typecheck, safety/config, ingestion SAST, CI-managed Lighthouse, SAST, and secret scan passed before the fix; final fix head requires CI rerun; local npm gates unavailable without a checkout |
diff --git a/docs/branch-review-records/f726c2e6e71b61720a0609b9fdfd96aac4292d00fcdac8e3629b2e8e1f3f4845.record.md b/docs/branch-review-records/f726c2e6e71b61720a0609b9fdfd96aac4292d00fcdac8e3629b2e8e1f3f4845.record.md
new file mode 100644
index 0000000000..9ad8dffd57
--- /dev/null
+++ b/docs/branch-review-records/f726c2e6e71b61720a0609b9fdfd96aac4292d00fcdac8e3629b2e8e1f3f4845.record.md
@@ -0,0 +1 @@
+| 2026-08-14 | claude/ledger-process-tooling-50uqfc | 58c4a3d5294ded839f7ff78c4bc18d6ece7522eb | PR #1944 CI format fix | Formatted two merge-loss review files | Prettier 3.9.6; audit self-test; JSON parse; docs:check-links |
diff --git a/docs/branch-review-records/f8f65adef944919407355aee8f60e939e4cc4398091af68728179d8b5b63e2e0.record.md b/docs/branch-review-records/f8f65adef944919407355aee8f60e939e4cc4398091af68728179d8b5b63e2e0.record.md
new file mode 100644
index 0000000000..fe9151ddb2
--- /dev/null
+++ b/docs/branch-review-records/f8f65adef944919407355aee8f60e939e4cc4398091af68728179d8b5b63e2e0.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/capture-ongoing-drop-question | 8aead5c4fa3ed588f63860b3dc96f54ba415da44 | required base sync through main 17402395 | Approved — required main update merged; prior drift-inference review remains applicable with no PR-path conflict | git diff --check; ci-change-scope self-test; ledger/inbox/outstanding/discipline guards passed |
diff --git a/docs/branch-review-records/fb53209f910afc80ba5fb207e1a2f36d30bc14b98d5c069c3e7fa8b7f89edee4.record.md b/docs/branch-review-records/fb53209f910afc80ba5fb207e1a2f36d30bc14b98d5c069c3e7fa8b7f89edee4.record.md
new file mode 100644
index 0000000000..9b39d22d9e
--- /dev/null
+++ b/docs/branch-review-records/fb53209f910afc80ba5fb207e1a2f36d30bc14b98d5c069c3e7fa8b7f89edee4.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/db-remediation-phase-0-wfaiyl | b55f7a4b5c02c8a0ca8e59fd2d9edfb7eaac0234 | Required base sync through main d301d8f4 | approved | git diff --check; guard self-test; ledger and issue guards |
diff --git a/docs/branch-review-records/fe8542d735a4d0a26e76906a700a861925da55131c0caacbaab18ac81507cd0d.record.md b/docs/branch-review-records/fe8542d735a4d0a26e76906a700a861925da55131c0caacbaab18ac81507cd0d.record.md
new file mode 100644
index 0000000000..2dfcd8bcfc
--- /dev/null
+++ b/docs/branch-review-records/fe8542d735a4d0a26e76906a700a861925da55131c0caacbaab18ac81507cd0d.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | codex/pwa-install-polish-20260815 | 233047f36f210f0e9ea4846183b2368ca67fa338 | Required base sync through main d301d8f4 | approved | git diff --check; CI scope self-test; ledger and issue guards |
diff --git a/docs/branch-review-records/fec8d16693dafc5f5c400815e091e8d8565e99f53e2979f061dd3cc68c012315.record.md b/docs/branch-review-records/fec8d16693dafc5f5c400815e091e8d8565e99f53e2979f061dd3cc68c012315.record.md
new file mode 100644
index 0000000000..992b15ca07
--- /dev/null
+++ b/docs/branch-review-records/fec8d16693dafc5f5c400815e091e8d8565e99f53e2979f061dd3cc68c012315.record.md
@@ -0,0 +1 @@
+| 2026-08-15 | claude/issues-reconcile-2026-08-15 | 2c0ca2c5c65065b2d39ab5465fce50c50eec5bb2 | review-and-fix | Found P2 stale #265 measurements in the reconciliation; queued an immutable correction with current 40/16 tap-floor and 19/10 edge-conflict counts; merged latest main | design-system contract; outstanding-issues and ledger-write-discipline guards; branch-review ledger; format; docs links |
diff --git a/docs/database-remediation-plan.md b/docs/database-remediation-plan.md
index 9bb9a18561..277b07e09c 100644
--- a/docs/database-remediation-plan.md
+++ b/docs/database-remediation-plan.md
@@ -3,14 +3,36 @@
 Owner: operator (Josh) + specialist session. Source findings: open ledger `#248` (whose causal
 conclusion awaits a read-only history and audit check) and the queued P1 live-drift follow-up.
 Companion evidence: live-drift Actions runs
-`30763871562` (2026-08-02) and
-`31330856982` (2026-08-09), PR #1614, `supabase/migrations/20260804110240_restore_rag_search_health_indexes.sql`.
-
-**Scope.** Fixes, in dependency order: the live-vs-repo schema gap (21 missing indexes, 2
-unexpected indexes, 10 diverged `match_*` RPC bodies), the unresolved cause of the affected
-migration history, drift-detection routing, and the surrounding database debt (`#102`, `#011`, `#036`,
-`#022`, `#025`, `#056`/`#057`, `#183`, `#188`/`#196`–`#200`, `#191`, `#098`/`#099`). Ends with
-standing protections so unverified history repairs remain visible and cannot silently mask drift.
+`30763871562` (2026-08-02), `31330856982` (2026-08-09) and
+`31813064485` (2026-08-14, the current measurement), PR #1614,
+`supabase/migrations/20260804110240_restore_rag_search_health_indexes.sql`.
+
+> **Status as of 2026-08-14.** Phase 0 is **complete** (routing, post-migration trigger, evidence
+> file, and the forced-dispatch proof — which auto-created issue **#1963**). Phase 1 is **partial**:
+> 1.1 and 1.3 were run in an owner-authorised incident window, but **1.2, the RPC divergence
+> dossier, is outstanding and is the gate for Phase 3**. Phase 4 is **partial**: the two
+> retrieval-critical trigram indexes were restored, ~20 remain.
+>
+> **Next step is Phase 1.2, not Phase 3.** Complete and review the RPC divergence dossier first,
+> then run the Phase 2 staging-parity rehearsal. Only after both prerequisites are complete may an
+> appropriately approved Phase 3 reconciliation proceed. Before starting any phase, check the
+> open-PR list for the surface first (`#292`): Phase 0 was independently built twice on 2026-08-14,
+> and Phases 3 and 4 spend approved production windows and eval-canary budget rather than just tokens.
+
+**Scope.** Fixes, in dependency order: the live-vs-repo schema gap, the unresolved cause of the
+affected migration history, drift-detection routing, and the surrounding database debt (`#102`,
+`#011`, `#036`, `#022`, `#025`, `#056`/`#057`, `#183`, `#188`/`#196`–`#200`, `#191`, `#098`/`#099`).
+Ends with standing protections so unverified history repairs remain visible and cannot silently mask
+drift.
+
+The schema gap, measured 2026-08-14 (superseding the 2026-08-09 figures this plan was written
+against):
+
+| Category                      | 2026-08-09 | 2026-08-14         |
+| ----------------------------- | ---------- | ------------------ |
+| diverged `match_*` RPC bodies | 10         | **10 — unchanged** |
+| `missing_live` indexes        | 21         | **20**             |
+| `unexpected_live` indexes     | 2          | **2 — unchanged**  |
 
 **Standing rules for every phase.** No hosted mutation without explicit approval for that phase.
 Never raw-SQL a drift fix — every live change is codified (migration + `schema.sql` mirror +
@@ -63,7 +85,7 @@ hypothesis into a named, evidence-backed conclusion.
 noise** (whitespace/qualifier only). No edits. This is the highest-stakes unknown in the whole
 plan — live retrieval behaviour may currently depend on bodies the repo does not contain.
 
-1.3 **Index inventory & sizing.** For the 21 missing and 2 unexpected indexes: owning-table
+1.3 **Index inventory & sizing.** For the 20 missing and 2 unexpected indexes: owning-table
 `pg_relation_size`, and `EXPLAIN (ANALYZE, BUFFERS)` for the known hot queries
 (`documents` title ILIKE, `document_chunks` content search, `rag_retrieval_logs` miss scan).
 These are the before-measurements for Phase 4, including the `#231` latency hypothesis.
diff --git a/docs/database-remediation-playbook.md b/docs/database-remediation-playbook.md
index d9d089aac1..0c8deceb92 100644
--- a/docs/database-remediation-playbook.md
+++ b/docs/database-remediation-playbook.md
@@ -19,19 +19,32 @@ migrations show that history advanced, but neither point distinguishes skipped D
 history from indexes that were created and later dropped. The Phase 1 read-only history and audit
 check must establish that cause before the row is closed or remediation is attributed to it.
 
-**Current live state** (from scheduled `live-drift.yml` Actions run `31330856982`, 2026-08-09):
+**Current live state** (from `live-drift.yml` Actions run `31813064485`, 2026-08-14 — this
+supersedes the 2026-08-09 run `31330856982` the plan was originally written against):
 
-- 21 `missing_live` indexes across many migrations — tables: `audit_logs` (2), `api_rate_limits`,
-  `document_chunks` (2, incl. `document_chunks_content_trgm_idx`), `document_images` (3),
-  `document_index_quality`, `document_index_units`, `document_publication_approvals`,
-  `document_summaries`, `documents` (2, incl. `documents_title_trgm_idx`),
+- 20 `missing_live` indexes across many migrations — tables: `audit_logs` (2), `api_rate_limits`,
+  `document_chunks`, `document_images` (3), `document_index_quality`, `document_index_units`,
+  `document_publication_approvals`, `document_summaries`, `documents`,
   `image_caption_cache`, `indexing_v3_agent_jobs`, `ingestion_job_stages`, `medication_records`,
   `rag_aliases`, `rag_queries`, `rag_query_misses`, `storage_cleanup_jobs`.
+  **`documents_title_trgm_idx` and `document_chunks_content_trgm_idx` are no longer among them** —
+  both were restored in the 2026-08-14 incident window and re-verified `indisvalid`/`indisready`.
 - 2 `unexpected_live` indexes: `document_table_facts_document_id_idx`,
   `storage_cleanup_jobs_owner_id_idx`.
-- `def_hash` mismatches on 10 `match_*` retrieval RPCs (protected RAG surface; live bodies vs
-  repo — direction unknown until diffed).
-- The weekly `live-drift` run has been red since 2026-07-26 with no notification routing.
+- `def_hash` mismatches on 10 `match_*` retrieval RPCs — **unchanged, and entirely outstanding**
+  (protected RAG surface; live bodies vs repo — direction unknown until diffed). This is now the
+  highest-stakes remaining unknown and the reason Phase 1.2 comes next.
+- Drift-failure routing is **live**: a failed run creates or updates the pinned issue
+  "Live drift check failing" (currently **#1963**) and a green run closes it.
+
+**Phase status.** Phase 0 complete. Phase 1 partial — 1.1 and 1.3 done in the owner-authorised
+incident window, **1.2 (RPC dossier) outstanding and gating Phase 3**. Phase 4 partial — two
+indexes restored, ~20 remain. **Next: complete Phase 1.2, then the Phase 2 staging-parity
+rehearsal; only then may an appropriately approved Phase 3 proceed.**
+
+**Before starting any phase, check the open-PR list for the surface** (`#292`). Phase 0 was built
+twice independently on 2026-08-14; a duplicate in Phase 3 or 4 wastes an approved production window
+and eval-canary budget, not just tokens.
 
 **Prior repair to imitate.** PR #1614 / migration `20260804110240_restore_rag_search_health_indexes.sql`
 is the approved pattern: operator prebuilds indexes with `CREATE INDEX CONCURRENTLY` outside any
@@ -70,7 +83,10 @@ mistakes. Opus is sufficient for Phases 0, 2, 4, 5, 7 — execution against this
 
 ---
 
-## Phase 0 — Enablement (repo-only; no approval window needed) · Opus · 2–4 h
+## Phase 0 — Enablement (repo-only; no approval window needed) · Opus · 2–4 h — **COMPLETE 2026-08-14**
+
+Delivered in PRs #1938, #1939 and #1951; the forced-dispatch proof is Actions run `31813064485`,
+which auto-created issue #1963. The prompt below is retained as history.
 
 Deliverables: drift-failure routing, post-migration drift trigger, evidence file scaffold.
 Definition of done: PR merged; `check:github-actions` and `verify:pr-local` green; a forced
@@ -119,7 +135,7 @@ conclusion for `#248`; no writes performed.
 > classify each as live-ahead, repo-ahead, or normalization noise, quoting the decisive diff hunks
 > — this is a protected RAG surface, so classification accuracy matters more than speed, and any
 > ambiguous diff is recorded as UNCLASSIFIED with the ambiguity explained, never guessed; (3) for
-> the 21 missing and 2 unexpected indexes, record owning-table pg_relation_size and run EXPLAIN
+> the 20 missing and 2 unexpected indexes, record owning-table pg_relation_size and run EXPLAIN
 > (ANALYZE, BUFFERS) for the documents title ILIKE query, the document_chunks content search, and
 > the rag_retrieval_logs miss scan as before-baselines. Write all evidence with dates and run IDs
 > into docs/audit/live-drift-forensics-2026-08.md, update the live-drift tracking item, commit, push, PR (docs-only;
@@ -169,7 +185,8 @@ allowlist entries); eval evidence attached for any behaviour-changing deploy.
 
 ## Phase 4 — Index restoration (approved off-peak production window) · Opus · 2–3 h active
 
-Prerequisites: Phases 1–3. Deliverables: 21 indexes restored + validated, 2 unexpected indexes
+Prerequisites: Phases 1–3. Deliverables: the ~20 still-missing indexes restored + validated (the two
+trigram indexes were already restored on 2026-08-14), 2 unexpected indexes
 dispositioned, guard migrations landed, live-drift green. Definition of done: green live-drift
 dispatch output pasted; `search_schema_health()` still `ok: true`.
 
diff --git a/docs/design-system/COMPONENTS.md b/docs/design-system/COMPONENTS.md
index e2eea76857..6e0d103d0e 100644
--- a/docs/design-system/COMPONENTS.md
+++ b/docs/design-system/COMPONENTS.md
@@ -1001,7 +1001,7 @@ This generated snapshot is a local source-derived inventory. It does not assert
 | `SearchField`            | controls | yes   | yes                | no                    | yes            | no                 |               0 |
 | `SegmentedControl`       | controls | yes   | yes                | inherited-global-root | yes            | no                 |              10 |
 | `Select`                 | controls | yes   | yes                | inherited-global-root | yes            | no                 |               2 |
-| `Sheet`                  | layout   | yes   | yes                | inherited-global-root | yes            | no                 |              26 |
+| `Sheet`                  | layout   | yes   | yes                | inherited-global-root | yes            | no                 |              25 |
 | `Skeleton`               | feedback | yes   | yes                | inherited-global-root | yes            | no                 |               6 |
 | `SourceDesignationBadge` | source   | yes   | yes                | inherited-global-root | yes            | no                 |               1 |
 | `SourceProvenance`       | source   | yes   | yes                | inherited-global-root | yes            | no                 |               1 |
diff --git a/docs/design-system/GATES.md b/docs/design-system/GATES.md
index 202fb362d1..9bb942a670 100644
--- a/docs/design-system/GATES.md
+++ b/docs/design-system/GATES.md
@@ -70,20 +70,20 @@ because it contributed nothing.
 
 ## 2 · The twelve system gates, labelled
 
-| #   | Gate                                                                                                                                                                                                               | Status                   | Evidence / path to blocking                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| --- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| 1   | Contrast ≥4.5:1 for every text/background pair, both themes, live **and** v2; `--decoration-soft` asserted below 4.5 and never on a text node                                                                      | **implemented-blocking** | v2 pairs + `--text-placeholder` + `--decoration-soft` tier + recipe AST (`decoration-on-text.contract.test.ts`); live full matrix remains follow-on.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| 2   | Tap targets ≥48px interactive (token + declared carriers today; fixed-height `h-10` controls and full interactive enumeration not yet blocked); static pills never carry `min-h-tap`; no production target reduced | **implemented-partial**  | Enforced today: `--spacing-tap` is 48px and pinned from both sides (`ckb-v2-token-contract` asserts the `@theme` knob is ≥48 and that `--tap-min` is its alias), `ui-style-contract` measures the rendered floor for declared `min-height` carriers in Chromium, and the legacy-class / literal ratchets still run. **Still open for the `h-10` case, and 9 Aug 2026 measured why.** An enumeration of _rendered interactive_ elements was written, shown to find genuine defects, and then **reverted rather than landed**: it is not deterministic on this route. Six runs against one production build returned 6, 5, 4, 3, 3 and 9 distinct sub-floor shapes, largely disjoint — one run saw the answer-suggestion chips and a sort band, another the settled results list. `waitForLoadState("networkidle")` plus deduplication to distinct shapes did not fix it, and two consecutive agreeing runs turned out to be coincidence. This spec runs in the required `Production UI` job, so an intermittent version of it would block every merge in the repo; that is a worse outcome than the gap it closes. Path to blocking: give the audit a deterministic surface — a static route or a fixed seeded state — before re-attempting it. **What the enumeration did establish, in every one of the six runs, is a live defect:** controls that carry `min-h-tap` compute `min-height: 0px` and render at 16–36px, six distinct shapes in total. The declared-carrier audit cannot report them by construction — it only measures elements already computing at or above the floor, so a floor overridden downward is skipped rather than flagged. Tracked as `#293`. **Correction, same date — "`test:e2e:style-contract` is not part of `verify:cheap`" was true and badly misleading, and it sent one session looking for a wiring bug that does not exist.** The npm script is only a convenience alias for running this one spec; the spec matches `productionSpecPattern` in `playwright.config.ts` and is listed explicitly in `scripts/playwright-pr-shards.mjs`, so it already runs in the `Production UI` job that `pr-required` demands on any UI-scoped PR. It must **not** be added to `verify:cheap:internal`: `check:gate-manifest` requires every gate in that chain to also run in `static-pr`, which has no browser and no server. Per-surface geometry stays in the held visual harness. |
-| 3   | Focus outline present, `--focus`, no companion ring                                                                                                                                                                | **planned**              | Corrected 6 Aug 2026: the previous evidence ("`--focus` is referenced nowhere in the DS export", finding N3) was false — **[verified: grep]** 4 declarations (2 theme, 2 forced-colours) against **273** `var(--focus)` consumers, 260 of them in `.tsx`. The token is adopted; the check is what is missing. Path to blocking: assert a visible focus outline on every interactive role and reject a `ring-*` companion on the same node. A row that understates shipped work costs the document its authority as surely as one that overstates it, and nobody files a bug against pessimism.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| 4   | Non-colour encoding on every status indicator                                                                                                                                                                      | **implemented-partial**  | Blocked today by `ui-v2-answer-safety.dom.test.tsx`: an overdue `DoseLine` row is asserted to carry all three channels (amber inset rule **plus** the words "Source review overdue" **plus** a `StatusMark` shape), `MissingValue` is asserted never to contract to a dash at any density, `FieldError` is asserted to pair its text with an icon, and `RetrievalStateBanner` is asserted to carry its state in the headline text rather than the tone alone. Off-vocabulary status still degrades to a phrase (`source-badges-off-vocab.dom.test.tsx`, Gate 6). **Not blocked today:** there is no repository-wide enumeration of status indicators, so a _new_ colour-only indicator elsewhere in `src/components/**` — the bare `statusDot*` recipes are the obvious candidates — would not fail anything. **Closed 9 Aug 2026 — the repository-wide enumeration now ships.** `colourOnlyStatusIndicators` (`check:design-system-contract`) flags a status hue on a box that says nothing: no children, no `aria-label`/`aria-labelledby`/`title` on it or any ancestor, no text sibling, and not a `StatusMark`. It also flags shared _swatch recipes_ — a status hue plus a tiny round box and no text utility — because the analyzer is per-file and cannot follow an imported `statusDotReady` to its call sites, so the recipe is where the defect is catchable. Ratcheted at **4** with per-path pins: the two bare `statusDot*` recipes GATES.md named, plus a calculator risk band and a therapy meter fill. A _new_ colour-only indicator anywhere in `src/**` now fails. Still partial: those 4 recorded sites, and `--decoration-soft` is deliberately out of scope (it carries no state).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| 5   | Tables: semantic caption, associated headers, `aria-controls` on the expander                                                                                                                                      | **implemented-blocking** | `AccessibleTableProps.caption` is required; DOM and alignment tests prove the semantic `<caption>`, associated headers, and expander relationship.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| 6   | Enum resilience — neutral fallback, never throws                                                                                                                                                                   | **implemented-blocking** | `source-badges-off-vocab.dom.test.tsx`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| 7   | Elevation monotonicity — no child heavier than its parent                                                                                                                                                          | **implemented-partial**  | Token-ramp monotonicity is tested; the per-surface child/parent rule is planned (needs a render-tree check).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| 8   | Edge ownership — no `border-*` + `ring-*` on one surface; no 1px spread in a drop shadow                                                                                                                           | **implemented-partial**  | Corrected 9 Aug 2026: the previous evidence — "the per-surface co-occurrence lint and spread-term check are planned (PR 9)" — was **false**, and had been since before this row was written. Both ship. `edgeOwnershipConflicts` is an AST co-occurrence check over resolved class roots (`BORDER_WIDTH_UTILITY` × `RING_WIDTH_UTILITY`), and `onePixelShadowSpreads` reads the fourth length of every `box-shadow` layer. Both ratchet **per path**, so a new conflict on any surface fails today. What is partial is the recorded debt, not the check: 27 conflicts across 15 files, and 2 spreads in `globals.css`. Path to blocking: retire that debt and pin both at zero. The spread form was chosen _because_ it is mechanically lintable, and it duly was.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| 9   | No layout-property animation; no hardcoded durations                                                                                                                                                               | **implemented-partial**  | Corrected 9 Aug 2026: "a layout-property lint is still planned" was **false**, and leaving it would have preserved the exact contradiction this pass exists to remove. `layoutTransitionExceptions` ships and ratchets **per path** against `SAFE_TRANSITION_PROPERTIES`, so a new layout-property transition in any file fails today; the phone chrome's intentional `grid-template-rows` / `height` / `padding-bottom` are among the 12 recorded exceptions rather than a gap. The Tailwind duration form is a **hard zero** (`hardcodedMotionClasses`), on top of PR-Arch tokenising production `duration-*`/`ease-*` literals onto `--duration-*` / `--ease-*` (Gate 10). What stays partial is recorded debt, not a missing check: 12 layout transitions and 42 CSS `hardcodedCssMotionDurations`. Path to blocking: retire those and pin both at zero.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| 10  | Named z and motion tokens have real consumers; no unapproved `z-` value                                                                                                                                            | **implemented-blocking** | PR-Arch: off-ladder `z-50` retired; toast at `--z-toast` (`z-[110]`, lint allowlist); motion literals map to named duration/ease tokens including phone-chrome hide/reveal pair. Dead `OverlayProvider` deleted.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| 11  | Published-type conformance — every `dtsPropsFor` entry exactly matches source props                                                                                                                                | **implemented-blocking** | `generate-design-sync-contract.mjs` uses the TypeScript checker to derive every public property from the exported source `*Props` type; `--check` and `check-design-sync-contract.mjs` reject drift, missing named types, or machine-specific declarations. Zero-prop visual roots are explicit.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| 12  | Publication coverage — every registered visual component has source, export, preview, prop contract and direct publication test                                                                                    | **implemented-blocking** | Registry/map/props parity and all 53 direct component rows are pinned by the design-sync contract and `design-sync-visual-exports.test.ts`. Behavioural, full visual-state, print, and browser acceptance remain separate gates; `DocumentFrame` is built shell-only in product but not yet among the 53 registered visual exports (print primitives remain specified-not-built).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| #   | Gate                                                                                                                                          | Status                               | Evidence / path to blocking                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| --- | --------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 1   | Contrast ≥4.5:1 for every text/background pair, both themes, live **and** v2; `--decoration-soft` asserted below 4.5 and never on a text node | **implemented-blocking**             | v2 pairs + `--text-placeholder` + `--decoration-soft` tier + recipe AST (`decoration-on-text.contract.test.ts`); live full matrix remains follow-on.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| 2   | Tap targets ≥48px interactive; static pills never carry `min-h-tap`; no production target reduced                                             | **implemented-blocking for new use** | Enforced today: `--spacing-tap` is 48px and pinned from both sides (`ckb-v2-token-contract` asserts the `@theme` knob is ≥48 and that `--tap-min` is its alias), `ui-style-contract` measures the rendered floor for declared `min-height` carriers in Chromium, and the legacy-class / literal ratchets still run. **Still open for the `h-10` case, and 9 Aug 2026 measured why.** An enumeration of _rendered interactive_ elements was written, shown to find genuine defects, and then **reverted rather than landed**: it is not deterministic on this route. Six runs against one production build returned 6, 5, 4, 3, 3 and 9 distinct sub-floor shapes, largely disjoint — one run saw the answer-suggestion chips and a sort band, another the settled results list. `waitForLoadState("networkidle")` plus deduplication to distinct shapes did not fix it, and two consecutive agreeing runs turned out to be coincidence. This spec runs in the required `Production UI` job, so an intermittent version of it would block every merge in the repo; that is a worse outcome than the gap it closes. Path to blocking: give the audit a deterministic surface — a static route or a fixed seeded state — before re-attempting it. **What the enumeration did establish, in every one of the six runs, is a live defect:** controls that carry `min-h-tap` compute `min-height: 0px` and render at 16–36px, six distinct shapes in total. The declared-carrier audit cannot report them by construction — it only measures elements already computing at or above the floor, so a floor overridden downward is skipped rather than flagged. Tracked as `#293`. **Correction, same date — "`test:e2e:style-contract` is not part of `verify:cheap`" was true and badly misleading, and it sent one session looking for a wiring bug that does not exist.** The npm script is only a convenience alias for running this one spec; the spec matches `productionSpecPattern` in `playwright.config.ts` and is listed explicitly in `scripts/playwright-pr-shards.mjs`, so it already runs in the `Production UI` job that `pr-required` demands on any UI-scoped PR. It must **not** be added to `verify:cheap:internal`: `check:gate-manifest` requires every gate in that chain to also run in `static-pr`, which has no browser and no server. Per-surface geometry stays in the held visual harness. **Both named gaps are now closed, 15 Aug 2026.** The rendered enumeration landed first: `885c613` (PR #1962) added the deterministic phone-viewport `min-h-tap` audit this row was waiting on — `/forms`'s fixed-array home rather than a live-search route, polled until three consecutive reads agree, explicitly sorted, and asserted identical across three full navigate-and-enumerate cycles. The `h-10` case is closed here by `interactiveTapFloorDeclarations` in `check:design-system-contract`: an interactive element (`a`, `button`, `input`, `select`, `summary`, `textarea`) declaring its own **unprefixed** `min-h-*` below the 48px token. Comparable arbitrary lengths and mutually exclusive/composed class branches are evaluated independently, so one safe branch cannot hide a sub-floor runtime path. Ratcheted at **40** across 16 files with per-path pins, so a new sub-floor control anywhere in `src/**` fails today. Mutation-verified: lowering one shortlist button to `min-h-9` produces both the total and matching per-path regression. **Deliberately scoped to `min-h-*`, not `h-*`/`size-*`:** a short `h-4` on an interactive element is routinely the visible box of a control whose hit area is owned by a tap-sized wrapper (`SelectionCheckbox` in `differentials-home.tsx`, whose label `ui-smoke` asserts still meets the floor), so flagging those would pad the baseline with non-defects — the §5 failure mode. **One known limit, recorded rather than hidden:** the walker sees intrinsic lowercase tags only, so a floor declared on `<Link>` or another component wrapper is invisible to it (the pre-existing `legacyTapClasses` check has the same blind spot). The 40 recorded sites are real debt still owed, tracked in `#265`. |
+| 3   | Focus outline present, `--focus`, no companion ring                                                                                           | **planned**                          | Corrected 6 Aug 2026: the previous evidence ("`--focus` is referenced nowhere in the DS export", finding N3) was false — **[verified: grep]** 4 declarations (2 theme, 2 forced-colours) against **273** `var(--focus)` consumers, 260 of them in `.tsx`. The token is adopted; the check is what is missing. Path to blocking: assert a visible focus outline on every interactive role and reject a `ring-*` companion on the same node. A row that understates shipped work costs the document its authority as surely as one that overstates it, and nobody files a bug against pessimism.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| 4   | Non-colour encoding on every status indicator                                                                                                 | **implemented-blocking for new use** | Blocked today by `ui-v2-answer-safety.dom.test.tsx`: an overdue `DoseLine` row is asserted to carry all three channels (amber inset rule **plus** the words "Source review overdue" **plus** a `StatusMark` shape), `MissingValue` is asserted never to contract to a dash at any density, `FieldError` is asserted to pair its text with an icon, and `RetrievalStateBanner` is asserted to carry its state in the headline text rather than the tone alone. Off-vocabulary status still degrades to a phrase (`source-badges-off-vocab.dom.test.tsx`, Gate 6). **Not blocked today:** there is no repository-wide enumeration of status indicators, so a _new_ colour-only indicator elsewhere in `src/components/**` — the bare `statusDot*` recipes are the obvious candidates — would not fail anything. **Closed 9 Aug 2026 — the repository-wide enumeration now ships.** `colourOnlyStatusIndicators` (`check:design-system-contract`) flags a status hue on a box that says nothing: no children, no `aria-label`/`aria-labelledby`/`title` on it or any ancestor, no text sibling, and not a `StatusMark`. It also flags shared _swatch recipes_ — a status hue plus a tiny round box and no text utility — because the analyzer is per-file and cannot follow an imported `statusDotReady` to its call sites, so the recipe is where the defect is catchable. Ratcheted at **4** with per-path pins: the two bare `statusDot*` recipes GATES.md named, plus a calculator risk band and a therapy meter fill. A _new_ colour-only indicator anywhere in `src/**` now fails. Still partial: those 4 recorded sites, and `--decoration-soft` is deliberately out of scope (it carries no state).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| 5   | Tables: semantic caption, associated headers, `aria-controls` on the expander                                                                 | **implemented-blocking**             | `AccessibleTableProps.caption` is required; DOM and alignment tests prove the semantic `<caption>`, associated headers, and expander relationship.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| 6   | Enum resilience — neutral fallback, never throws                                                                                              | **implemented-blocking**             | `source-badges-off-vocab.dom.test.tsx`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| 7   | Elevation monotonicity — no child heavier than its parent                                                                                     | **implemented-partial**              | Token-ramp monotonicity is tested; the per-surface child/parent rule is planned (needs a render-tree check).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| 8   | Edge ownership — no `border-*` + `ring-*` on one surface; no 1px spread in a drop shadow                                                      | **implemented-partial**              | Corrected 9 Aug 2026: the previous evidence — "the per-surface co-occurrence lint and spread-term check are planned (PR 9)" — was **false**, and had been since before this row was written. Both ship. `edgeOwnershipConflicts` is an AST co-occurrence check over resolved class roots (`BORDER_WIDTH_UTILITY` × `RING_WIDTH_UTILITY`), and `onePixelShadowSpreads` reads the fourth length of every `box-shadow` layer. Both ratchet **per path**, so a new conflict on any surface fails today. What is partial is the recorded debt, not the check: **19 conflicts across 10 files**, and 2 spreads in `globals.css`. (Corrected 15 Aug 2026 — this cell said 27 across 15, which PR #1942 had already paid down to 25 across 12 without updating the prose. The §3 row below and `scripts/design-system-contract-baseline.json` both already said 25, and per `docs/design-system/README.md` the baseline outranks this document, so the prose was the defect. Ledger `#265` carried the same stale figure.) Path to blocking: retire that debt and pin both at zero. The spread form was chosen _because_ it is mechanically lintable, and it duly was.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| 9   | No layout-property animation; no hardcoded durations                                                                                          | **implemented-partial**              | Corrected 9 Aug 2026: "a layout-property lint is still planned" was **false**, and leaving it would have preserved the exact contradiction this pass exists to remove. `layoutTransitionExceptions` ships and ratchets **per path** against `SAFE_TRANSITION_PROPERTIES`, so a new layout-property transition in any file fails today; the phone chrome's intentional `grid-template-rows` / `height` / `padding-bottom` are among the 12 recorded exceptions rather than a gap. The Tailwind duration form is a **hard zero** (`hardcodedMotionClasses`), on top of PR-Arch tokenising production `duration-*`/`ease-*` literals onto `--duration-*` / `--ease-*` (Gate 10). What stays partial is recorded debt, not a missing check: 12 layout transitions and 42 CSS `hardcodedCssMotionDurations`. Path to blocking: retire those and pin both at zero.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| 10  | Named z and motion tokens have real consumers; no unapproved `z-` value                                                                       | **implemented-blocking**             | PR-Arch: off-ladder `z-50` retired; toast at `--z-toast` (`z-[110]`, lint allowlist); motion literals map to named duration/ease tokens including phone-chrome hide/reveal pair. Dead `OverlayProvider` deleted.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| 11  | Published-type conformance — every `dtsPropsFor` entry exactly matches source props                                                           | **implemented-blocking**             | `generate-design-sync-contract.mjs` uses the TypeScript checker to derive every public property from the exported source `*Props` type; `--check` and `check-design-sync-contract.mjs` reject drift, missing named types, or machine-specific declarations. Zero-prop visual roots are explicit.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| 12  | Publication coverage — every registered visual component has source, export, preview, prop contract and direct publication test               | **implemented-blocking**             | Registry/map/props parity and all 53 direct component rows are pinned by the design-sync contract and `design-sync-visual-exports.test.ts`. Behavioural, full visual-state, print, and browser acceptance remain separate gates; `DocumentFrame` is built shell-only in product but not yet among the 53 registered visual exports (print primitives remain specified-not-built).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
 
 **Computed-style suites (planned, PR 1–2):** Tailwind conflict order · v2 cascade, ancestor
 **and** same-node forms · HCM remapping under all three v2 selectors · z-index · target
@@ -103,33 +103,33 @@ theme-list parity, and remote design-project publication remain separate concern
 
 ## 3 · The prohibition table
 
-| Never do this                                                        | Gate                                                                                                                                     | Status                                                                                                                                                                                                                                                                                                                                                     |
-| -------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Reintroduce `.ckb-v2:not(.dark)`                                     | Cascade computed-style test (PR 1) + contract-test selector filter update                                                                | implemented-blocking — landed #1538; contract parser + dark-ink regression guard                                                                                                                                                                                                                                                                           |
-| Add `prefers-color-scheme` rules to the v2 layer                     | — (users pin a theme against OS preference)                                                                                              | **manual**                                                                                                                                                                                                                                                                                                                                                 |
-| Paint a numeral with a status colour; use amber/red decoratively     | `check:design-system-contract` — `statusColouredNumerals` + `colourOnlyStatusIndicators`                                                 | **implemented-blocking** (9 Aug 2026) — ratcheted at 2 and 4 with per-path pins; see §5                                                                                                                                                                                                                                                                    |
-| Put `--decoration-soft`/`--text-soft` on a text node                 | Tier pinned both sides in the token contract; recipe AST (`decoration-on-text.contract.test.ts`)                                         | implemented-blocking (recipes); broader AST follow-on                                                                                                                                                                                                                                                                                                      |
-| Uppercase a dose unit                                                | `Quantity` pins `normal-case` + unit test                                                                                                | implemented-blocking (branch)                                                                                                                                                                                                                                                                                                                              |
-| Invert a PDF, diagram or clinical image in any theme                 | `check:design-system-contract` — `imageInversions`, pinned at **zero**, not ratcheted                                                    | **implemented-blocking** (9 Aug 2026) — CSS `filter`/`backdrop-filter` plus the Tailwind `invert`/`hue-rotate` utilities; see §5                                                                                                                                                                                                                           |
-| Border **and** ring on one surface, or a 1px spread in a drop shadow | `check:design-system-contract` — `edgeOwnershipConflicts` (25) + `onePixelShadowSpreads` (2)                                             | **implemented-blocking for new use** — AST/CSS ratchets with per-path pins; the recorded debt itself is Gate 8's remaining half                                                                                                                                                                                                                            |
-| A child shadow heavier than its parent's                             | Gate 7                                                                                                                                   | implemented-partial                                                                                                                                                                                                                                                                                                                                        |
-| Use `--shadow-tight`/any alias in new code                           | `check:design-system-contract` — `legacyShadowAliases`, ratcheted at 119 with per-path pins                                              | **implemented-blocking for new use** — a new alias in any file fails. `--shadow-tight` itself is retired onto `--e1` and additionally pinned by a tracked-tree sweep in `tests/design-token-contract.test.ts` (it was silently reverted once by the `acf78bf` merge); the remaining 119 are the other six aliases, still `#262`                            |
-| Raw pixel size, padding, radius, gap or line-height in markup        | `check:design-system-contract` — `rawPaddingLiterals` (63), `rawRadiusLiterals` (24), `rawGapLiterals` (32), `rawLineHeightLiterals` (3) | **implemented-blocking for new use** (9 Aug 2026) — per-path ratchets over both the utility and the CSS-declaration spelling, so a literal cannot move into `globals.css` to escape. Values containing a CSS function (`env(`, `clamp(`, `max(`, `calc(`) are sanctioned computed forms and exempt. Raw _size_ is still covered only for tap/shadow/colour |
-| Animate `width`, `height`, `grid-template-*`, `top`, `left`, `gap`   | `check:design-system-contract` — `layoutTransitionExceptions`, ratcheted at 11 with per-path pins                                        | **implemented-blocking for new use** — `SAFE_TRANSITION_PROPERTIES` carries the compositor-only allowlist; phone chrome's deliberate `grid-template-rows` is in the recorded 11                                                                                                                                                                            |
-| Hardcode a transition duration                                       | `check:design-system-contract` — `hardcodedMotionClasses` (**zero**) + `hardcodedCssMotionDurations` (42)                                | **implemented-blocking** for the Tailwind `duration-*`/`delay-*`/`transition-all` form; the CSS form is a ratchet, so its 42 are debt                                                                                                                                                                                                                      |
-| A `z-` value outside the named rungs                                 | `require-z-index-ladder` (ESLint)                                                                                                        | implemented-blocking                                                                                                                                                                                                                                                                                                                                       |
-| Ship a registered component without a direct publication test        | Gate 12                                                                                                                                  | implemented-blocking                                                                                                                                                                                                                                                                                                                                       |
-| Lower a production tap target below 48px                             | Gate 2 + `ui-smoke` flake history + held visual probe                                                                                    | implemented-partial — token floor + declared carriers only; fixed `h-10` interactive controls and the unwired Chromium audit are not blocked                                                                                                                                                                                                               |
-| Construct an enabled control with no action, destination or name     | PR 4 discriminated unions + DOM contracts; `require-button-wiring` covers raw `<button>`                                                 | implemented-blocking (Citation/Chip/ToggleSwitch/RadioGroup)                                                                                                                                                                                                                                                                                               |
-| Render `AnswerCard` without a verification and answer state          | PR 6 required props (type-level)                                                                                                         | implemented-blocking in `AnswerCard`; live answer-shell adoption remains compatibility-layer work                                                                                                                                                                                                                                                          |
-| Use a bare dash for a missing clinical value                         | `MissingValue` + review                                                                                                                  | implemented-partial — `AccessibleTable` composes `MissingValue`; broader legacy call-site convergence remains manual                                                                                                                                                                                                                                       |
-| Render "0 matches" after a failed request                            | `ErrorState` adoption + `check:design-system-contract` (`errorStateCountProps` and `failedStateResultCounts`, baseline 0)                | **implemented-blocking** (11 Aug 2026) — count-bearing shared error copy and JSX rendered directly by an error/failed branch are rejected                                                                                                                                                                                                                  |
-| Hand-rolled rows replacing `AccessibleTable` without declaring it    | —                                                                                                                                        | **manual** (declaration convention)                                                                                                                                                                                                                                                                                                                        |
-| Drop the AI verification disclaimer                                  | PR 6 required prop                                                                                                                       | implemented-blocking in `AnswerCard`; production shell wording remains separately guarded during adoption                                                                                                                                                                                                                                                  |
-| Fix a collapsed column by nudging pixels                             | 320px snapshot                                                                                                                           | planned (held harness)                                                                                                                                                                                                                                                                                                                                     |
-| `dark:` colour override                                              | `check:design-system-contract` — `darkColorOverrides`, baseline 0                                                                        | **implemented-blocking** (7 Aug 2026) — all 3 instances retired; see §4                                                                                                                                                                                                                                                                                    |
-| Truncate a page title, dialog title, drug name or review warning     | —                                                                                                                                        | **manual**                                                                                                                                                                                                                                                                                                                                                 |
-| Restate a token value in prose                                       | —                                                                                                                                        | **manual** (eleven divergences came from this; TOKENS.md is the only inventory)                                                                                                                                                                                                                                                                            |
+| Never do this                                                        | Gate                                                                                                                                                   | Status                                                                                                                                                                                                                                                                                                                                                     |
+| -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Reintroduce `.ckb-v2:not(.dark)`                                     | Cascade computed-style test (PR 1) + contract-test selector filter update                                                                              | implemented-blocking — landed #1538; contract parser + dark-ink regression guard                                                                                                                                                                                                                                                                           |
+| Add `prefers-color-scheme` rules to the v2 layer                     | — (users pin a theme against OS preference)                                                                                                            | **manual**                                                                                                                                                                                                                                                                                                                                                 |
+| Paint a numeral with a status colour; use amber/red decoratively     | `check:design-system-contract` — `statusColouredNumerals` + `colourOnlyStatusIndicators`                                                               | **implemented-blocking** (9 Aug 2026) — ratcheted at 1 and 4 with per-path pins; see §5                                                                                                                                                                                                                                                                    |
+| Put `--decoration-soft`/`--text-soft` on a text node                 | Tier pinned both sides in the token contract; recipe AST (`decoration-on-text.contract.test.ts`)                                                       | implemented-blocking (recipes); broader AST follow-on                                                                                                                                                                                                                                                                                                      |
+| Uppercase a dose unit                                                | `Quantity` pins `normal-case` + unit test                                                                                                              | implemented-blocking (branch)                                                                                                                                                                                                                                                                                                                              |
+| Invert a PDF, diagram or clinical image in any theme                 | `check:design-system-contract` — `imageInversions`, pinned at **zero**, not ratcheted                                                                  | **implemented-blocking** (9 Aug 2026) — CSS `filter`/`backdrop-filter` plus the Tailwind `invert`/`hue-rotate` utilities; see §5                                                                                                                                                                                                                           |
+| Border **and** ring on one surface, or a 1px spread in a drop shadow | `check:design-system-contract` — `edgeOwnershipConflicts` (19) + `onePixelShadowSpreads` (2)                                                           | **implemented-blocking for new use** — AST/CSS ratchets with per-path pins; the recorded debt itself is Gate 8's remaining half                                                                                                                                                                                                                            |
+| A child shadow heavier than its parent's                             | Gate 7                                                                                                                                                 | implemented-partial                                                                                                                                                                                                                                                                                                                                        |
+| Use `--shadow-tight`/any alias in new code                           | `check:design-system-contract` — `legacyShadowAliases`, ratcheted at 114 with per-path pins                                                            | **implemented-blocking for new use** — a new alias in any file fails. `--shadow-tight` itself is retired onto `--e1` and additionally pinned by a tracked-tree sweep in `tests/design-token-contract.test.ts` (it was silently reverted once by the `acf78bf` merge); the remaining 119 are the other six aliases, still `#262`                            |
+| Raw pixel size, padding, radius, gap or line-height in markup        | `check:design-system-contract` — `rawPaddingLiterals` (63), `rawRadiusLiterals` (23), `rawGapLiterals` (31), `rawLineHeightLiterals` (3)               | **implemented-blocking for new use** (9 Aug 2026) — per-path ratchets over both the utility and the CSS-declaration spelling, so a literal cannot move into `globals.css` to escape. Values containing a CSS function (`env(`, `clamp(`, `max(`, `calc(`) are sanctioned computed forms and exempt. Raw _size_ is still covered only for tap/shadow/colour |
+| Animate `width`, `height`, `grid-template-*`, `top`, `left`, `gap`   | `check:design-system-contract` — `layoutTransitionExceptions`, ratcheted at 11 with per-path pins                                                      | **implemented-blocking for new use** — `SAFE_TRANSITION_PROPERTIES` carries the compositor-only allowlist; phone chrome's deliberate `grid-template-rows` is in the recorded 11                                                                                                                                                                            |
+| Hardcode a transition duration                                       | `check:design-system-contract` — `hardcodedMotionClasses` (**zero**) + `hardcodedCssMotionDurations` (41)                                              | **implemented-blocking** for the Tailwind `duration-*`/`delay-*`/`transition-all` form; the CSS form is a ratchet, so its 42 are debt                                                                                                                                                                                                                      |
+| A `z-` value outside the named rungs                                 | `require-z-index-ladder` (ESLint)                                                                                                                      | implemented-blocking                                                                                                                                                                                                                                                                                                                                       |
+| Ship a registered component without a direct publication test        | Gate 12                                                                                                                                                | implemented-blocking                                                                                                                                                                                                                                                                                                                                       |
+| Lower a production tap target below 48px                             | `check:design-system-contract` — `interactiveTapFloorDeclarations` (40) + Gate 2's phone-viewport `ui-style-contract` audit + `ui-smoke` flake history | **implemented-blocking for new use** (15 Aug 2026) — a new interactive control declaring a sub-floor `min-h-*`, including comparable arbitrary values and any reachable conditional branch, fails on both the total and its own path; the 40 recorded sites remain debt. Component-wrapper tags such as `<Link>` are a known blind spot                    |
+| Construct an enabled control with no action, destination or name     | PR 4 discriminated unions + DOM contracts; `require-button-wiring` covers raw `<button>`                                                               | implemented-blocking (Citation/Chip/ToggleSwitch/RadioGroup)                                                                                                                                                                                                                                                                                               |
+| Render `AnswerCard` without a verification and answer state          | PR 6 required props (type-level)                                                                                                                       | implemented-blocking in `AnswerCard`; live answer-shell adoption remains compatibility-layer work                                                                                                                                                                                                                                                          |
+| Use a bare dash for a missing clinical value                         | `MissingValue` + review                                                                                                                                | implemented-partial — `AccessibleTable` composes `MissingValue`; broader legacy call-site convergence remains manual                                                                                                                                                                                                                                       |
+| Render "0 matches" after a failed request                            | `ErrorState` adoption + `check:design-system-contract` (`errorStateCountProps` and `failedStateResultCounts`, baseline 0)                              | **implemented-blocking** (11 Aug 2026) — count-bearing shared error copy and JSX rendered directly by an error/failed branch are rejected                                                                                                                                                                                                                  |
+| Hand-rolled rows replacing `AccessibleTable` without declaring it    | —                                                                                                                                                      | **manual** (declaration convention)                                                                                                                                                                                                                                                                                                                        |
+| Drop the AI verification disclaimer                                  | PR 6 required prop                                                                                                                                     | implemented-blocking in `AnswerCard`; production shell wording remains separately guarded during adoption                                                                                                                                                                                                                                                  |
+| Fix a collapsed column by nudging pixels                             | 320px snapshot                                                                                                                                         | planned (held harness)                                                                                                                                                                                                                                                                                                                                     |
+| `dark:` colour override                                              | `check:design-system-contract` — `darkColorOverrides`, baseline 0                                                                                      | **implemented-blocking** (7 Aug 2026) — all 3 instances retired; see §4                                                                                                                                                                                                                                                                                    |
+| Truncate a page title, dialog title, drug name or review warning     | —                                                                                                                                                      | **manual**                                                                                                                                                                                                                                                                                                                                                 |
+| Restate a token value in prose                                       | —                                                                                                                                                      | **manual** (eleven divergences came from this; TOKENS.md is the only inventory)                                                                                                                                                                                                                                                                            |
 
 ## 3a · Rules added by the perfection pass (31 July, second half)
 
diff --git a/docs/design-system/adoption-contract.json b/docs/design-system/adoption-contract.json
index 169ba25275..c8a679bb5d 100644
--- a/docs/design-system/adoption-contract.json
+++ b/docs/design-system/adoption-contract.json
@@ -484,7 +484,7 @@
         "status": "not-committed",
         "files": []
       },
-      "sanctionedSpecialPatterns": ["ApplicationsLauncherPage", "CalculatorsSearchPage"]
+      "sanctionedSpecialPatterns": ["ToolsSearchResultsPage", "CalculatorsSearchPage"]
     },
     {
       "id": "privacy-safety-and-reference",
diff --git a/docs/design-system/adoption-manifest.json b/docs/design-system/adoption-manifest.json
index 0f706d3d38..1eafffd1c2 100644
--- a/docs/design-system/adoption-manifest.json
+++ b/docs/design-system/adoption-manifest.json
@@ -112,6 +112,7 @@
         "tests/accessible-table.dom.test.tsx",
         "tests/design-sync-visual-exports.test.ts",
         "tests/design-system-adoption.test.ts",
+        "tests/ui-tools.spec.ts",
         "tests/ward-output.test.ts"
       ],
       "baseline": {
@@ -1515,7 +1516,6 @@
         "src/components/forms/forms-search-results-page.tsx",
         "src/components/in-page-nav/in-page-nav-header.tsx",
         "src/components/mode-nav/mode-nav.tsx",
-        "src/components/services/service-group-nav.tsx",
         "src/components/tools/tools-search-results-page.tsx",
         "src/components/ui/confirm-dialog.tsx"
       ],
@@ -1544,7 +1544,6 @@
         "src/components/forms/forms-search-results-page.tsx",
         "src/components/in-page-nav/in-page-nav-header.tsx",
         "src/components/mode-nav/mode-nav.tsx",
-        "src/components/services/service-group-nav.tsx",
         "src/components/tools/tools-search-results-page.tsx"
       ],
       "designSync": {
@@ -1562,6 +1561,7 @@
         "tests/header-scroll-hide-contract.test.ts",
         "tests/image-lightbox-geometry.test.ts",
         "tests/in-page-nav-route-sections.dom.test.tsx",
+        "tests/mobile-sheet-safe-area-contract.test.ts",
         "tests/mode-nav.dom.test.tsx",
         "tests/rag-answer-fallback.test.ts",
         "tests/settings-dialog-actions.dom.test.tsx",
@@ -3000,7 +3000,7 @@
         "files": []
       },
       "permittedComponentFamilies": ["controls", "feedback", "layout"],
-      "sanctionedSpecialPatterns": ["ApplicationsLauncherPage", "CalculatorsSearchPage"],
+      "sanctionedSpecialPatterns": ["CalculatorsSearchPage", "ToolsSearchResultsPage"],
       "roots": [
         {
           "file": "src/app/(search-app)/calculators/page.tsx",
@@ -3020,7 +3020,7 @@
           "literalCkbV2": false,
           "dynamicCkbV2": false,
           "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": ["ApplicationsLauncherPage"]
+          "sanctionedPatternsPresent": ["ToolsSearchResultsPage"]
         }
       ]
     },
diff --git a/docs/filter-contract.md b/docs/filter-contract.md
index 342de4b41a..52d89db67c 100644
--- a/docs/filter-contract.md
+++ b/docs/filter-contract.md
@@ -28,11 +28,13 @@ does today — tells the reader they cannot hold two domains at once, which is f
 
 ### There is no `navigate` kind, and that is the point
 
-Services' former quick filters did not filter. They called `router.push` and **replaced the query**,
-so choosing one discarded the search and its results with no warning and no undo. A control labelled
-"Filter" must not do that. The presets were removed because they also competed visually with the
-service-group navigation; query-replacing suggestions should only return if they have a distinct,
-clearly labelled home beside the composer.
+Services' former quick filters did not filter. They called `router.push` and **replaced the
+query**, so choosing one discarded the search and its results with no warning and no undo. A
+control labelled "Filter" must not do that. Moving those presets beside the results as suggested
+searches still made a second search-navigation row compete with the result hierarchy, so the
+production Services route removes them entirely. The separate service-group strip moves into the
+sheet as the real, URL-backed **Service category** facet: its four categories overlap, so they use
+OR-within multi-selection rather than pretending to be a one-of-N lens.
 
 Factsheets' category dimension is not this pattern, despite an earlier draft of this section
 grouping it with services' quick filters: `filterFactsheets(query, category)` ANDs the two, so
@@ -94,9 +96,9 @@ scope segment — `These results N | All items N`, counts on both — built from
 tabindex and radio semantics. `ResultFilterSheet` reserves the slot (`scopeControl`) but does not
 build the segment itself: "meaningfully larger" and what the two counts mean are per-mode
 judgements the shared renderer cannot make. Services is the first mode to use it — see
-`services-navigator-page.tsx`: the segment is gated on the catalogue exceeding the query/group
-scoped result set (not the facet-narrowed one, so the segment does not flicker away as facets are
-applied), and both counts reflect the current facet/lens selection.
+`services-navigator-page.tsx`: the segment is gated on the catalogue exceeding the query-scoped
+result set (not the facet-narrowed one, so the segment does not flicker away as facets are applied),
+and both counts reflect the current category/facet/lens selection.
 
 It earns its place because it is the only escape from a filtered-to-zero state that does not
 discard the query: the commit becomes "Show N in all items" instead of a dead end.
@@ -123,7 +125,7 @@ find-a-filter field and collapse-by-default disclosures.
 | > 3 groups, or > 20 options | chips plus find-a-filter and collapse-by-default, every group behind a disclosure header |
 
 `ResultFilterSheet` computes the threshold once across all facet groups. The option-count limb
-catches a small number of very large groups, while the group-count limb covers services' five
+catches a small number of very large groups, while the group-count limb covers services' six
 facet groups. Below the threshold every group renders as before.
 
 Collapse rules, when they apply: groups start collapsed; a group holding a selection opens
@@ -162,11 +164,12 @@ Contract first, then one PR per mode:
    desktop rail so the breakpoints stop disagreeing. Done for differentials, medication,
    applications and specifiers (all `lens`), formulation (`facet`), and factsheets, whose real
    category lens now shares one counted option array between desktop and phone.
-3. **Services** — move its query-replacing quick filters to the composer. Done for services:
-   five facets (catchments, age_groups, setting_flags, acuity_flags, housing_flags),
+3. **Services** — remove its query-replacing quick filters instead of presenting them as filters or
+   a competing suggestion row. Done for services: Service category plus five catalogue facets
+   (catchments, age_groups, setting_flags, acuity_flags, housing_flags),
    substance_flags as a lens (an exact partition, not an accumulating constraint — see
-   `src/lib/service-facets.ts`), a URL round-trip alongside `q`/`group`, and the scope segment
-   (section 4). Services is also the first mode dense enough (5 facet groups) to exercise the
+   `src/lib/service-facets.ts`), a URL round-trip alongside `q`, and the scope segment (section 4).
+   Services is also the first mode dense enough (6 facet groups) to exercise the
    `> 3 groups` chrome added to the shared sheet for this — see section 5.
 4. **Therapy-compass** — converge runtime use of the bespoke phone-only filter sheet and trigger
    onto `ResultFilterSheet`, `ResultFilterTrigger`, and `ResultFilterFacetChips`. Topics are OR
diff --git a/docs/ledger-id-scheme-proposal.md b/docs/ledger-id-scheme-proposal.md
new file mode 100644
index 0000000000..39196d8e4b
--- /dev/null
+++ b/docs/ledger-id-scheme-proposal.md
@@ -0,0 +1,149 @@
+# Collision-free outstanding-issue ids — design proposal
+
+**Status:** design only — no implementation, no id allocated by this document
+**Ledger row:** `#168` (P2, rec) · closely related `#156` (same race, resolution-path evidence)
+**Distinct from:** `#292`, which is two sessions colliding on the **work** a row describes. A
+collision-free id leaves that untouched.
+**Measured:** 2026-08-14 against `origin/main` at `d47aa6d` — 314 rows, marker at `next-id=317`
+
+---
+
+## 1. The problem
+
+Ids are allocated read-modify-write against the `issues:next-id` marker **inside the very file
+being edited**. `scripts/outstanding-issues.mjs` reads the marker, claims that number, and
+rewrites the marker to `N + 1`. Two branches open at the same time both read `N` and both
+write `N`.
+
+Because duplicate ids are unacceptable, a union merge driver is unsafe — `.gitattributes` says
+so explicitly, which is why this file deliberately has no driver and **every overlapping append
+conflicts by hand**.
+
+Manual resolution is where rows get dropped. The record is specific:
+
+- PR #1490 was closed during a conflict resolution and took the only record of four snapshots
+  with it (`#152`).
+- One P3 row was renumbered `#135` → `#141` → `#145` → `#147` → `#149` across four sync cycles
+  because `main` had taken each id in turn (`#156`, measured on PR #1451).
+- `#168` itself was written as `#159`, then renumbered because `main` had already used `#159`.
+- The GitHub **Update branch** button produced a head carrying **two rows numbered `#141` and
+  two `next-id` markers**, leaving the marker _below_ `main`'s highest id — so the next
+  allocation would have reused a live number. `git merge` reported success; only
+  `npm run check:outstanding-issues` caught it (`#156`).
+
+The inbox (`scripts/ledger-inbox.mjs`) removed the mechanical errors — requests are immutable
+UUID-named files and only `npm run issues:reconcile` writes the canonical ledger — but it
+explicitly did not remove this one. Reconciliation still allocates from the marker, so two
+reconcile branches still contend, and the single-writer discipline is what makes that
+tolerable rather than fixed.
+
+---
+
+## 2. What the id has to do
+
+Any scheme has to satisfy four things at once, which is why the obvious answers are wrong:
+
+1. **Collision-free without coordination.** Two sessions that never see each other must not
+   produce the same id.
+2. **Stable once written.** Ids are cited by other rows, by review records under
+   `docs/branch-review-records/`, by `AGENTS.md`, by `.claude/skills/issues/SKILL.md`, and by
+   commit messages and PR bodies across the repo's history. An id that can be renumbered is the
+   defect, not the format.
+3. **Readable enough to say aloud.** `/issues` output, the `SessionStart` hook, and every
+   handoff summary read ids back to a human. `#151` works in conversation; a bare
+   `01JQ8ZK3M7Q9V2W4X6Y8Z0ABCD` does not.
+4. **Sortable by creation.** The ledger's queue and archive both read better in the order the
+   work arrived.
+
+---
+
+## 3. Recommendation — ULID stored, permanent short display id allocated
+
+Allocate a **ULID** as the durable id and a **permanent short display id** for human use.
+
+- **ULID**, not UUIDv4, because a ULID is lexicographically sortable by its millisecond
+  timestamp prefix — requirement 4 — while remaining collision-free without coordination.
+  UUIDv7 is an equally good fit if a dependency is preferred over ~20 lines of local code; the
+  repo already generates UUIDv4 via `randomUUID()` in `ledger-inbox.mjs`, so neither needs a
+  new package.
+- **Display id** starts as the first 6 characters of the ULID's random suffix, rendered
+  `#K3M7Q9`, and is stored with the row at allocation time. Six Crockford base-32 characters is
+  ~1.07 billion values, so a collision is rare at the observed rate of roughly 320 rows a year.
+- **Collision handling happens before writing.** The allocator checks display-id uniqueness; if
+  the initial 6-character candidate is already allocated, it takes additional characters until
+  it finds an unused candidate, then stores that result. Existing display ids are never
+  lengthened or otherwise changed. This preserves every written `#K3M7Q9` citation while keeping
+  the durable ULID as the collision-free machine identity.
+
+Rejected alternatives, briefly:
+
+- **Timestamp + slug** (`#2026-08-14-merge-loss`) is readable and sortable, but two sessions
+  filing similar rows on the same day collide on the slug, and the slug wants to change when
+  the row is re-scoped — reintroducing renumbering by another name.
+- **Content hash** is collision-free but neither sortable nor stable: any edit to the row
+  changes its identity.
+- **Keeping sequential ids and adding a lock** does not work across branches. There is no
+  shared state at allocation time; that is the whole problem.
+
+---
+
+## 4. Migration path
+
+**The 314 existing sequential ids keep their literal ids, permanently.** Renumbering them is
+off the table — they are cited across the ledger, the review records, the agent instructions
+and the entire commit history, and a rewrite would invalidate every one of those citations
+while producing exactly the renumbering churn this row exists to end.
+
+So the two forms coexist, and the migration is additive:
+
+| Step | Change                                                                                                                                                        | Risk                                                            |
+| ---- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- |
+| 1    | Widen every id validator to accept both `#NNN` and the new stored display id, while allocation still uses the marker. No behaviour change; purely permissive. | Low. Fully reversible.                                          |
+| 2    | Add ULID and display-id fields to new rows and switch allocation to them. The `issues:next-id` marker stops being read.                                       | Medium — this is the cutover.                                   |
+| 3    | Remove the marker and its `next-id` guards once no writer consults it.                                                                                        | Low, but only after step 2 has been through a few real appends. |
+| 4    | Reconsider a union merge driver, which becomes safe only once **no** id is allocated read-modify-write.                                                       | Deliberately last. See the Stop below.                          |
+
+**Every place that currently assumes a sequential id** — all of these need step 1 before
+anything else moves:
+
+- `scripts/ledger-inbox.mjs` — `/^#\d{3,}$/` in `validateRequest`, twice (the `done` and
+  `update` actions).
+- `scripts/check-outstanding-issues.mjs` — `ID_CELL = /^#\d+$/`; the
+  `MARKER = /<!--\s*issues:next-id=(\d+)\s*-->/` parse; the `nextId <= highest` assertion; and
+  the `String(highest).padStart(3, "0")` formatting in its messages.
+- `scripts/outstanding-issues.mjs` — the allocator that reads `parsed.nextId`, formats
+  `#${String(number).padStart(3, "0")}`, and rewrites the marker to `nextId + 1`.
+- `scripts/issues-report.mjs` and `.claude/hooks/issues-surface.sh`, which render ids back to
+  the reader.
+
+A row-per-file variant — one file per row in a new per-row directory under `docs/`, with the
+table generated the way `docs/site-map.md` already is — removes the shared hunk entirely and is
+the stronger end state. It is a larger change and should be decided separately; the id scheme
+is a prerequisite for it either way, since per-row filenames need collision-free names.
+
+---
+
+## 5. What this does not fix
+
+`#292` — two sessions independently building the same queued item — is untouched by any of
+this. That is a collision on the **work** a row describes, not on its id, and the mitigation
+there is the open-PR check already written into the three skills. Do not conflate them when
+scoping the implementation.
+
+`#156`'s second finding is also untouched: a merge that silently drops an appended prose block
+is invisible to `check:outstanding-issues`, which validates ids and structure rather than
+whether both sides' text survived. A collision-free id makes such merges rarer; it does not
+make them detectable. `npm run audit:merge-loss` is the closest thing the repo now has to that
+detection.
+
+---
+
+## 6. Stop
+
+- **Do not reinstate `merge=union` while ids are sequential.** That combination was tried in
+  PR #1416 and removed for duplicating rows and the marker. It only becomes safe after step 3.
+- **Do not renumber existing rows** to make the ledger uniform. The citations are the point.
+- **Do not implement this from this document alone.** It is a proposal; the cutover in step 2
+  wants its own PR, its own review, and a check that both id forms round-trip through
+  `issues:add`, `issues:update`, `issues:done` and `issues:reconcile` before the marker is
+  removed.
diff --git a/docs/maturity-backlog-workorders.md b/docs/maturity-backlog-workorders.md
index 4033b0bbd1..251f085a7f 100644
--- a/docs/maturity-backlog-workorders.md
+++ b/docs/maturity-backlog-workorders.md
@@ -158,15 +158,37 @@ structural change, not a single mixed PR.
 - **Verification:** `npm run check:drift` + the CI `db-reset-verify` replay; **live-DB work is
   confirmation-required** per the AGENTS.md provider boundary.
 
-### X6 · Raise coverage floors for clinical domains — `OPEN`
+### X6 · Raise coverage floors for clinical domains — `DONE`
 
 - **Outcome:** higher targeted thresholds where correctness matters most (clinical-safety,
   retrieval, answer) than the current global 38–50%.
-- **Approach:** add per-path coverage thresholds in `vitest.config.mts`; add the targeted tests
-  needed to clear them (ratchet up, don't drop the bar retroactively).
-- **Files:** `vitest.config.mts` (+ new `tests/*` specs).
-- **Risk:** MEDIUM — needs real tests, not just a threshold bump.
-- **Verification:** `npm run test:coverage` meets the new per-path floors.
+- **Landed (ledger #192, 2026-08-14):** `vitest.config.mts` already carried four per-domain
+  coverage-threshold groups — retrieval (`clinical-search`, `retrieval-selection`,
+  `answer-ranking`, `clinical-value-binding`, `medication-entities`,
+  `rag-candidate-sources`, `rag-context-selection`, `rag-retrieval-variants`,
+  `rag-routing`), evidence/verification (`answer-verification`, `evidence`,
+  `evidence-relevance`, `rag-claim-support`, `rag-evidence-gates`,
+  `rag-quote-verification`, `rag-source-segmentation`), core RAG/answer (`rag`,
+  `rag-extractive-answer`, `rag-comparison`, `rag-answer-support`), and
+  clinical-safety/governance (`clinical-safety`, `source-governance`, `source-review`,
+  `clinical-review-queue`, `answer-response`) — plus a whole-repository floor, all
+  CI-enforced by the required `coverage` job (`npm run test:coverage`) on every PR that
+  touches executable scope. This closed out most of X6 before this ledger item was
+  worked; re-measuring on 2026-08-14 confirmed the floors were honest (no false
+  failure) and found two branch thresholds that had drifted past this file's own
+  documented 5pp re-ratchet trigger, so those two were raised (never lowered) to
+  restore headroom: evidence/verification branches 81 → 84 (measured 86.04%, gap was
+  5.04pp) and core RAG/answer branches 72 → 76 (measured 78.22%, gap was 6.22pp). No
+  other value in this file needed a change — every other floor already sat within the
+  5pp band. No file in the four domain groups showed a genuine untested critical path:
+  the per-file low points were 76.4% statements (`rag-quote-verification.ts`) and 57.7%
+  branches (`rag-answer-support.ts`), well clear of the "under 30%" bar this ledger item
+  treats as scary, so no padding tests were added, per the ledger's own stop condition.
+- **Files:** `vitest.config.mts`, `docs/maturity-backlog-workorders.md`.
+- **Risk:** MEDIUM — needs real tests, not just a threshold bump. (No new tests were
+  needed this pass; the floors were already backed by real, passing coverage.)
+- **Verification:** `npm run test:coverage` — 606 files / 6549 tests passed, all
+  thresholds green, both before and after the two branch-floor raises.
 
 ### X7 · Complete the `src/lib` domain-directory reorg — `OPEN`
 
@@ -291,7 +313,7 @@ collaborators join — `AGENTS.md` + the PR template already carry that load.
 | X3 Monolith decomposition        | Next       | IN PROGRESS (DocumentViewer #1025 + Dashboard #1034/#1042/#1047 done; rag.ts open) |
 | X4 SAST-blocking on parser       | Next       | **DONE** (gate + policy check)                                                     |
 | X5 ACL-migration consolidation   | Next       | PROVIDER-GATED (DB owner)                                                          |
-| X6 Coverage floors               | Next       | OPEN                                                                               |
+| X6 Coverage floors               | Next       | **DONE** (ledger #192)                                                             |
 | X7 `src/lib` domain reorg (rest) | Next       | OPEN (follow-on to X2; needs RAG flag on answer/retrieval clusters)                |
 | L1 Archive one-shot scripts      | Later      | IN PROGRESS (#1033 archived m13/july8; refs reconciled; backfills open)            |
 | L2 Action-SHA uniformity         | Later      | **DONE** (#992)                                                                    |
diff --git a/docs/medication-interaction-lexicon-review.md b/docs/medication-interaction-lexicon-review.md
index 8c8687a64c..ff70571c26 100644
--- a/docs/medication-interaction-lexicon-review.md
+++ b/docs/medication-interaction-lexicon-review.md
@@ -96,8 +96,8 @@ the class cannot be enumerated, and holds the medication at grey rather than gre
 
 **35 of the catalogue's 328 medications sit outside both ends of every resolved
 interaction row.** Entering one of them produces no alert — not because the combination was checked and
-found clear, but because no machine-resolved edge in the corpus includes that drug. On screen those
-outcomes look the same, so this list is the honest boundary of the feature.
+found clear, but because no machine-resolved edge in the corpus includes that drug. On screen those outcomes look the
+same, so this list is the honest boundary of the feature.
 
 This is a **corpus coverage** limit, not necessarily a lexicon fault. Widening it means adding an
 interaction row or making an existing row machine-resolvable, with clinical review of the source content.
diff --git a/docs/medication-lexicon-review-worklist.md b/docs/medication-lexicon-review-worklist.md
new file mode 100644
index 0000000000..14fe335424
--- /dev/null
+++ b/docs/medication-lexicon-review-worklist.md
@@ -0,0 +1,188 @@
+# Medication lexicon — clinician reading worklist (`#318`)
+
+**This is a reading aid, not a review.** It does not fill in the sign-off block in
+`docs/medication-interaction-lexicon-review.md`, and it makes no clinical determination. Its only
+job is to make the top-down pass that `#318` asks for as short as it can honestly be.
+
+Generated against `origin/main` at `8069188`. The review sheet was regenerated at that commit and
+came back byte-identical to the committed copy, so the sheet is current: 28 catalogue terms,
+1 flagged.
+
+## Read this first
+
+**Two of the row's three known defects are already closed**, and one new mechanical defect was found
+that the sheet's own guard could not see.
+
+| Defect as stated in `#318`                           | State now                                                                                                                                     |
+| ---------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
+| ARB matching Carbapenem across 16 CRITICAL/HIGH rows | **Closed.** `arbs` resolves to Candesartan only, and a standing substring check now guards it.                                                |
+| Two divergent Warfarin records                       | **Open.** Still the single flagged item. §2.6 — highest consequence on this page.                                                             |
+| Lithium unreachable from eight HIGH rows             | **Closed.** `lithium` resolves to Lithium carbonate (IR/SR) across 9 rows / 9 severe, and lithium is absent from the unreachable-drugs table. |
+
+**New — a dead slug drops a TCA from 20 severe rows.** `§2.1`. This one is a broken reference, not a
+clinical judgment call, and it is the reason `§4` matters: the sheet's "Checks that ran and found
+nothing" line is **overstated for two terms**, `tcas` among them.
+
+## 1. The top ten terms by severe usage
+
+`Severe` = CRITICAL or HIGH interaction rows the term fires on. These ten carry **236 of the 390
+severe firings across all 28 terms (61%)**, so a pass that stops after ten has covered most of the
+red-and-amber surface.
+
+| #   | Term              | Rows / Severe | Resolves to                                                                                                                                                                                                                                    | Look at  |
+| --- | ----------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
+| 1   | `nsaids`          | 39 / 38       | 6 — Aspirin, Diclofenac, Ibuprofen, Ketorolac, Meloxicam, Naproxen                                                                                                                                                                             | **§2.2** |
+| 2   | `opioids`         | 36 / 35       | 14 — Buprenorphine (SL/depot), Buprenorphine + naloxone, Buprenorphine patch, Codeine, Fentanyl, Hydromorphone (IR/IV), **Loperamide**, Methadone, Morphine (IR/IV), Morphine SR/MR, Oxycodone IR, Oxycodone SR/MR, Tapentadol SR, Tramadol IR | §2.4     |
+| 3   | `benzodiazepines` | 32 / 32       | 8 — Alprazolam, Clonazepam, Diazepam, Lorazepam, Midazolam, Nitrazepam, Oxazepam, Temazepam                                                                                                                                                    | clean    |
+| 4   | `beta-blockers`   | 23 / 22       | 7 — Atenolol, Bisoprolol, Carvedilol, Labetalol, Metoprolol, Propranolol, Sotalol                                                                                                                                                              | clean    |
+| 5   | `acei`            | 20 / 20       | 1 — Perindopril                                                                                                                                                                                                                                | §2.5     |
+| 6   | `tcas`            | 22 / 20       | 5 — Amitriptyline, Clomipramine, Doxepin, Imipramine, Nortriptyline                                                                                                                                                                            | **§2.1** |
+| 7   | `ssris`           | 21 / 19       | 6 — Citalopram, Escitalopram, Fluoxetine, Fluvoxamine, Paroxetine, Sertraline                                                                                                                                                                  | clean    |
+| 8   | `diuretics`       | 18 / 17       | 6 — Amiloride, Eplerenone, Frusemide, Hydrochlorothiazide, Indapamide, Spironolactone                                                                                                                                                          | clean    |
+| 9   | `maois`           | 19 / 17       | 2 — Phenelzine, Tranylcypromine                                                                                                                                                                                                                | §2.3     |
+| 10  | `arbs`            | 16 / 16       | 1 — Candesartan                                                                                                                                                                                                                                | §2.5     |
+
+"clean" means I enumerated every catalogue record whose class or subclass names that class and found
+the term already covers all of them, with the deliberate exclusions accounted for.
+
+## 2. The findings — six items, in priority order
+
+The prose a clinician sees is always verbatim catalogue text. What is in question is only which
+drugs a phrase was taken to mean.
+
+### 2.1 `tcas` carries a dead slug — Dosulepin is silently excluded from 20 severe rows
+
+**This is a defect, not a judgment call, and it needs no clinical opinion to confirm.**
+
+`src/lib/medication-interaction-lexicon.ts` selects TCAs by an explicit slug list:
+
+```
+select: { slugs: ["amitriptyline", "nortriptyline", "imipramine", "clomipramine", "doxepin", "dothiepin"] }
+```
+
+Six slugs, but the catalogue record's slug is **`dosulepin`**, not `dothiepin`. A search of
+`data/medications-snapshot.json` for `"dothiepin"` returns **zero** records — the slug matches
+nothing. The drug is in the catalogue (`class: Antidepressant`, `subclass: TCA`, and its own
+overview reads "Tricyclic Antidepressant (also known as Dothiepin)"), so the lexicon was written
+against the older Australian/UK name while the catalogue uses the current INN.
+
+Consequence: Dosulepin fires **none** of the 20 severe `tcas` rows. Its own catalogue record flags
+`Toxicity in OD: FATAL` and `Anticholinergic: HIGH`.
+
+**Your call:** confirm Dosulepin should be a TCA for interaction purposes (I expect yes), and the
+fix is a one-word slug correction plus a regenerate. I have not made it — `#318` says do not change
+the lexicon.
+
+### 2.2 `nsaids` excludes Celecoxib and Parecoxib — missed-alert direction, 38 severe rows
+
+`nsaids` selects on `subclassIncludes: ["NSAID"]`. The catalogue holds two more analgesics whose
+subclass reads `COX-2 Inhibitor` and `COX-2 Inhibitor (Injectable)` — Celecoxib and Parecoxib.
+Neither string contains "NSAID", so neither is selected. Both records carry `tag: "NSAID"`, which
+the selector does not read.
+
+Note the inconsistency this creates: Meloxicam **is** included, only because its subclass happens to
+be spelled `NSAID (COX-2 preferential)`. So a COX-2-preferential NSAID is in and two selective COX-2
+inhibitors are out, on spelling rather than pharmacology.
+
+**Your call:** celecoxib's GI-bleeding risk is genuinely lower, so exclusion from bleeding-risk rows
+may be right. Its renal, lithium-level, and ACE-I/ARB "triple whammy" interactions are not lower.
+Should `nsaids` cover the coxibs for the non-bleeding rows? This may be a row-by-row answer rather
+than a blanket include.
+
+### 2.3 `maois` excludes Moclobemide — missed-alert direction, 17 severe rows
+
+Moclobemide **is** in the catalogue: `class: Antidepressant`, `subclass: RIMA`. Phenelzine and
+Tranylcypromine are `Irreversible MAOI`. The selector is `subclassIncludes: ["MAOI"]`, and the
+string `RIMA` does not contain `MAOI`, so Moclobemide sits outside all 17 severe rows.
+
+**Your call:** moclobemide is a reversible, selective MAO-A inhibitor. Its tyramine/food risk is
+genuinely much lower than the irreversible agents, so excluding it from dietary rows is defensible.
+Its serotonin-syndrome risk with SSRIs, TCAs, tramadol or other serotonergics is not lower. Should
+`maois` cover Moclobemide for the serotonergic rows specifically?
+
+Moclobemide is reachable by name from 4 places in the interaction index, so it is not invisible to
+the feature — only to this class term.
+
+### 2.4 `opioids` includes Loperamide — false-alert direction, 35 severe rows
+
+Loperamide is `class: Antidiarrhoeal`, `subclass: Peripheral Opioid Agonist`, so it matches on the
+substring `Opioid`. It is a true opioid agonist but peripherally restricted, and does not
+meaningfully cross the blood-brain barrier at therapeutic doses.
+
+**Your call:** for the sedation and respiratory-depression rows — opioids paired with
+benzodiazepines, alcohol or other CNS depressants — should Loperamide fire? If not, it is producing
+false CRITICAL/HIGH alerts on a common OTC antidiarrhoeal. Loperamide does carry real QTc and
+cardiac risk in overdose, so this too may be row-dependent.
+
+### 2.5 `acei` and `arbs` resolve to one drug each — confirm this is intended catalogue scope
+
+`acei` → Perindopril only (20 severe). `arbs` → Candesartan only (16 severe). `loop-diuretics` →
+Frusemide only.
+
+**No lexicon defect here** — I verified by exact record name that ramipril, lisinopril, irbesartan,
+telmisartan and valsartan are not in `data/medications-snapshot.json` at all. This is catalogue
+coverage, exactly as the sheet says.
+
+**Your call:** is one ACE inhibitor and one ARB the right scope for your prescribing? A patient on
+ramipril or irbesartan gets **no** alert from these 36 severe rows, and per the sheet's "What this
+tool can never warn about" section, silence looks identical on screen to a checked-and-clear result.
+
+### 2.6 `anticoagulants` — the flagged Warfarin split, plus an internal inconsistency
+
+Rank 12 by severe usage (18 rows / 15 severe), but it carries the sheet's only flagged defect.
+
+**The flagged defect.** The catalogue holds two records both named **Warfarin**
+(`warfarin-vka`, `warfarin-anticoagulant`), with identical class `Anticoagulant` and subclass
+`Vitamin K Antagonist`. They carry 3 interaction rows each and **zero in common**. Which record a
+clinician opens changes which warnings appear, with no visible cue that a second Warfarin exists.
+This is a catalogue reconciliation, not a lexicon fix.
+
+**The inconsistency.** `anticoagulants` also resolves to Clopidogrel, Dipyridamole and Ticagrelor —
+antiplatelets, not anticoagulants — because the catalogue files all three under class
+`Anticoagulant`. Meanwhile Aspirin, which carries the _same_ class `Anticoagulant` (subclass
+`Antiplatelet / NSAID`), sits on the sheet's deliberate-exclusion list.
+
+**Your call:** three antiplatelets are in and one is out, on identical class metadata. Is that the
+intended clinical line, or should `anticoagulants` and `antiplatelets` be cleanly separated?
+
+## 3. What I did not do
+
+- Did not modify `src/lib/medication-interaction-lexicon.ts` or any catalogue data.
+- Did not fill in, or pre-fill, the sign-off block. That is the clinician action `#318` asks for.
+- Did not treat `check:medication-lexicon-report` as review. Regeneration was a no-op, which proves
+  only that the sheet describes the current lexicon — not that any mapping is correct. `#318`'s stop
+  condition is unchanged.
+
+## 4. The review instrument has two blind spots — worth fixing before the next reading pass
+
+The sheet prints "Checks that ran and found nothing: **Missed class members** — no catalogue drug
+whose own class or subclass names a term's phrase was left out of that term." For three terms that
+sentence is **not true**, because the check could not run.
+
+`missedClassMembers()` in `scripts/build-medication-lexicon-report.ts` (line 442) skips any surface
+whose singular stem is shorter than four characters:
+
+```
+const stem = surface.toLowerCase().replace(/s$/, "");
+if (stem.length < 4) return false;
+```
+
+That guard exists to stop short tokens generating false positives, but it silently disables the
+whole check for a three-letter class acronym unless some _other_ surface on the same term is long
+enough to carry it. I executed the guard's own logic against each term's real surfaces and
+haystacks rather than reasoning about it:
+
+| Term   | Usable stems after the `< 4` filter                            | Verdict         | Severe rows | Real miss?                   |
+| ------ | -------------------------------------------------------------- | --------------- | ----------- | ---------------------------- |
+| `tcas` | `tricyclic`, `tricyclic antidepressant`, `anticholinergic tca` | **cannot fire** | 20          | **Yes — Dosulepin (§2.1)**   |
+| `arbs` | _none_                                                         | **cannot fire** | 16          | No — catalogue holds one ARB |
+| `ppis` | `proton pump inhibitor`                                        | runs correctly  | 8           | n/a                          |
+
+`ppis` is rescued by its long surface; `tcas` is not, because none of its three usable stems match
+the haystack `antidepressant tca`, and `arbs` has no usable stem at all.
+
+Second blind spot: the check reads only `class` and `subclass`, never `tag`. Celecoxib and Parecoxib
+carry `tag: "NSAID"` (§2.2) and are invisible to it for that reason.
+
+Neither fix is made here. Both are cheap, and doing them before the clinical pass would mean the
+"ran clean" lines can be trusted at face value.
diff --git a/docs/no-unchecked-indexed-access-migration-plan.md b/docs/no-unchecked-indexed-access-migration-plan.md
new file mode 100644
index 0000000000..7910f17f9a
--- /dev/null
+++ b/docs/no-unchecked-indexed-access-migration-plan.md
@@ -0,0 +1,213 @@
+# `noUncheckedIndexedAccess` — staged migration plan
+
+**Status:** plan only — this document changes no code and does not touch `tsconfig.json`
+**Ledger row:** `#211` (P2, task) · related `#212` (`as unknown as` casts), `#213` (empty catch handlers)
+**Measured:** 2026-08-14 against `origin/main` at `d47aa6d`
+**Source finding:** [`docs/review-findings-2026-08-02.md`](review-findings-2026-08-02.md) §6
+
+`tsconfig.json` sets `strict: true` but not `noUncheckedIndexedAccess`. Without the flag,
+`array[0]` is typed `T` even when the array is empty and `record[key]` is typed `V` even when
+the key is absent, so every out-of-bounds read is invisible to the compiler and surfaces as a
+runtime `undefined` — including on the answer path, where the failure lands in front of a
+clinician.
+
+Row `#211` carries an explicit **Stop:** do not flip the flag on `main` without a staged plan.
+This is that plan.
+
+---
+
+## 1. Current measurement
+
+Measured by extending `tsconfig.json` with `noUncheckedIndexedAccess: true` in a throwaway
+config outside the repo tree and running `tsc --noEmit`. **1,445 errors across 269 files** —
+up from the 1,266 recorded on 2026-08-02, because the flag is off and nothing stops new
+unchecked indexing from landing. That drift rate is itself an argument for the ratchet in §3.
+
+| Bucket                   | Errors | Share | Character                                                             |
+| ------------------------ | -----: | ----: | --------------------------------------------------------------------- |
+| `tests/**`               |    713 | 49.3% | Mechanical. A wrong guard fails a test, it does not reach production. |
+| Mockups (design scratch) |    237 | 16.4% | Mechanical. 404s in production; already gate-exempt for wiring.       |
+| `src/lib/**` (non-RAG)   |    211 | 14.6% | Mixed — contains the clinical hot spots.                              |
+| `src/components/**`      |    167 | 11.6% | Mostly mechanical render-path indexing.                               |
+| `scripts/**`             |     57 |  3.9% | Mechanical; tooling-plane, failures are loud and local.               |
+| `src/lib/rag/**`         |     32 |  2.2% | **Protected surface.** See §5.                                        |
+| `worker/**`              |     27 |  1.9% | Manual — ingestion runtime.                                           |
+| `src/` other             |      1 |  0.1% | —                                                                     |
+
+Two-thirds of the population (tests plus mockups, 950 errors) carries no production
+consequence whatever. That is what makes staging worthwhile: the risky remainder is ~500
+errors, not 1,445.
+
+**Error shape:** `TS2532` "object is possibly undefined" (569) and `TS18048` "…is possibly
+undefined" (455) together are 71% — these are the ones a guard fixes. `TS2345`/`TS2322`
+(368) are `string | undefined` flowing into a parameter typed `string`, which more often
+needs a real decision about what the absent case means.
+
+**Heaviest files:** `tests/ui-smoke.spec.ts` (43), `src/lib/demo-data.ts` (42),
+`src/components/master-document-flow-mockups.tsx` (41), `src/lib/answer-verification.ts` (41),
+`tests/evidence.test.ts` (40), `tests/ui-phone-scroll-page-owned.spec.ts` (38),
+`tests/clinical-search.test.ts` (28), `src/lib/rag/rag-extractive-answer.ts` (23),
+`worker/main.ts` (23), `src/lib/evidence.ts` (19).
+
+**To reproduce:** create a config outside the repo that extends `tsconfig.json`, adds
+`"noUncheckedIndexedAccess": true`, and excludes `.next` (build artefacts produce unrelated
+errors), then run `./node_modules/.bin/tsc --noEmit --project <that file>`. Do not add the
+throwaway config to the repo — `docs:check-links` and the tsconfig gates both notice.
+
+---
+
+## 2. Why this cannot simply be split by directory
+
+`noUncheckedIndexedAccess` is a whole-project compiler option. It cannot be enabled for one
+directory: narrowing `include` does not help either, because TypeScript still loads and
+reports errors in every transitively imported file, so a tests-only project pulls all of
+`src/lib` in with it.
+
+So the flag itself flips exactly once, in the final PR. Everything before that is remediation
+performed against the measurement, verified by a ratchet rather than by `npm run typecheck`.
+
+---
+
+## 3. The ratchet
+
+Stage 1 adds a baseline file plus a check, in the shape this repo already uses for
+`scripts/design-system-contract-baseline.json` (`metrics` + `debtByPath`) and
+`bundle-budget.json`:
+
+(Paths below are proposed, not existing — they are written without a directory prefix so the
+`docs:check-links` and `docs:check-scripts` gates do not read them as stale references.)
+
+- A baseline file `no-unchecked-indexed-access-baseline.json` under `scripts/` —
+  `{ measuredOn, total, debtByPath }` mapping each file still permitted to have errors to its
+  current count.
+- A checker `check-no-unchecked-indexed-access.mjs` under `scripts/` — runs `tsc` with the flag
+  against a generated config, then fails when a file **absent** from `debtByPath` has any
+  error, or when a listed file's count **rises**. Falling counts are fine; the baseline is
+  refreshed as stages land.
+- A `package.json` entry named `check:no-unchecked-indexed-access`, run per stage and by the
+  final PR.
+
+This makes the migration monotonic: a stage cannot be undone by the next week's merges, and
+new code cannot add debt while the migration is in flight — which is precisely what let the
+count drift from 1,266 to 1,445.
+
+**Do not** add this to `verify:cheap:internal` while the migration is in flight. A full `tsc`
+run is not a cheap gate, and `scripts/check-gate-manifest.mjs` would additionally require a
+matching `static-pr` step in `.github/workflows/ci.yml`. Run it per stage; consider promoting
+it only after stage 6, when the flag is on and `npm run typecheck` covers it anyway.
+
+---
+
+## 4. Stages
+
+One PR per stage, in this order. Cheapest and most consequence-free first, so the mechanical
+bulk lands before anyone has to think hard.
+
+### Stage 1 · Ratchet only — `MECHANICAL`
+
+- **Outcome:** the debt is measured, pinned, and cannot grow.
+- **Files:** the checker and baseline named in §3, plus `package.json` and
+  `docs/scripts-index.md`.
+- **Risk:** none — no product file changes.
+- **Verification:** the new `check:no-unchecked-indexed-access` entry passes at the baseline; a
+  deliberately introduced `arr[0]` in a clean file makes it fail.
+
+### Stage 2 · `tests/**` — 713 errors — `MECHANICAL`
+
+- **Outcome:** roughly half the population gone, with no production surface touched.
+- **Approach:** use a non-null assertion `!` only where a nearby assertion deliberately proves
+  the invariant (`const rows = parse(x); expect(rows).toHaveLength(3)`). Do not make this a
+  blanket replacement: `expect(rows[0]?.id).toBe(…)` fails with `undefined` when `rows` is
+  empty, unless `undefined` is the expected value. Choose optional access or an explicit guard
+  when that better expresses the intended test.
+- **Risk:** low, but real. Reviewers check that each assertion still states its intended empty
+  case and that `!` is backed by a local invariant.
+- **Verification:** `npm run test`; the Playwright specs in this bucket
+  (`tests/ui-smoke.spec.ts`, `tests/ui-phone-scroll-page-owned.spec.ts`) are compiled by
+  `typecheck` but only executed by `npm run verify:ui`, so typecheck is the gate that matters
+  for them.
+
+### Stage 3 · Mockups — 237 errors — `MECHANICAL`
+
+- **Outcome:** design scratch off the books.
+- **Files:** `src/app/mockups/**`, `*-mockups.tsx`.
+- **Risk:** none. These 404 in production. Note they are still compiled and still weighed by
+  `check:bundle-budget` against the `mockups` baseline — "gate-exempt" does not mean "free".
+- **Verification:** `npm run typecheck`, `npm run check:bundle-budget`.
+
+### Stage 4 · `scripts/**` and `src/components/**` — 224 errors — `MECHANICAL`, spot-reviewed
+
+- **Outcome:** the tooling plane and the render path.
+- **Approach:** `??` with a sensible empty default in render code; a thrown error in scripts,
+  where failing loudly is correct and silence is not.
+- **Risk:** low. The component work can change rendered output if a `??` default differs from
+  what the old `undefined` produced — check any empty-state or list-rendering change.
+- **Verification:** `npm run typecheck`, `npm run test`, and `npm run verify:ui` only if a
+  component's rendered output actually changed.
+
+### Stage 5 · `worker/**` and `src/lib/**` non-clinical — `MANUAL`
+
+- **Outcome:** ingestion and the general library.
+- **Approach:** `worker/main.ts:901-942` repeatedly indexes `preparedImage`/`image` arrays and
+  passes the results to functions typed `ExtractedImage`. A shorter-than-expected array throws
+  today; the fix is a real guard that skips or fails the job, not a `!` that preserves the
+  throw. `src/lib/demo-data.ts` (42) is the largest single file and is genuinely mechanical —
+  it is synthetic fixture data.
+- **Risk:** medium. Ingestion is a background worker; a wrong guard turns a loud crash into a
+  silently skipped image.
+- **Verification:** `npm run typecheck`, `npm run test`, plus `npm run check:production-readiness`
+  (ingestion is a domain change under AGENTS.md).
+
+### Stage 6 · Clinical hot spots, then flip the flag — `MANUAL, HIGHEST CARE`
+
+- **Files:** `src/lib/answer-verification.ts` (41), `src/lib/rag/rag-extractive-answer.ts` (23),
+  `src/lib/evidence.ts` (19), `src/lib/document-summary-formatting.ts` (16), and the remaining
+  `src/lib/rag/**`.
+- **Approach:** every site individually. `rag-extractive-answer.ts` is the deterministic
+  source-only fallback used _when generation has already failed its quality gate_ — an
+  out-of-bounds throw there means the fallback fails too, and the user gets nothing instead of
+  a cited answer. `answer-verification.ts` indexes into arrays that may be empty while deciding
+  whether an answer is safe to show; a `!` that converts a type error into a runtime throw
+  crashes the verification gate itself. Neither file wants `!` anywhere.
+- **Then:** set `"noUncheckedIndexedAccess": true` in `tsconfig.json`, delete the baseline and
+  its check, and remove the `check:no-unchecked-indexed-access` entry.
+- **Verification:** `npm run typecheck`, `npm run test`, `npm run check:production-readiness`,
+  and the RAG requirements in §5.
+
+---
+
+## 5. The RAG carve-out
+
+Stage 6 touches `src/lib/rag/**`, which is a protected ranking surface under AGENTS.md.
+Three obligations apply and none is optional:
+
+1. **Flag the task to the user before editing anything under `src/lib/rag/**`** — including a
+   change this mechanical.
+2. The PR body needs an explicit `RAG impact:` line or `scripts/pr-policy.mjs` blocks the
+   merge. A guard that only adds a narrowing check should be able to state
+   `RAG impact: no retrieval behaviour change — adds undefined guards without touching
+comparator order, scoring, or selection`, but that claim has to be **true**: read
+   `docs/rag-behaviour/` first and confirm no comparator key, clamped-score contract, or
+   selection threshold moved.
+3. If any guard does change ordering or selection — for example a `?? 0` default that alters a
+   sort — it is a behaviour change and needs a live eval-canary pair. That is provider-backed
+   (~$1–2) and needs explicit user approval.
+
+Splitting `src/lib/rag/**` into its own final PR, after the rest of stage 6, keeps the
+governance requirement off the other files.
+
+---
+
+## 6. Tracking
+
+Progress lives in ledger row `#211`, updated with `npm run issues:update` after each stage
+lands (never by hand-editing `docs/outstanding-issues.md`). Record the stage number, the PR,
+and the new total from the baseline file, so a later reader can tell how far the migration got
+without re-running `tsc`.
+
+Do not close `#211` until the flag is on in `tsconfig.json` and the baseline file is gone.
+A partially-migrated repo with the flag still off has none of the protection and all of the
+churn, so an abandoned migration is worse than an unstarted one.
+
+**Stop:** do not flip the flag on `main` ahead of stage 6, and do not silence a stage by adding
+files back to the baseline — the baseline only ever shrinks.
diff --git a/docs/outstanding-issues-inbox/1d35d652-d833-4934-890c-84b6837581cd.json b/docs/outstanding-issues-inbox/1d35d652-d833-4934-890c-84b6837581cd.json
new file mode 100644
index 0000000000..0b22f0d69a
--- /dev/null
+++ b/docs/outstanding-issues-inbox/1d35d652-d833-4934-890c-84b6837581cd.json
@@ -0,0 +1,10 @@
+{
+  "version": 2,
+  "id": "1d35d652-d833-4934-890c-84b6837581cd",
+  "createdOn": "2026-08-17",
+  "action": "update",
+  "payload": {
+    "id": "#324",
+    "detail": "**Outcome:** the file-level merge-loss detector is delivered; one authoritative row now tracks its remaining operational decision. **Delivered:** PR #1944 added scripts/audit-merge-loss.mjs through npm run audit:merge-loss and focused tests. It compares every changed file in a bounded main-history window with the landing commit's first parent, then reports possible reverts for human review. The implementation independently rediscovered the acf78bf casualties, including the #1803 token-retirement loss, and deliberately remains advisory because blob equality cannot distinguish a deliberate revert from an accidental merge-resolution loss. **Remaining:** decide whether it runs after merges or on a schedule, who triages positive findings, and whether the separate branch-versus-squash inbox-request-loss case should be a second detector or a mode of the same tool. A scheduled or required check without a named human disposition path would become ignorable noise. **Stop:** do not reimplement the delivered script, and do not make either detector blocking or auto-close findings until that ownership decision exists. SIGNAL-TO-NOISE CHARACTERISED AND TWO FIXES LANDED 2026-08-15 (owner-approved in session; still advisory, still unscheduled, still not blocking). (1) DEFECT FOUND AND FIXED: treeEntryReader split ls-tree output on the literal two-character sequence backslash-t rather than a tab, so the tree entry kept the filename. Same-path comparisons were unaffected, which is why the tool still found real losses, but isReconciliationMove compares an inbox path against its applied/ path, so the exemption could never match. Measured at 8069188 over 14 days: 51 findings / 255 flagged files / filesExempted 0, versus 11 findings / 66 flagged files / 189 exempted after a one-character fix - the exemption the script's own docstring says exists to stop inbox noise burying the genuine #1803 signal had been dead since it was written. Root cause of the escape: every test injected entryAt directly, so bare entries compared equal whether or not the path was stripped. Closed permanently by extracting parseTreeEntry as an exported pure function and testing it against real ls-tree output; mutation-verified (reintroducing backslash-t fails 3 tests plus the self-test). (2) MECHANISM CLASSIFIER ADDED: classifyRemoval walks the commits touching each flagged file between the landing and the ref, oldest first, takes the first whose tree entry already equals the pre-landing entry, and reports whether that commit was a merge (accidental) or single-parent (usually deliberate, and its subject says why). This is what makes the report triageable: over the window, 14 of 66 flagged files were merge-resolution removals with 13 from the single documented bad merge acf78bf, while all 52 others had explanatory single-parent subjects such as 'Re-land the --shadow-tight retirement', 'rework the viewer for phone and PWA reading' and 'ci: speed iteration without weakening gates'. Merge-resolution findings now sort first; unknown is reported rather than guessed. Mutation-verified in three directions (tab bug, newest-first walk, unknown-as-deliberate). GENUINE STILL-UNREPAIRED LOSSES, re-verified against main after it advanced past 8069188: #1800 fuzzy catalogue wiring is absent from therapies.ts, specifiers.ts and factsheets-data.ts AND all three of its tests carry zero fuzzy assertions so nothing can go red (tracked by #330); #1804's removal of UniversalSearchAlsoMatches from forms mode is reverted so the component is back at forms-search-results-page.tsx lines 44 and 894 with its guard assertions reverted, APPARENTLY UNTRACKED; #1796's ALLOWED_NODE_MAJOR_VERSIONS [24, 26] allowance is gone so worker/validate-runtime.ts still hard-codes nodeMajor() !== 24, APPARENTLY UNTRACKED; #1803 and #1807 lost design-system doc status rows while their code landed, so docs and code disagree. NEXT - the three decisions this row exists for are still open and are deliberately NOT implemented: (a) schedule, recommended weekly on a 14-day window rather than post-merge, because a post-merge trigger fires roughly 380 times per 14 days here and at merge time the loss has not happened yet; (b) triage owner, recommended routing to a pinned issue reusing the live-drift routing already covered by tests/live-drift-workflow.test.ts, with one named human, and not a required check; (c) recommended ONE tool with a --mode flag rather than a second detector, since the inbox case shares the window, landing enumeration and tree-entry comparison and differs only in paths and exemptions. Also recommended: the phantom-SHA class (a ledger record asserting a fix at 720e7027, an object that does not exist) is a DIFFERENT family - a ledger assertion with no landed content, checkable with git cat-file -e - and should get its own row rather than being folded into this tool. Stop unchanged: do not make either detector blocking or auto-close findings until the ownership decision exists."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/314e5e31-7d15-46f2-adb0-c4d113bc589d.json b/docs/outstanding-issues-inbox/314e5e31-7d15-46f2-adb0-c4d113bc589d.json
new file mode 100644
index 0000000000..22dfd92023
--- /dev/null
+++ b/docs/outstanding-issues-inbox/314e5e31-7d15-46f2-adb0-c4d113bc589d.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "314e5e31-7d15-46f2-adb0-c4d113bc589d",
+  "createdOn": "2026-08-15",
+  "action": "update",
+  "payload": {
+    "id": "#098",
+    "detail": "UPDATE 2026-08-16: residual (a) is complete on current main via commit 563ce4195512b9e623df6ba98762f4a3dc1b9e8e. tests/search-route-round-trip-budget.test.ts now drives POST /api/search with a counted Supabase client and pins the successful-request route budget plus the limiter-only denial path, so route preamble and post-processing traffic are covered. Keep this row open: residual (c) is still unresolved. scripts/eval-rag-offline.mjs and scripts/test-rag-offline.mjs remain unwired, and the new route-level test is not registered in scripts/fixtures/rag-offline-contract-tests.json. Decide explicitly whether the offline contract runner is the canonical home and register this route-level budget there, or wire the legacy scripts. The prior stop against wholesale collapsing the three lexical variants remains unchanged; any later latency change still needs a materially different approach or a real canary pair. Stop: do not close #098 until the runner decision is implemented and recorded.",
+    "source": "Commit 563ce4195512b9e623df6ba98762f4a3dc1b9e8e; tests/search-route-round-trip-budget.test.ts; scripts/fixtures/rag-offline-contract-tests.json"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/46750cbf-f4f4-4a00-ab93-bdac644afbde.json b/docs/outstanding-issues-inbox/46750cbf-f4f4-4a00-ab93-bdac644afbde.json
new file mode 100644
index 0000000000..97602ca081
--- /dev/null
+++ b/docs/outstanding-issues-inbox/46750cbf-f4f4-4a00-ab93-bdac644afbde.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "46750cbf-f4f4-4a00-ab93-bdac644afbde",
+  "createdOn": "2026-08-15",
+  "action": "update",
+  "payload": {
+    "id": "#318",
+    "detail": "docs/medication-interaction-lexicon-review.md is generated by npm run medications:lexicon-report and expands every lexicon term to the catalogue drugs it resolves to, with how many CRITICAL/HIGH rows depend on it, sorted by severe usage. It is marked UNREVIEWED and its sign-off table is unfilled, so every red and amber drug-drug interaction alert is currently an unvalidated mapping over source-backed text. The wording shown to a clinician is always verbatim catalogue prose; what is unreviewed is which drugs a phrase like 'NSAIDs' or 'CNS depressants' was taken to mean. Next: a clinician reads the term table top-down (it is sorted so the top ten terms carry most of the severe usage) and fills in the sign-off block. Stop: do not treat check:medication-lexicon-report passing as review - that check only proves the sheet describes the current lexicon, not that the mappings are correct. WORKLIST PREPARED 2026-08-15 (still UNREVIEWED; the clinician sign-off is untouched and remains the only thing that closes this row). docs/medication-lexicon-review-worklist.md gives the top ten terms by severe usage (236 of 390 severe firings, 61 percent) with resolved drug sets and six prioritised questions. The sheet was regenerated against main at 8069188 and came back byte-identical, so it is current. TWO OF THE THREE DEFECTS THIS ROW CITES ARE ALREADY CLOSED: the ARB/Carbapenem substring match is fixed and now guarded, and lithium is reachable (9 rows / 9 severe, absent from the unreachable table). Only the divergent Warfarin pair remains, and it is worse than stated - warfarin-vka and warfarin-anticoagulant carry 3 interaction rows each with ZERO in common, so which record is opened changes which warnings appear. THREE NEW FINDINGS, none of which needed live access. (1) MECHANICAL DEFECT, no clinical opinion required: the tcas selector lists slug 'dothiepin' but the catalogue slug is 'dosulepin', so the slug matches zero records and Dosulepin - flagged FATAL in overdose - fires none of the 20 severe TCA rows. (2) nsaids selects on subclassIncludes NSAID, so Celecoxib and Parecoxib (subclass 'COX-2 Inhibitor', tag 'NSAID') sit outside all 38 severe rows while Meloxicam is included only because its subclass is spelled 'NSAID (COX-2 preferential)'. (3) maois selects on subclassIncludes MAOI, so Moclobemide (subclass 'RIMA') sits outside all 17 severe rows; its tyramine risk is genuinely lower but its serotonin-syndrome risk is not. Also noted: opioids includes Loperamide (peripheral agonist) across 35 severe rows in the false-alert direction, and anticoagulants includes three antiplatelets while deliberately excluding Aspirin on identical class metadata. THE REVIEW INSTRUMENT ITSELF HAS TWO BLIND SPOTS, verified by executing the guard's own logic rather than reasoning about it: missedClassMembers() in scripts/build-medication-lexicon-report.ts skips any surface stem shorter than four characters, which makes the check unable to fire for tcas and arbs (ppis is rescued by its long surface), and the check reads only class and subclass, never tag. So the sheet's printed 'Checks that ran and found nothing' line is overstated for two terms - which is how the Dosulepin miss stayed invisible. Fixing those two blind spots before the clinical pass would make the 'ran clean' lines trustworthy. No lexicon, catalogue or sign-off content was changed."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/55cb57e8-7e6e-42f8-bd79-81b81a01ef3a.json b/docs/outstanding-issues-inbox/55cb57e8-7e6e-42f8-bd79-81b81a01ef3a.json
new file mode 100644
index 0000000000..2be598e0bd
--- /dev/null
+++ b/docs/outstanding-issues-inbox/55cb57e8-7e6e-42f8-bd79-81b81a01ef3a.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "55cb57e8-7e6e-42f8-bd79-81b81a01ef3a",
+  "createdOn": "2026-08-15",
+  "action": "update",
+  "payload": {
+    "id": "#314",
+    "detail": "UPDATE 2026-08-16: the provider-free implementation is now on current main via commit ca788d41e: view=summary/search projections and gzip are shipped in repository code. Remaining scope is external-only: deploy an exact authorized SHA, verify /api/registry/records headers and transfer bytes on that deployment, then rerun live LCP. Stop: do not close from local payload measurements, and do not deploy or query production without explicit target authorization.",
+    "source": "Commit ca788d41e on current main; original latency audit evidence"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/55f0d5de-8642-487a-b063-44c1c0bc0921.json b/docs/outstanding-issues-inbox/55f0d5de-8642-487a-b063-44c1c0bc0921.json
new file mode 100644
index 0000000000..fa12e554a4
--- /dev/null
+++ b/docs/outstanding-issues-inbox/55f0d5de-8642-487a-b063-44c1c0bc0921.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "55f0d5de-8642-487a-b063-44c1c0bc0921",
+  "createdOn": "2026-08-15",
+  "action": "done",
+  "payload": {
+    "id": "#237",
+    "outcome": "Completed with a real Chromium mockup journey at 320x700 using the production AccessibleTable and MissingValue components. The focused repository wrapper passed twice; computed proof showed normal whitespace, no ellipsis, both full 'Not recorded' phrases within the table wrapper, wrapper scroll delta at most 1px, and zero page overflow. The final 320x700 screenshot was visually inspected and confirmed the low-confidence warning and phrases are legible and uncut. No product CSS adjustment was needed."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/739887b7-24d6-4ea8-9aad-e7700a537913.json b/docs/outstanding-issues-inbox/739887b7-24d6-4ea8-9aad-e7700a537913.json
new file mode 100644
index 0000000000..e34160ae52
--- /dev/null
+++ b/docs/outstanding-issues-inbox/739887b7-24d6-4ea8-9aad-e7700a537913.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "739887b7-24d6-4ea8-9aad-e7700a537913",
+  "createdOn": "2026-08-15",
+  "action": "done",
+  "payload": {
+    "id": "#330",
+    "outcome": "Resolved on current main 512b8c20e by commit 247a35936cfdc78e2e85dd889d5d9dbdc3804e32: conservative fuzzy catalogue search and the one-edit cap are implemented with wrong-drug regression coverage."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/7ad31d10-aeef-4635-863d-d6ce9340d916.json b/docs/outstanding-issues-inbox/7ad31d10-aeef-4635-863d-d6ce9340d916.json
new file mode 100644
index 0000000000..d7c4ba29de
--- /dev/null
+++ b/docs/outstanding-issues-inbox/7ad31d10-aeef-4635-863d-d6ce9340d916.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "7ad31d10-aeef-4635-863d-d6ce9340d916",
+  "createdOn": "2026-08-15",
+  "action": "update",
+  "payload": {
+    "id": "#265",
+    "detail": "CORRECTION QUEUED 2026-08-15 during PR #1987 review. Gate 2 is closed for new use, but the just-reconciled detail inherited stale measurements from PR #1984's pre-sync tree. On the exact current tree after PRs #1982-#1986, check:design-system-contract measures interactiveTapFloorDeclarations=40 across 16 production files, not 43 across 17, and edgeOwnershipConflicts=19 across 10 files, not 25 across 12. The strengthened tap-floor parser removed three old false-positive counts from calculators/search-page.tsx; favourites-library-nav and pwa-lifecycle no longer contribute edge conflicts after the merged UI work. The baseline and GATES.md still permit/report the older 43 and 25 values, so they carry three and six units of stale ratchet slack respectively and need a focused tightening follow-up. The detector still correctly evaluates comparable arbitrary lengths and reachable conditional/composed branches, and component-wrapper tags such as Link remain its known blind spot. Gate 7 remains open: add a shared deterministic render-tree traversal plus child/parent elevation-tier check. Gate 8 remains open: decide ring-versus-outline focus ownership, widen onePixelShadowSpreads to all relevant token families, then retire conflicts with browser focus proof. Do not edit the applied 8c133c4e request in place; it is immutable audit history.",
+    "source": "PR #1987 review; exact tree after #1986; check:design-system-contract; scripts/design-system-contract-baseline.json; docs/design-system/GATES.md"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/7e454b66-74ae-4e67-8669-1f1fdc2c018c.json b/docs/outstanding-issues-inbox/7e454b66-74ae-4e67-8669-1f1fdc2c018c.json
new file mode 100644
index 0000000000..d0a74a28c1
--- /dev/null
+++ b/docs/outstanding-issues-inbox/7e454b66-74ae-4e67-8669-1f1fdc2c018c.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "7e454b66-74ae-4e67-8669-1f1fdc2c018c",
+  "createdOn": "2026-08-15",
+  "action": "done",
+  "payload": {
+    "id": "#331",
+    "outcome": "Resolved on current main: PR #1951 commit 9628b246 repairs the generated medication lexicon report and PR #1979 commit 17402395 wires check:medication-lexicon-report into the static_heavy_changed CI contract. Clean current main 512b8c20 reproduces the check green at 28 catalogue terms; clinician review remains separately tracked by #318."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/81fdf812-4dd6-4fd6-b2e8-f3b730affd8a.json b/docs/outstanding-issues-inbox/81fdf812-4dd6-4fd6-b2e8-f3b730affd8a.json
new file mode 100644
index 0000000000..03647fe9c5
--- /dev/null
+++ b/docs/outstanding-issues-inbox/81fdf812-4dd6-4fd6-b2e8-f3b730affd8a.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "81fdf812-4dd6-4fd6-b2e8-f3b730affd8a",
+  "createdOn": "2026-08-15",
+  "action": "done",
+  "payload": {
+    "id": "#192",
+    "outcome": "Resolved by PR #1964 (commit adc5182a7): X6 added four clinical/retrieval/answer coverage groups plus global/broad floors and CI enforcement, raising evidence/verification branches 81 to 84 and core RAG branches 72 to 76 without lowering any floor. Current-main static CI scope check passes. A fresh exclusive coverage run is useful after later RAG commits but is freshness evidence, not remaining X6 implementation."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/a81b68eb-6b26-46db-81fa-90279a599886.json b/docs/outstanding-issues-inbox/a81b68eb-6b26-46db-81fa-90279a599886.json
new file mode 100644
index 0000000000..4c735d168d
--- /dev/null
+++ b/docs/outstanding-issues-inbox/a81b68eb-6b26-46db-81fa-90279a599886.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "a81b68eb-6b26-46db-81fa-90279a599886",
+  "createdOn": "2026-08-15",
+  "action": "done",
+  "payload": {
+    "id": "#162",
+    "outcome": "Resolved on current main 512b8c20e by commit 88e3117ff3e078f0c88cd2e5e5c360ce4efca665: Tools is an all-results directory with query-as-H1, shared results band, dense rows, filters, and one-composer ownership. Stale local branch disposition remains separate hygiene work."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/00428ff0-1b45-4066-9838-94216fa8b6eb.json b/docs/outstanding-issues-inbox/applied/00428ff0-1b45-4066-9838-94216fa8b6eb.json
similarity index 100%
rename from docs/outstanding-issues-inbox/00428ff0-1b45-4066-9838-94216fa8b6eb.json
rename to docs/outstanding-issues-inbox/applied/00428ff0-1b45-4066-9838-94216fa8b6eb.json
diff --git a/docs/outstanding-issues-inbox/01580a63-502e-4ee9-bdf2-a5bf492f7dee.json b/docs/outstanding-issues-inbox/applied/01580a63-502e-4ee9-bdf2-a5bf492f7dee.json
similarity index 100%
rename from docs/outstanding-issues-inbox/01580a63-502e-4ee9-bdf2-a5bf492f7dee.json
rename to docs/outstanding-issues-inbox/applied/01580a63-502e-4ee9-bdf2-a5bf492f7dee.json
diff --git a/docs/outstanding-issues-inbox/04a0b8d6-8af9-4779-8af8-8e3b6e9a3b2b.json b/docs/outstanding-issues-inbox/applied/04a0b8d6-8af9-4779-8af8-8e3b6e9a3b2b.json
similarity index 100%
rename from docs/outstanding-issues-inbox/04a0b8d6-8af9-4779-8af8-8e3b6e9a3b2b.json
rename to docs/outstanding-issues-inbox/applied/04a0b8d6-8af9-4779-8af8-8e3b6e9a3b2b.json
diff --git a/docs/outstanding-issues-inbox/applied/0948fcd2-2e51-47bc-8990-7ec002934e43.json b/docs/outstanding-issues-inbox/applied/0948fcd2-2e51-47bc-8990-7ec002934e43.json
new file mode 100644
index 0000000000..a673b068f2
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/0948fcd2-2e51-47bc-8990-7ec002934e43.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "0948fcd2-2e51-47bc-8990-7ec002934e43",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#316",
+    "detail": "2026-08-14 incident session: two of the 21 missing indexes (documents_title_trgm_idx, document_chunks_content_trgm_idx) were the retrieval-critical pair; restored live via owner-approved CREATE INDEX CONCURRENTLY + ANALYZE. Before/after supabase_rpc_latency_ms 31610 -> 1535 (text) / 8519 (hybrid). Forensics: indexes existed 2026-08-04 (guard 20260804110240 passed) and were dropped by 2026-08-09; no app code drops indexes - owner to check dashboard audit for manual/advisor DROP INDEX. Evidence: docs/audit/live-drift-forensics-2026-08.md. Remaining drift findings + 10 diverged match_* RPC bodies stay with docs/database-remediation-plan.md. Drift routing: PR #1939. WHOLE-SCHEMA MEASUREMENT 2026-08-14 (read-only connector session, recorded in forensics 1.2 and 1.3): after that repair, 210 repo-defined indexes vs 192 live, 20 still absent and 2 orphaned on live (210-20+2=192, so neither side is a partial read). Both repaired indexes confirmed present. NOTE the arithmetic does not reconcile with the row's original 21: 21 minus the 2 restored would leave 19, not 20 - treat 20 as the measured current figure and 21 as approximate. Retrieval-relevant absentees include document_chunks_anchor_idx, document_index_units_heading_path_idx, rag_aliases_type_enabled_idx, rag_queries_source_chunk_ids_gin_idx, rag_query_misses_aliases_idx. Zero invalid-or-not-ready indexes across public, so the failed-CREATE-INDEX-CONCURRENTLY class documented in database-drift-detection.md explains none of them. All five creating migrations recorded executed DDL (stmt_count 32/36/14/27/11, none mark-applied), including 20260712165211_reconcile_missing_operational_indexes. RPC half now enumerated: 0 missing, 0 extra, 16 hash mismatches, of which 6 are proven normalization noise (re-qualifying vector to extensions.vector reproduces the manifest hash exactly) and 10 are real and UNCLASSIFIED - which independently confirms this row's 10. Next: per-function diff hunks for the 10 (read-only) before any RPC write, then one approved window covering indexes and RPCs together. Stop: do not redeploy repo RPC definitions over live before the hunks classify them - that is a protected-surface behaviour change needing a canary pair; and do not treat root cause as established."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/0a052268-97e1-4d4a-9ad7-033003aa486c.json b/docs/outstanding-issues-inbox/applied/0a052268-97e1-4d4a-9ad7-033003aa486c.json
new file mode 100644
index 0000000000..166bba5ad1
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/0a052268-97e1-4d4a-9ad7-033003aa486c.json
@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "id": "0a052268-97e1-4d4a-9ad7-033003aa486c",
+  "createdOn": "2026-08-15",
+  "action": "add",
+  "payload": {
+    "pri": "P2",
+    "type": "task",
+    "summary": "Favourites Continue and Recent are driven by hard-coded demo timestamps; real saved items have no last-opened data",
+    "detail": "Surfaced while shipping #164 (PR #1983), which made both surfaces prominent. src/components/clinical-dashboard/favourites-command-library-page.tsx derives 'most recently used' from lastUsedScore(item.lastUsed), and item.lastUsed comes from lastUsedByItemId — a hard-coded five-entry literal keyed to demo slugs ('Today 08:44', 'Yesterday 16:12', ...). Anything else, including every real registry favourite, falls back to the literal string 'Saved', which lastUsedScore buckets at 1000. pinnedItemIds is likewise a hard-coded two-item Set. The consequence after #164: for a signed-in user with real favourites, the Continue card and the Recent panel are effectively arbitrary — every item ties at the same score and the order is whatever the source array happened to be. Note that recentQueries in the shell is search-query history, not viewed-item history, so it cannot back this. Next: add a per-favourite last-opened timestamp. Cheapest is a client-side recents store keyed by favourite id written on open; the durable version is a column on the account favourites record so it survives a device change, which is a schema plus /api/account/favourites change and needs the usual migration review. Either way, pinning should stop being a hard-coded id set. Stop: do not fabricate a timestamp at render time from anything other than a recorded open event — an invented 'last used' on a clinical reference list is worse than an honest absence.",
+    "source": "session 2026-08-15; PR #1983; favourites-command-library-page.tsx lastUsedByItemId/pinnedItemIds"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/0b6a19d6-c586-4ea3-8fc6-fa8ee941d922.json b/docs/outstanding-issues-inbox/applied/0b6a19d6-c586-4ea3-8fc6-fa8ee941d922.json
new file mode 100644
index 0000000000..8efa0c0069
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/0b6a19d6-c586-4ea3-8fc6-fa8ee941d922.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "0b6a19d6-c586-4ea3-8fc6-fa8ee941d922",
+  "createdOn": "2026-08-14",
+  "action": "cancel",
+  "payload": {
+    "requestId": "b53c5e20-2c6f-41da-a202-bcf5c7609938",
+    "reason": "The queued correction is stale: PR #1949's PWA install-sheet decoding=async change is now on main."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/0bbea6d5-4d5e-4e9a-bcba-bc129beeba3f.json b/docs/outstanding-issues-inbox/applied/0bbea6d5-4d5e-4e9a-bcba-bc129beeba3f.json
new file mode 100644
index 0000000000..c0cb664bb1
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/0bbea6d5-4d5e-4e9a-bcba-bc129beeba3f.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "0bbea6d5-4d5e-4e9a-bcba-bc129beeba3f",
+  "createdOn": "2026-08-14",
+  "action": "cancel",
+  "payload": {
+    "requestId": "ef62d13b-6852-4a12-a1d3-4d7e22ec1232",
+    "reason": "The shell expanded code-span markers while creating this request, removing two command names; preserve it for audit and apply the corrected #331 update instead."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/0e5573e3-425d-4253-9b28-0c1c81a4f3fe.json b/docs/outstanding-issues-inbox/applied/0e5573e3-425d-4253-9b28-0c1c81a4f3fe.json
new file mode 100644
index 0000000000..e4d591766e
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/0e5573e3-425d-4253-9b28-0c1c81a4f3fe.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "0e5573e3-425d-4253-9b28-0c1c81a4f3fe",
+  "createdOn": "2026-08-15",
+  "action": "done",
+  "payload": {
+    "id": "#163",
+    "outcome": "CLOSED 2026-08-15 by PR #1982, but the row was half-stale when picked up and the split is worth recording. ALREADY ON MAIN before this PR, verified against e60b49a: the query is the <h1> via SearchResultsHeaderBand headingLevel={1} (the count is separate neutral text, never a heading), the shortlist bar is already conditional on selected.length, Compare already exists, and the four-card numbered walkthrough (ServiceReferralFlow) is mounted only on /services/[slug] — tests/ui-tools.spec.ts:1394 already asserted it absent from results. The current/ baseline PNG the row was written against is from 2026-07-31 and no longer reflects main, which is why the row read as untouched work. DELIVERED BY THIS PR: the tiny Search/Shortlist/Compare/Refer dot rail (new ServiceReferralProgress, accessible name Referral progress — deliberately not Referral workflow, so the absence assertion cannot be satisfied by renaming the old component back onto the route); row compaction dropping the Catchment/Eligibility/Cost strip and the confidence pill (both values remain untruncated on the record behind Review referral); a per-row bookmark wired to account favourites and kept distinct from the non-persisted shortlist, with a visible polite status because sign-in-required is the common guest outcome; and the shortlist banner moved below the heading it qualifies. NOT DONE, deliberately: the comp draws the query dominant and the count small, which is the reverse of the shipped band. That weighting is a documented contract (docs/search-chrome-behaviour.md Results band rules 1-2), shared by twelve modes, and visual-baselined from /services?q=CMHT&run=1, so inverting it is a repo-wide change and not this row. The outcome this row asked for holds either way. Captured separately. Verification: verify:pr-local all ten selected gates passed; UI proof delegated to CI Production UI because the container ships chromium-1194 against a pinned 1234 (#255/#312)."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/11e56221-8d46-4c9a-a89c-78621f18e754.json b/docs/outstanding-issues-inbox/applied/11e56221-8d46-4c9a-a89c-78621f18e754.json
similarity index 100%
rename from docs/outstanding-issues-inbox/11e56221-8d46-4c9a-a89c-78621f18e754.json
rename to docs/outstanding-issues-inbox/applied/11e56221-8d46-4c9a-a89c-78621f18e754.json
diff --git a/docs/outstanding-issues-inbox/applied/1376cc64-a753-41a0-9c54-30a5cca7f896.json b/docs/outstanding-issues-inbox/applied/1376cc64-a753-41a0-9c54-30a5cca7f896.json
new file mode 100644
index 0000000000..6db8875cd4
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/1376cc64-a753-41a0-9c54-30a5cca7f896.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "1376cc64-a753-41a0-9c54-30a5cca7f896",
+  "createdOn": "2026-08-15",
+  "action": "update",
+  "payload": {
+    "id": "#312",
+    "detail": "Progress 2026-08-15: PR #1965 landed on main (commit 3ec6116) and closes the false-OK gap for the pinned Chromium revision by resolving the effective cache and requiring a launchable binary. Keep this issue open: the unscoped test:e2e and release matrix also require Firefox and WebKit, and the check does not yet report whether their locked revisions are installed. Next: enumerate required and installed revisions for all browser families, with a Chromium-only-cache regression; project-scoped --project=chromium runs may continue to require Chromium alone."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/17e1baf4-7d8f-4494-acd6-a845ade305ca.json b/docs/outstanding-issues-inbox/applied/17e1baf4-7d8f-4494-acd6-a845ade305ca.json
similarity index 100%
rename from docs/outstanding-issues-inbox/17e1baf4-7d8f-4494-acd6-a845ade305ca.json
rename to docs/outstanding-issues-inbox/applied/17e1baf4-7d8f-4494-acd6-a845ade305ca.json
diff --git a/docs/outstanding-issues-inbox/applied/1860498b-2e89-41cf-85f1-e62dc3cca057.json b/docs/outstanding-issues-inbox/applied/1860498b-2e89-41cf-85f1-e62dc3cca057.json
new file mode 100644
index 0000000000..8cdf380148
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/1860498b-2e89-41cf-85f1-e62dc3cca057.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "1860498b-2e89-41cf-85f1-e62dc3cca057",
+  "createdOn": "2026-08-14",
+  "action": "done",
+  "payload": {
+    "id": "#210",
+    "outcome": "Closed after PR #1953 landed on main: scripts/run-playwright.mjs now gives the generated isolated child tsconfig its own include/exclude, preventing stale repo-root .next/dev types from leaking into the Playwright build while retaining the run's generated types."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/19762e55-fa25-41de-a5a2-7f4932a545fe.json b/docs/outstanding-issues-inbox/applied/19762e55-fa25-41de-a5a2-7f4932a545fe.json
new file mode 100644
index 0000000000..c4bb9a01e0
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/19762e55-fa25-41de-a5a2-7f4932a545fe.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "19762e55-fa25-41de-a5a2-7f4932a545fe",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#324",
+    "detail": "**Outcome:** the file-level merge-loss detector is delivered; one authoritative row now tracks its remaining operational decision. **Delivered:** PR #1944 added scripts/audit-merge-loss.mjs through npm run audit:merge-loss and focused tests. It compares every changed file in a bounded main-history window with the landing commit's first parent, then reports possible reverts for human review. The implementation independently rediscovered the acf78bf casualties, including the #1803 token-retirement loss, and deliberately remains advisory because blob equality cannot distinguish a deliberate revert from an accidental merge-resolution loss. **Remaining:** decide whether it runs after merges or on a schedule, who triages positive findings, and whether the separate branch-versus-squash inbox-request-loss case should be a second detector or a mode of the same tool. A scheduled or required check without a named human disposition path would become ignorable noise. **Stop:** do not reimplement the delivered script, and do not make either detector blocking or auto-close findings until that ownership decision exists.",
+    "source": "session 2026-08-13 blob sweep; PR #1944 audit implementation and tests; PR #1937 inbox-loss case; consolidated by PR #1956 review follow-up"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/19fb70c0-1fd4-43a8-a4f4-efa9c31d16b1.json b/docs/outstanding-issues-inbox/applied/19fb70c0-1fd4-43a8-a4f4-efa9c31d16b1.json
new file mode 100644
index 0000000000..7f06c89dae
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/19fb70c0-1fd4-43a8-a4f4-efa9c31d16b1.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "19fb70c0-1fd4-43a8-a4f4-efa9c31d16b1",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#231",
+    "detail": "2026-08-14: rung-2 evidence measured live - supabase_rpc_latency_ms 31610 on a semantic query (route budget 25000 starved generation), caused by the #316 dropped trigram indexes; after restore 1535 (text) / 8519 (hybrid). Pre-generation latency was the binding residual cause for semantic-query fallbacks; S1 (A1 phase 2) should re-verify generation-quality-gate dominance on healthy latency before choosing a code mitigation rung.",
+    "source": "session 2026-08-14 live incident probes"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/1b483041-4f2e-4ccf-872e-f7657785cfb3.json b/docs/outstanding-issues-inbox/applied/1b483041-4f2e-4ccf-872e-f7657785cfb3.json
similarity index 100%
rename from docs/outstanding-issues-inbox/1b483041-4f2e-4ccf-872e-f7657785cfb3.json
rename to docs/outstanding-issues-inbox/applied/1b483041-4f2e-4ccf-872e-f7657785cfb3.json
diff --git a/docs/outstanding-issues-inbox/applied/1da43f2b-4b52-4fb7-b39a-e5aa5bf7c7e7.json b/docs/outstanding-issues-inbox/applied/1da43f2b-4b52-4fb7-b39a-e5aa5bf7c7e7.json
new file mode 100644
index 0000000000..fe19e0445a
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/1da43f2b-4b52-4fb7-b39a-e5aa5bf7c7e7.json
@@ -0,0 +1,12 @@
+{
+  "version": 1,
+  "id": "1da43f2b-4b52-4fb7-b39a-e5aa5bf7c7e7",
+  "createdOn": "2026-08-15",
+  "action": "update",
+  "payload": {
+    "id": "#316",
+    "summary": "Live DB has 20 currently missing repo-defined indexes and 10 retrieval RPC bodies diverge; weekly live-drift has been red since 2026-07-26 with no routing",
+    "detail": "2026-08-14 incident session: two of the 21 missing indexes (documents_title_trgm_idx, document_chunks_content_trgm_idx) were the retrieval-critical pair; restored live via owner-approved CREATE INDEX CONCURRENTLY + ANALYZE. Current 2026-08-14 inventory is 20 missing indexes (the inventory result, not an arithmetic inference from the prior 21 baseline). Before/after supabase_rpc_latency_ms 31610 -> 1535 (text) / 8519 (hybrid). Forensics: the pair was created 2026-07-05 and reported missing by 2026-08-02, so the drop is bounded between 2026-07-05 and 2026-08-02 (likely by 2026-07-26); guard 20260804110240 validates four other indexes and gives no existence bound for this pair. No app code drops indexes; owner dashboard-audit check for manual/advisor DROP INDEX remains pending. Evidence: docs/audit/live-drift-forensics-2026-08.md. Remaining drift findings plus 10 diverged match_* RPC bodies stay with docs/database-remediation-plan.md. Drift routing: PR #1939.",
+    "source": "PR #1968 review against docs/audit/live-drift-forensics-2026-08.md, 2026-08-15"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/1e598935-a21b-4aa5-9bd2-c667ce16ebbd.json b/docs/outstanding-issues-inbox/applied/1e598935-a21b-4aa5-9bd2-c667ce16ebbd.json
similarity index 100%
rename from docs/outstanding-issues-inbox/1e598935-a21b-4aa5-9bd2-c667ce16ebbd.json
rename to docs/outstanding-issues-inbox/applied/1e598935-a21b-4aa5-9bd2-c667ce16ebbd.json
diff --git a/docs/outstanding-issues-inbox/2194da1d-c445-47db-8b97-09774056ab42.json b/docs/outstanding-issues-inbox/applied/2194da1d-c445-47db-8b97-09774056ab42.json
similarity index 100%
rename from docs/outstanding-issues-inbox/2194da1d-c445-47db-8b97-09774056ab42.json
rename to docs/outstanding-issues-inbox/applied/2194da1d-c445-47db-8b97-09774056ab42.json
diff --git a/docs/outstanding-issues-inbox/applied/21b6525a-dd2d-4dcc-95d5-c3c777420adf.json b/docs/outstanding-issues-inbox/applied/21b6525a-dd2d-4dcc-95d5-c3c777420adf.json
new file mode 100644
index 0000000000..dd2f90d2c5
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/21b6525a-dd2d-4dcc-95d5-c3c777420adf.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "21b6525a-dd2d-4dcc-95d5-c3c777420adf",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#333",
+    "detail": "PARTIAL 2026-08-14 (PR #1951): the regeneration half of this row's Next step is done. Ran npm run medications:lexicon-report, confirmed by whitespace-normalised byte comparison that it is a pure re-wrap and not a content change needing clinical review (all 28 catalogue terms identical), and committed it. The diagnosis in #331 is now closed out: it was not a staleness-comparison bug, it was a genuinely stale committed file that prettier could not flag because proseWrap: preserve accepts both wrappings. STILL OPEN, and the more important half: the check is in the local verify:pr-local chain but in no CI job, so it fails every local preflight while every required check stays green. Decide one way or the other — wire it into CI so it cannot silently rot again, or drop it from verify:pr-local so it stops failing preflights it does not gate. Caveat on this PR: #1951 carries the regeneration alongside a workflow test rather than strictly on its own as this row asked, because the session was constrained to a single designated branch; the regeneration is its own revertible commit."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/24408f86-38ff-4715-affa-55d6c7bc1bb7.json b/docs/outstanding-issues-inbox/applied/24408f86-38ff-4715-affa-55d6c7bc1bb7.json
new file mode 100644
index 0000000000..e7ae0ea2b8
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/24408f86-38ff-4715-affa-55d6c7bc1bb7.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "24408f86-38ff-4715-affa-55d6c7bc1bb7",
+  "createdOn": "2026-08-15",
+  "action": "cancel",
+  "payload": {
+    "requestId": "0948fcd2-2e51-47bc-8990-7ec002934e43",
+    "reason": "Superseded by the corrected forensic record: it falsely narrows the index window, overstates unresolved hash mismatches as body differences, and combines separately approved Phase 3 and Phase 4 work."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/256e9f44-2c1d-4068-a3e6-74baf3de271d.json b/docs/outstanding-issues-inbox/applied/256e9f44-2c1d-4068-a3e6-74baf3de271d.json
new file mode 100644
index 0000000000..147ffe97a5
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/256e9f44-2c1d-4068-a3e6-74baf3de271d.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "256e9f44-2c1d-4068-a3e6-74baf3de271d",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#212",
+    "detail": "RAG-surface tranche implemented via PR #1946: new src/lib/rag/rag-row-contracts.ts (assertRetrievalRows, Zod-backed, RetrievalRowShapeError) replaces 4 'as SearchResult[]' casts in rag.ts (hybrid telemetry/merge, vector-fallback, document-summary context) with runtime shape assertion -- strict on id/document_id/content (not-null in schema) and the 4 score fields (nullish), loose via z.looseObject on everything else so RPC-version column differences don't break. Assertion-only (no transform), so object identity/key order is unchanged on success; errors carry only Zod issue paths, never row content. tests/rag-retrieval-row-contract.test.ts (8 cases) plus tests/rag-imputation-contract.test.ts kept green as evidence no ranking/comparator logic moved. Deliberately untouched: query_embedding casts (a deliberate repo-wide convention satisfying Supabase-generated RPC types) and outbound Json serialization casts. Remaining #212 population (~11 as-unknown-as casts) confirmed via grep to live OUTSIDE rag.ts's import graph: src/app/api/documents/route.ts (4), src/app/api/ingestion/{batches,jobs,quality}/route.ts (6), src/app/api/jobs/route.ts (1) -- legitimate non-RAG-flagged tranche-2 candidates, not yet started.",
+    "source": "PR #1946, session 2026-08-14"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/25f6b53a-86e2-42e9-9b38-1c2daae28892.json b/docs/outstanding-issues-inbox/applied/25f6b53a-86e2-42e9-9b38-1c2daae28892.json
similarity index 100%
rename from docs/outstanding-issues-inbox/25f6b53a-86e2-42e9-9b38-1c2daae28892.json
rename to docs/outstanding-issues-inbox/applied/25f6b53a-86e2-42e9-9b38-1c2daae28892.json
diff --git a/docs/outstanding-issues-inbox/applied/2b7856a5-fe32-49b8-9e3c-819d961784c6.json b/docs/outstanding-issues-inbox/applied/2b7856a5-fe32-49b8-9e3c-819d961784c6.json
new file mode 100644
index 0000000000..b66e07f209
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/2b7856a5-fe32-49b8-9e3c-819d961784c6.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "2b7856a5-fe32-49b8-9e3c-819d961784c6",
+  "createdOn": "2026-08-14",
+  "action": "done",
+  "payload": {
+    "id": "#335",
+    "outcome": "Closed 2026-08-15 as duplicate follow-up of #324. The delivered file-level audit, the remaining schedule/owner decision, and the distinct inbox-request-loss scope are all retained in #324; no scheduling or CI policy was changed by this consolidation."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/3156e1c9-82aa-46c3-84e6-0e119015acc6.json b/docs/outstanding-issues-inbox/applied/3156e1c9-82aa-46c3-84e6-0e119015acc6.json
new file mode 100644
index 0000000000..a9274bf0f0
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/3156e1c9-82aa-46c3-84e6-0e119015acc6.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "3156e1c9-82aa-46c3-84e6-0e119015acc6",
+  "createdOn": "2026-08-15",
+  "action": "cancel",
+  "payload": {
+    "requestId": "1da43f2b-4b52-4fb7-b39a-e5aa5bf7c7e7",
+    "reason": "Superseded by the consolidated #316 update so all Phase 0 evidence and the corrected current inventory land as one audited mutation."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/33d68dca-16b7-4325-8c50-f046c2f71316.json b/docs/outstanding-issues-inbox/applied/33d68dca-16b7-4325-8c50-f046c2f71316.json
similarity index 100%
rename from docs/outstanding-issues-inbox/33d68dca-16b7-4325-8c50-f046c2f71316.json
rename to docs/outstanding-issues-inbox/applied/33d68dca-16b7-4325-8c50-f046c2f71316.json
diff --git a/docs/outstanding-issues-inbox/applied/38c6095f-41f5-4925-b1ea-f5af5187885d.json b/docs/outstanding-issues-inbox/applied/38c6095f-41f5-4925-b1ea-f5af5187885d.json
new file mode 100644
index 0000000000..72a38f0367
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/38c6095f-41f5-4925-b1ea-f5af5187885d.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "38c6095f-41f5-4925-b1ea-f5af5187885d",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#238",
+    "detail": "CLOSURE ATTEMPTED AND REJECTED 2026-08-14 — read this before closing again. PR #1940 queued a `done` for this row citing tests/sheet.dom.test.tsx and the `portal = true` default; the closure was cancelled on review with the reason \"generic Sheet coverage does not verify the requested product-overlay browser journeys\". The cancellation is correct. The residual risk this row exists for is ancestor-scoped CSS, `contain` and `transform` on the specific product overlays — a property of where each overlay sits in the real page, which a component-level unit test cannot see no matter how thorough it is. IN FLIGHT note retired: PR #1842 merged, so the do-not-start warning no longer applies. The requirement is unchanged. PR #1616 flips the Sheet portal default to true, moving ~10 product overlays into OverlayRoot; token inheritance is safe. Next: one visual pass in a real browser over settings-dialog, ClinicalSidebar, answer-result sheets, launcher sheet and section-nav. Stop: do not close this row on Sheet component coverage — the question is about the five host surfaces, not about Sheet."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/397a3588-b8cf-404b-a3d4-6060b84f7d60.json b/docs/outstanding-issues-inbox/applied/397a3588-b8cf-404b-a3d4-6060b84f7d60.json
new file mode 100644
index 0000000000..37b0ecf067
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/397a3588-b8cf-404b-a3d4-6060b84f7d60.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "397a3588-b8cf-404b-a3d4-6060b84f7d60",
+  "createdOn": "2026-08-15",
+  "action": "cancel",
+  "payload": {
+    "requestId": "c3622ee1-872f-4476-8b12-20e97057c5d5",
+    "reason": "Superseded by the corrected forensic record: its sampled migration fingerprint does not cover every migration behind the absent-index inventory."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/39b08439-bd16-4b6d-b218-f04ad0a9a8cd.json b/docs/outstanding-issues-inbox/applied/39b08439-bd16-4b6d-b218-f04ad0a9a8cd.json
similarity index 100%
rename from docs/outstanding-issues-inbox/39b08439-bd16-4b6d-b218-f04ad0a9a8cd.json
rename to docs/outstanding-issues-inbox/applied/39b08439-bd16-4b6d-b218-f04ad0a9a8cd.json
diff --git a/docs/outstanding-issues-inbox/applied/3d0adf39-ec7a-4fa3-9309-057a193410de.json b/docs/outstanding-issues-inbox/applied/3d0adf39-ec7a-4fa3-9309-057a193410de.json
new file mode 100644
index 0000000000..0249dbcdc8
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/3d0adf39-ec7a-4fa3-9309-057a193410de.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "3d0adf39-ec7a-4fa3-9309-057a193410de",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#316",
+    "detail": "Combined 2026-08-14 update, superseding the two partial requests cancelled in this same batch. PHASE 0 CLOSED including the forced-dispatch proof its definition of done required: live-drift dispatched on main (Actions run 31813064485) failed at the drift step, the always() capture step still ran, the migration-history step correctly skipped, and the separate drift-routing job then created issue #1963 \"Live drift check failing\" carrying the label, run URL, job result, trigger and the full findings block. Routing is now also covered offline by tests/live-drift-workflow.test.ts, mutation-verified. INCIDENT REPAIR, owner-approved in-session: the two retrieval-critical indexes documents_title_trgm_idx and document_chunks_content_trgm_idx were restored with CREATE INDEX CONCURRENTLY plus ANALYZE, both indisvalid and indisready at 648 kB and 68 MB, re-verified afterwards by an independent read-only query. Before and after supabase_rpc_latency_ms 31610 to 1535 on the text fast path and 8519 hybrid, with match_document_chunks_text_v2 at 14 ms. No repo schema change was needed because the definitions were already codified. CORRECTED FIGURES measured 2026-08-14, superseding the 2026-08-09 numbers this row was opened with: 10 match_* def_hash mismatches (unchanged), 20 missing_live indexes rather than 21, and the same 2 unexpected_live. ATTRIBUTION STILL OPEN: migration 20260705180000 recorded 14 executed statements so it was not mark-applied, and the 20260804110240 guard validates four other indexes and never checks this pair, so it gives no existence bound for 2026-08-04. The drop window is therefore 2026-07-05 to 2026-08-02 and the dashboard audit-history pairing remains owner action; #248 stays open. NEXT: Phase 3 RPC reconciliation before Phase 4, per the plan's ordering that the change which can alter clinical answers precedes the ones that only speed them up. Evidence: docs/audit/live-drift-forensics-2026-08.md."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/3d861de3-4402-4e40-8dec-8a84e10093c2.json b/docs/outstanding-issues-inbox/applied/3d861de3-4402-4e40-8dec-8a84e10093c2.json
new file mode 100644
index 0000000000..f435c95a05
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/3d861de3-4402-4e40-8dec-8a84e10093c2.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "3d861de3-4402-4e40-8dec-8a84e10093c2",
+  "createdOn": "2026-08-14",
+  "action": "done",
+  "payload": {
+    "id": "#215",
+    "outcome": "Closed after PR #1949 landed on main: the PWA install-sheet icon now uses decoding=\"async\". Demo PNG-to-WebP conversion was explicitly declined as a low-value synthetic-demo build step, preserving the row's requested implementation-or-drop decision."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/3dda04ff-1ae9-4153-80ed-ad081931e396.json b/docs/outstanding-issues-inbox/applied/3dda04ff-1ae9-4153-80ed-ad081931e396.json
new file mode 100644
index 0000000000..14a45f2ac1
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/3dda04ff-1ae9-4153-80ed-ad081931e396.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "3dda04ff-1ae9-4153-80ed-ad081931e396",
+  "createdOn": "2026-08-14",
+  "action": "cancel",
+  "payload": {
+    "requestId": "9792c896-78d8-46ab-b194-6a52b7fd7cab",
+    "reason": "Superseded by the single combined #316 update queued in the same batch, which merges this request's dispatch proof and corrected drift figures with the incident-session findings from request bbf21714 so the row carries one coherent account instead of two partial ones."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/3f8797e0-dffa-4d26-8019-15147b9af397.json b/docs/outstanding-issues-inbox/applied/3f8797e0-dffa-4d26-8019-15147b9af397.json
new file mode 100644
index 0000000000..fa7ca93a2f
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/3f8797e0-dffa-4d26-8019-15147b9af397.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "3f8797e0-dffa-4d26-8019-15147b9af397",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#292",
+    "detail": "Recurred 2026-08-14 on the database remediation plan, this time with two assistants building Phase 0: PR #1938 and PR #1939 both implemented live-drift failure routing and the post-migration trigger, merged four hours apart. Both landed and no harm resulted — #1939 built on #1938's commit and improved it, moving the findings capture after the migration-history step so a migration-history failure is visible instead of a clean drift result being published as its explanation. The cost was still two full authoring sessions and two CI cycles for one deliverable. This matters more for the phases still ahead than it did here: Phase 1 consumes an approved read-only production window, and Phases 3 and 4 consume approved mutation windows and live eval-canary budget, so a duplicate there wastes an operator-gated resource rather than just tokens. Concrete ask for the remediation work specifically: check the open-PR list for the surface before starting any of Phases 1-5, per docs/database-remediation-playbook.md."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/413a0aec-0239-45b2-8880-d3ace65cfdaf.json b/docs/outstanding-issues-inbox/applied/413a0aec-0239-45b2-8880-d3ace65cfdaf.json
similarity index 100%
rename from docs/outstanding-issues-inbox/413a0aec-0239-45b2-8880-d3ace65cfdaf.json
rename to docs/outstanding-issues-inbox/applied/413a0aec-0239-45b2-8880-d3ace65cfdaf.json
diff --git a/docs/outstanding-issues-inbox/applied/42dd600a-b032-45a5-8c53-cb185f08cf13.json b/docs/outstanding-issues-inbox/applied/42dd600a-b032-45a5-8c53-cb185f08cf13.json
new file mode 100644
index 0000000000..0fe6d09f8b
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/42dd600a-b032-45a5-8c53-cb185f08cf13.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "42dd600a-b032-45a5-8c53-cb185f08cf13",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#309",
+    "detail": "Attempted 2026-08-14: an implementation task for chips-for-6-20 was stopped before any code was written, because it directly contradicts this row's own current, still-open text, which requires a full-width DENSE LIST (right-aligned count column, group headings) for the 6-20 band, and explicitly says chips-for-6-20 does not satisfy this row. Confirmed chips-for-6-20 is ALREADY the live behaviour (dense = facetGroups.length > 3 || totalFacetOptions > 20 in result-filter-control.tsx), and that closing this row on that basis was already tried once and explicitly reverted (PR #1925, 'correct #309 to partially delivered'). No code changed, no PR opened. Needs a product/design decision between: (1) build the genuine full-width dense-list renderer plus the nine-option DOM assertion this row asks for, or (2) formally amend docs/filter-contract.md section 5 to deliberately drop the middle band with reviewer sign-off -- different from what already happened (a silent merge-conflict resolution the row says didn't count).",
+    "source": "session 2026-08-14, agent stop per contract contradiction"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/4b6930e6-fae2-4b4f-9f90-49bf0bcd548c.json b/docs/outstanding-issues-inbox/applied/4b6930e6-fae2-4b4f-9f90-49bf0bcd548c.json
similarity index 100%
rename from docs/outstanding-issues-inbox/4b6930e6-fae2-4b4f-9f90-49bf0bcd548c.json
rename to docs/outstanding-issues-inbox/applied/4b6930e6-fae2-4b4f-9f90-49bf0bcd548c.json
diff --git a/docs/outstanding-issues-inbox/applied/4b85e2d3-963d-46fe-a9c3-b234b4de14b0.json b/docs/outstanding-issues-inbox/applied/4b85e2d3-963d-46fe-a9c3-b234b4de14b0.json
new file mode 100644
index 0000000000..015bfd8ae5
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/4b85e2d3-963d-46fe-a9c3-b234b4de14b0.json
@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "id": "4b85e2d3-963d-46fe-a9c3-b234b4de14b0",
+  "createdOn": "2026-08-14",
+  "action": "add",
+  "payload": {
+    "pri": "P3",
+    "type": "rec",
+    "summary": "npm run format in an uninstalled worktree runs a different Prettier than the lockfile pins and manufactures false drift",
+    "detail": "MEASURED 2026-08-14 in a Claude-on-web container during PR #1943, by running the commands rather than reasoning about them. The repo pins prettier ^3.9.6 in package.json with 3.9.6 in package-lock.json, but the container had no node_modules, so 'npm run format' (prettier --write .) resolved Prettier through npx and got 3.8.1. The older Prettier disagreed with files that are correctly formatted under the pinned version and REWROTE 31 files nobody had touched, including src/lib/rag/rag-cache.ts, src/lib/rag/rag-provider.ts, src/lib/openai.ts, src/lib/types.ts, tests/route-reachability.test.ts and several docs. Committing that output would have turned a docs-only PR into one classifyPullRequestFiles scores as ragRanking and clinicalRisk, pulling in a Clinical Governance Preflight and a RAG impact line for changes that were pure formatting noise, and would have collided with four sibling sessions working the same tree. Proof it was an artifact and not real drift: 'npx prettier@3.9.6 --check' on the same files returns 'All matched files use Prettier code style!' -- main is clean. This is the same failure class as archived row #087 (never act on a knip finding from a worktree that has not been installed) but strictly worse, because knip only reports while format WRITES, and the false result arrives already applied to the working tree. Next: make the version explicit rather than incidental -- either pin the binary in the format and format:changed scripts, or fail closed when the resolved Prettier version does not match the lockfile, so the command cannot silently run the wrong one. A pre-push guard already reconstructs an exact-lock environment for this reason (scripts/guard-push.mjs), so the precedent for refusing to trust an unpinned local Prettier exists. Stop: do not commit the output of npm run format from a worktree that has not been installed, and do not conclude formatting drift exists on main without re-checking under the pinned version.",
+    "source": "session 2026-08-14 PR #1943; package.json ^3.9.6; package-lock.json 3.9.6; npx prettier --version 3.8.1 vs npx prettier@3.9.6"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/4bc449a1-ec81-426d-aadd-8a78abec21cf.json b/docs/outstanding-issues-inbox/applied/4bc449a1-ec81-426d-aadd-8a78abec21cf.json
new file mode 100644
index 0000000000..eb5e1c0967
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/4bc449a1-ec81-426d-aadd-8a78abec21cf.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "4bc449a1-ec81-426d-aadd-8a78abec21cf",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#324",
+    "detail": "**Outcome:** the file-level merge-loss detector is delivered; one authoritative row now tracks its remaining operational decision. **Delivered:** PR #1944 added  (\n> prompt-for-codex-medical-knowledge-base@0.1.0 audit:merge-loss\n> node scripts/audit-merge-loss.mjs --self-test && node scripts/audit-merge-loss.mjs\n\n[merge-loss] scanned 362 pull request landing(s) on origin/main over the last 14 day(s); compared 3673 file(s).\n\n[merge-loss] 41 landing(s) look reverted — HUMAN CONFIRMATION REQUIRED.\nA deliberate later revert is identical to an accidental one at blob level, so this is a\nquestion, not a verdict. For each entry below, decide whether the change was meant to go.\n\n  PR #1815 — Merge pull request #1815 from BigSimmo/claude/spacing-icon-design-review-rxwh28\n    landed 2026-08-12T12:38:37+08:00 as 4587f7890818\n    50 of 141 changed file(s) match the pre-merge tree entry:\n      - src/app/mockups/answer-evidence-popups/page.tsx\n      - src/app/mockups/mode-dropdown/page.tsx\n      - src/components/DocumentViewer.tsx\n      - src/components/calculator-mockups/calculator-ui.tsx\n      - src/components/calculator-mockups/directory-grid-mockup.tsx\n      - src/components/calculator-mockups/guided-flow-mockup.tsx\n      - src/components/calculator-mockups/search-page-mockup.tsx\n      - src/components/calculators/calculator-ui.tsx\n      - src/components/calculators/directory-grid.tsx\n      - src/components/calculators/guided-flow.tsx\n      - src/components/clinical-dashboard/dashboard-nav.tsx\n      - src/components/clinical-dashboard/evidence-panels.tsx\n      - src/components/clinical-dashboard/favourites-command-library-page.tsx\n      - src/components/clinical-dashboard/favourites-hub.tsx\n      - src/components/clinical-dashboard/favourites-library-nav.tsx\n      - src/components/clinical-dashboard/signed-image.tsx\n      - src/components/document-phone-fused-directions-mockups.tsx\n      - src/components/document-phone-title-mockups.tsx\n      - src/components/document-phone-title-refined-mockups.tsx\n      - src/components/document-search-mockups.tsx\n      - src/components/document-top-navigation-mockups.tsx\n      - src/components/document-viewer/document-clinical-summary.tsx\n      - src/components/document-viewer/non-pdf-source-preview.tsx\n      - src/components/document-viewer/pdf-canvas-viewer.tsx\n      - src/components/document-viewer/section-nav.tsx\n      - src/components/dsm/dsm-comparison-page.tsx\n      - src/components/dsm/dsm-differential-considerations-page.tsx\n      - src/components/favourites-page-mockups/favourites-page-mockup-page.tsx\n      - src/components/formulation/formulation-builder-page.tsx\n      - src/components/master-document-flow-mockups.tsx\n      - src/components/patient-safety-plan.tsx\n      - src/components/phone-mode-sheet-yes-mockups.tsx\n      - src/components/privacy-live-signal-perfected-mockups.tsx\n      - src/components/registry-record-loader.tsx\n      - src/components/settings-search-mockups/settings-search-mockup-page.tsx\n      - src/components/source-overlay-redesign-mockups.tsx\n      - src/components/therapy-compass/controls.ts\n      - src/components/therapy-compass/screens/compare-screen.tsx\n      - src/components/therapy-compass/screens/detail-screen.tsx\n      - src/components/therapy-compass/screens/other-screen.tsx\n      - src/components/therapy-compass/screens/recommend-screen.tsx\n      - src/components/therapy-compass/screens/sheets-screen.tsx\n      - src/components/tools-page-mockups/rectangle-direction-mockups.tsx\n      - src/components/tools-page-mockups/split-pane-refined-mockups.tsx\n      - src/components/tools-page-mockups/task-directory-mockup.tsx\n      - src/components/tools-page-mockups/tools-page-mockup-page.tsx\n      - src/components/ui-primitives.tsx\n      - src/components/ui/button.tsx\n      - src/components/universal-search-redesign-mockups.tsx\n      - tests/tailwind-merge-config.test.ts\n    Inspect: git diff 4587f78908180ffb03a75b8ff5703b788e240d61^1 4587f78908180ffb03a75b8ff5703b788e240d61 -- <file>\n\n  PR #1920 — Merge pull request #1920 from BigSimmo/claude/ledger-sweep-inbox-requests\n    landed 2026-08-14T04:15:35+08:00 as 5d67c2ade600\n    47 of 49 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/05b0c32b-07f7-4ca2-9361-4d7bc5490661.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/09b3e12b-c171-49a6-b9d3-3ff627c8f2cd.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/0d8735c6-1950-4fef-8880-007063bbf662.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/0e47904b-f354-4795-a4fc-dcf8b91c1790.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/2a2200d7-83ea-4cff-9969-ae682bad740c.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/2a5aadb2-ab0e-4d89-8653-7a704933d533.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/439cd410-9311-4d22-8888-9fc15948fea0.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/52929edc-53b9-4694-a0e2-1bd3c4b0a41b.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/5a2b5bda-41b7-45e9-921b-d87df7ac6af0.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/5af9a8bf-6136-4347-bcae-8433c8c9e686.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/5bf830df-f89b-4789-a6dc-48284d212171.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/67352cea-8989-4e12-b50d-5a775664d8a7.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/6a90b0f5-e5e2-46a1-9981-d5886d0e41b8.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/721e629e-15df-4b77-a25c-c18200bdca3f.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/72929356-5ff3-47da-89a9-82de09602e73.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/75a2729c-b0b0-4144-8d99-2c3014d4bcf1.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/7f9de4f4-73ca-4ab2-946c-b2ee3c27d708.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/7fc8d67c-e2e4-4e6c-9bcf-6ac65fe9adc7.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/82377462-2da9-4f8e-b0f5-a421a1ab5fdd.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/8c2d3fea-e7a9-41af-a825-62c8109d0248.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/8ef1a871-8573-4eab-83fd-213734efd82c.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/9424f687-997a-4b52-ab31-b49e462168b6.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/9c89036c-733b-41ed-b1f7-92f3daa2940b.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/9dd78494-88b6-4d8e-b5c3-28caf91acaba.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/a101203a-ae13-46e0-9f76-6e91adf77c9a.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/a5c8654c-f466-49b5-86ec-f783c15fc6e7.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/a8a73f5a-f4c5-4c97-8c5d-bc93215469bc.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/abd14d84-e4d6-4f8c-8384-a97817aafcb7.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/b278a991-3122-4662-a835-37dd1d6645cc.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/bb14f53c-d36f-48ce-a02d-836aaa107008.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/bce5b6bd-4727-4ad5-ac5f-d05a24df43cc.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/bf12d7c9-04f8-4095-ba68-0cf6f5736501.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/bfc60ffa-e648-47e1-8270-bc1056516239.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/c1218846-c99f-4d49-a44c-a97d642926aa.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/c2c0104b-02e3-4ae3-8f8a-706c421ea4ce.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/cafca1f3-5985-4d5e-9a5e-47cb6d5ffafb.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/ce7dfda5-ea3b-4cb8-a992-aec759367f9d.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/d34ff313-231a-4e65-93d6-806f5b910846.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/da9b65c7-7245-4878-8b75-56c4cbe211cb.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/dcb1ba9e-18ea-4ae4-9594-8b7cbb6cbbcc.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/e2b81b96-5063-429c-866f-3d42549bd1c8.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/e7d125c0-98a4-45db-883e-b19937bd4550.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/f1673818-e4fe-4733-9db4-312b11d0279c.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/f6953f9c-671e-4bd3-82a5-d5825046cd95.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/f6e5fe24-02f4-4a49-beea-2f8bf20e0a0e.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/fa725f37-2d49-480e-83bc-23e8bca4c232.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/fc44a290-5b8f-4ee4-b233-516774792802.json (added by the PR, absent now)\n    Inspect: git diff 5d67c2ade60009deac175a6afce9aa0003389704^1 5d67c2ade60009deac175a6afce9aa0003389704 -- <file>\n\n  PR #1940 — docs(issues): retire the stale IN FLIGHT annotations, archive 9 verified rows (#1940)\n    landed 2026-08-14T11:18:50Z as 7a157f423089\n    14 of 15 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/1b483041-4f2e-4ccf-872e-f7657785cfb3.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/1e598935-a21b-4aa5-9bd2-c667ce16ebbd.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/2194da1d-c445-47db-8b97-09774056ab42.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/33d68dca-16b7-4325-8c50-f046c2f71316.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/413a0aec-0239-45b2-8880-d3ace65cfdaf.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/74edc91b-042b-4e73-911c-286d0b38da45.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/a860ce7a-5ecf-4f30-a3b9-5c22d1d914b9.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/b5f28517-89c9-455d-a4b4-202608141940.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/b7a5bee9-bddc-4a7a-9614-a49301c00cc8.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/ce304701-1e01-4cfb-bf9c-202608141940.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/d3b2fe49-3282-4756-9135-7c555dede447.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/d9a7e3fc-06e9-45ca-ab2a-202608141940.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/ded27e2f-5c71-43b8-99dc-ffffa6294ba3.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/f9f40594-a816-45a8-954a-3fcecf6d5d05.json (added by the PR, absent now)\n    Inspect: git diff 7a157f423089ae809a3a237221b4a2ec02225c5b^1 7a157f423089ae809a3a237221b4a2ec02225c5b -- <file>\n\n  PR #1942 — Re-land the --shadow-tight retirement and close three design-token debt rows (#1942)\n    landed 2026-08-14T19:57:21+08:00 as f89fbcc75e76\n    8 of 85 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/04a0b8d6-8af9-4779-8af8-8e3b6e9a3b2b.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/11e56221-8d46-4c9a-a89c-78621f18e754.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/25f6b53a-86e2-42e9-9b38-1c2daae28892.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/39b08439-bd16-4b6d-b218-f04ad0a9a8cd.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/69b9cd4a-9c2a-4e37-a146-48c7e540b87e.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/7268da45-5b77-4583-a3cb-27e5ec7067b1.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/dcb09280-0436-4651-a707-b0007e872d7b.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/fc23f1ec-c597-4690-b256-2263ecf73c86.json (added by the PR, absent now)\n    Inspect: git diff f89fbcc75e766dd08850c0e7effbd6520456abfa^1 f89fbcc75e766dd08850c0e7effbd6520456abfa -- <file>\n\n  PR #1915 — Reduce registry latency and align Sentry release identity (#1915)\n    landed 2026-08-13T13:16:12Z as ca788d41e1e6\n    7 of 39 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/155e96f9-c111-4d18-b4d8-5f83b3f79907.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/2ab54188-4652-42e2-a6b0-ff2f673d3d10.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/67f9ce93-caf5-4cd4-89e1-742e61ce882a.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/78fad74b-9478-4e58-9131-8a6bc5858c79.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/9a3ea3c5-31ed-4a89-a035-e6d364b906bf.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/a4bf50b9-95bf-458f-9a16-a80acf0830c0.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/e760edf4-fdf7-41c2-aa97-6f4563c6152f.json (added by the PR, absent now)\n    Inspect: git diff ca788d41e1e6b64dc6b9bc63609074d92470d7e7^1 ca788d41e1e6b64dc6b9bc63609074d92470d7e7 -- <file>\n\n  PR #1800 — Add conservative typo-tolerant fuzzy matching to catalogue searches (#1800)\n    landed 2026-08-10T23:44:57+08:00 as 022c83bd78a0\n    6 of 12 changed file(s) match the pre-merge tree entry:\n      - src/components/factsheets/factsheets-data.ts\n      - src/lib/specifiers.ts\n      - src/lib/therapies.ts\n      - tests/factsheets-data.test.ts\n      - tests/specifiers.test.ts\n      - tests/therapy-card-preview.test.ts\n    Inspect: git diff 022c83bd78a0bb72cc64f1e5dedc5eab21e6377f^1 022c83bd78a0bb72cc64f1e5dedc5eab21e6377f -- <file>\n\n  PR #1804 — Merge pull request #1804 from BigSimmo/codex/remove-also-matches-in-other-modes\n    landed 2026-08-10T23:59:30+08:00 as 914a5b9009f5\n    5 of 21 changed file(s) match the pre-merge tree entry:\n      - src/components/forms/forms-search-results-page.tsx\n      - tests/favourites-auth-gate.test.ts\n      - tests/favourites-empty-state.dom.test.tsx\n      - tests/mode-menu-prefetch.dom.test.tsx\n      - tests/style-contract-registry.test.ts\n    Inspect: git diff 914a5b9009f5c86b35699a3e53d366f20fd51e12^1 914a5b9009f5c86b35699a3e53d366f20fd51e12 -- <file>\n\n  PR #1930 — Queue five ledger corrections: the document-viewer rows say things that are no longer true (#1930)\n    landed 2026-08-13T21:22:50Z as a544719afd14\n    5 of 12 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/3f1a672f-9038-4a36-897f-5286e4fa028d.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/89ac3ee8-550a-44aa-b411-88687e5935e4.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/9ae893ef-7073-4dfa-8602-899d53b177b7.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/9db75fae-07e6-454d-b2c4-eb88b0e8ff06.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/c15dfcea-2b4e-4c25-983e-c699ef7d1a52.json (added by the PR, absent now)\n    Inspect: git diff a544719afd14ccaf1ed4241e7a66ec20f4f96c2c^1 a544719afd14ccaf1ed4241e7a66ec20f4f96c2c -- <file>\n\n  PR #1934 — Merge pull request #1934 from BigSimmo/claude/ledger-tasks-fable-xhl7xb\n    landed 2026-08-14T05:50:19+08:00 as 606176ccf6a0\n    5 of 6 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/210e3db5-f863-4dc8-8d6e-4d75d044e661.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/31650c87-cfea-4a98-88e1-bd41b44c12b2.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/829597d4-698b-4cc2-9bf4-65310504cba3.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/8621298b-db72-4960-818a-66ae49a3977f.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/f23c14ec-e386-4910-ba60-fd488cc0a83b.json (added by the PR, absent now)\n    Inspect: git diff 606176ccf6a0629735f8345dff6df1edf939b0ac^1 606176ccf6a0629735f8345dff6df1edf939b0ac -- <file>\n\n  PR #1944 — Five ledger process and tooling fixes: dirty-tree gate, merge-loss detector, three plans (#1944)\n    landed 2026-08-14T14:08:19Z as 372cb13fb2f5\n    5 of 20 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/71d61764-9d93-43bd-a3d3-230f5ad78418.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/83ec71cf-db94-4110-ada8-ec7e730e5154.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/a780ce8a-a373-4c95-974f-0692af775ff6.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/d229e6b5-a31a-44a9-8a7b-536e7f8ccf50.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/e684a311-2a0d-4c21-ba18-13afde3b62f8.json (added by the PR, absent now)\n    Inspect: git diff 372cb13fb2f530eab259e72cdff41e6aa31dabbb^1 372cb13fb2f530eab259e72cdff41e6aa31dabbb -- <file>\n\n  PR #1960 — Merge pull request #1960 from BigSimmo/claude/live-drift-forensics-lnhvja\n    landed 2026-08-14T23:17:32+08:00 as 7679dfa25339\n    5 of 8 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/19fb70c0-1fd4-43a8-a4f4-efa9c31d16b1.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/606b1573-6217-457a-9183-7f8e550d3094.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/81845ded-27a8-43d8-9a56-d85a5515935b.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/bbf21714-0ef9-4c2f-942f-1b8d7e328ac8.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/d52dbc3d-6759-4f6e-9089-24059830ed5a.json (added by the PR, absent now)\n    Inspect: git diff 7679dfa25339256cb8e04d32ab666d1eb95396d1^1 7679dfa25339256cb8e04d32ab666d1eb95396d1 -- <file>\n\n  PR #1886 — fix(therapies): stop the catalogue generator consuming its own output (#180) and serve aliases by rewrite (#177) (#1886)\n    landed 2026-08-13T07:17:48Z as b189fb57d326\n    4 of 14 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/02278dd9-cc4d-4114-8d5e-84414910b886.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/3f38592b-8346-48dc-87d9-acc585ffe5b8.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/7336de95-160e-4255-b2c0-abcfd7f4e093.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/976c4c7a-5c74-47e3-975b-046718c54859.json (added by the PR, absent now)\n    Inspect: git diff b189fb57d326d7a05770c0e4be8b0a4b1abfadf6^1 b189fb57d326d7a05770c0e4be8b0a4b1abfadf6 -- <file>\n\n  PR #1933 — Record deployed latency evidence and remaining bottleneck (#1933)\n    landed 2026-08-13T21:43:37Z as 804e931a063d\n    4 of 5 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/821d7e63-4bf3-4af7-abfb-071f916b847c.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/a51fd616-bb58-4a1b-9009-21686eea2a84.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/e7fe0e34-3ff3-48d0-878c-2d7a7fe792f1.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/ee6875e6-62ad-4f2e-8644-6f3b7a973d87.json (added by the PR, absent now)\n    Inspect: git diff 804e931a063d7720de61849e6daeea78916d5cfb^1 804e931a063d7720de61849e6daeea78916d5cfb -- <file>\n\n  PR #1957 — Merge pull request #1957 from BigSimmo/claude/correct-rejected-closures\n    landed 2026-08-14T23:01:02+08:00 as b58a2359eede\n    4 of 5 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/38c6095f-41f5-4925-b1ea-f5af5187885d.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/7f5e6922-8d0b-424a-b359-12bed3a4e315.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/bd11cfe9-1627-425f-a8f7-e0e202b980a4.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/ec6d0c23-2f19-4159-9c73-49bdc103b61e.json (added by the PR, absent now)\n    Inspect: git diff b58a2359eede6fc5a76237337fbe1b04c7964d26^1 b58a2359eede6fc5a76237337fbe1b04c7964d26 -- <file>\n\n  PR #1923 — fix(medications): reach lithium, retire the dead z-drugs term, make lexicon review flags evidence-bearing (#1923)\n    landed 2026-08-13T20:45:21Z as eac9c4d51fdd\n    3 of 18 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/1bfaf0ef-e169-4a0c-8ad0-ca391f5f6024.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/4b95979b-65e8-474d-bc53-6f69e7eb5acf.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/5c830d16-5076-4435-9903-6f3e7a71daa4.json (added by the PR, absent now)\n    Inspect: git diff eac9c4d51fddf258b93ec5affe066427f66345d8^1 eac9c4d51fddf258b93ec5affe066427f66345d8 -- <file>\n\n  PR #1925 — chore(issues): close #170, and correct #309 to partially delivered (#1925)\n    landed 2026-08-14T00:20:50+08:00 as 63526ee5305e\n    3 of 4 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/4944d2d8-69b6-479c-b0bd-a977494a74fb.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/4bb5ba0d-ca46-454e-97f4-5a49f5c87f22.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/e48b440b-d5a0-436b-bea8-ca7670d1a6bb.json (added by the PR, absent now)\n    Inspect: git diff 63526ee5305ec0ff6c6ed2c2ccdf347310cb7c03^1 63526ee5305ec0ff6c6ed2c2ccdf347310cb7c03 -- <file>\n\n  PR #1928 — docs(issues): queue a capture for the four placeholders #291 deliberately left native (#1928)\n    landed 2026-08-13T21:10:03Z as 3086cf1cc535\n    3 of 5 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/1752caad-7fac-4089-a415-d20a26e5984a.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/38e25384-5dcb-463d-b1b7-e0caea60bb83.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/47ba09d2-64f6-47ab-8ad6-380fc3f93eee.json (added by the PR, absent now)\n    Inspect: git diff 3086cf1cc535a23b0f338694477b63db4a953e09^1 3086cf1cc535a23b0f338694477b63db4a953e09 -- <file>\n\n  PR #1941 — fix(errors): disposition the last 3 empty catch handlers and guard the rule (#1941)\n    landed 2026-08-14T11:41:08Z as 3d5cd7cb8b0d\n    3 of 8 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/b7c0f9f6-c95d-413f-9bdd-6b6ad9cbcb91.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/e4a11465-348c-49e5-8a0a-202608141941.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/f825f6b9-94ec-4af1-929c-202608141941.json (added by the PR, absent now)\n    Inspect: git diff 3d5cd7cb8b0d22fc95d3e04a495cfae8533bda17^1 3d5cd7cb8b0d22fc95d3e04a495cfae8533bda17 -- <file>\n\n  PR #1548 — Therapy Compass: stop faking multi-select with a listbox on phones (#1548)\n    landed 2026-08-01T01:35:44Z as 40814b447080\n    2 of 8 changed file(s) match the pre-merge tree entry:\n      - src/components/therapy-compass/filter-sheet.tsx (added by the PR, absent now)\n      - tests/therapy-filter-sheet.dom.test.tsx (added by the PR, absent now)\n    Inspect: git diff 40814b447080219d861dd999fee0c8bc4cac3cc2^1 40814b447080219d861dd999fee0c8bc4cac3cc2 -- <file>\n\n  PR #1807 — Merge pull request #1807 from BigSimmo/claude/codex-m4c-retire-shadow-nliak3\n    landed 2026-08-11T18:24:08+08:00 as 381d2c214c8a\n    2 of 10 changed file(s) match the pre-merge tree entry:\n      - docs/design-system/HANDOVER-2026-08-07.md\n      - docs/design-system/SPEC.md\n    Inspect: git diff 381d2c214c8a49b7970474ad9e9f1042dc020c75^1 381d2c214c8a49b7970474ad9e9f1042dc020c75 -- <file>\n\n  PR #1906 — Merge pull request #1906 from BigSimmo/claude/fable-tasks-issues-49hnvp\n    landed 2026-08-13T18:47:53+08:00 as 4bbc4c5ca2f2\n    2 of 6 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/a3dca734-d253-4c42-8edc-dc690dd140dc.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/dec50a21-f143-485d-a6b1-f9c3621013a6.json (added by the PR, absent now)\n    Inspect: git diff 4bbc4c5ca2f27cf8b3e571d8ebce1e18937296b6^1 4bbc4c5ca2f27cf8b3e571d8ebce1e18937296b6 -- <file>\n\n  PR #1909 — Merge pull request #1909 from BigSimmo/claude/rag-incremental-delivery-lpw15e\n    landed 2026-08-14T02:25:18+08:00 as d9306e800b7a\n    2 of 13 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/75df9b82-7ecc-4aa2-bdac-653da976fe53.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/e1506952-64c6-472f-9da4-812f8d69b483.json (added by the PR, absent now)\n    Inspect: git diff d9306e800b7ab276c81d0b41a2b4527cb0da1948^1 d9306e800b7ab276c81d0b41a2b4527cb0da1948 -- <file>\n\n  PR #1927 — Reduce render-blocking CSS without delaying LCP fonts (#1927)\n    landed 2026-08-14T00:06:15+08:00 as f2abf5baf3f4\n    2 of 10 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/66f364c0-5612-449b-9046-94b4dab0b152.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/f4b9c833-03f4-40bd-9537-90501c1287c4.json (added by the PR, absent now)\n    Inspect: git diff f2abf5baf3f449a1803bedef9dc107f30b70db93^1 f2abf5baf3f449a1803bedef9dc107f30b70db93 -- <file>\n\n  PR #1929 — Merge pull request #1929 from BigSimmo/claude/design-issues-triage-wnr7k9\n    landed 2026-08-14T05:17:30+08:00 as 1e7efdb0f244\n    2 of 3 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/04470779-8c8d-4c90-ad04-bc6d613fd73a.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/9fded706-51d9-4d8f-9aa4-c57a6b0ac7aa.json (added by the PR, absent now)\n    Inspect: git diff 1e7efdb0f2441f370564cbdbdb50de94c405026b^1 1e7efdb0f2441f370564cbdbdb50de94c405026b -- <file>\n\n  PR #1932 — Close the resolved ranking snapshot refresh task accurately (#1932)\n    landed 2026-08-13T21:33:49Z as 1ca47782aa3a\n    2 of 4 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/43a11115-c75f-4402-a83c-7a309b3a76c4.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/b78e551e-280b-4b9c-bdc5-37a79daeb4cf.json (added by the PR, absent now)\n    Inspect: git diff 1ca47782aa3ae8504134a5798a6b86716cdebac2^1 1ca47782aa3ae8504134a5798a6b86716cdebac2 -- <file>\n\n  PR #1937 — Record a queued ledger request that was lost between a branch and its squash (#1937)\n    landed 2026-08-14T11:06:10Z as 87fa45292273\n    2 of 3 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/4b6930e6-fae2-4b4f-9f90-49bf0bcd548c.json (added by the PR, absent now)\n      - docs/outstanding-issues-inbox/63419f06-c12a-4a84-a684-6e177f527365.json (added by the PR, absent now)\n    Inspect: git diff 87fa4529227393733a2aa9ce9d95598070535714^1 87fa4529227393733a2aa9ce9d95598070535714 -- <file>\n\n  PR #1555 — Search results bar: delete the inert scope system, rebuild the filter shelf, and land the bar anatomy (#1555)\n    landed 2026-08-01T10:25:30+08:00 as b1e01173eae2\n    1 of 20 changed file(s) match the pre-merge tree entry:\n      - docs/handoff-search-bar.md (added by the PR, absent now)\n    Inspect: git diff b1e01173eae2ac1f68c7a98e72dd569fe79cd305^1 b1e01173eae2ac1f68c7a98e72dd569fe79cd305 -- <file>\n\n  PR #1661 — Add first-page PDF cover thumbnails on document search cards (#1661)\n    landed 2026-08-07T03:32:04Z as 096ba3138fe4\n    1 of 20 changed file(s) match the pre-merge tree entry:\n      - scripts/backfill-document-covers.mjs (added by the PR, absent now)\n    Inspect: git diff 096ba3138fe4dda182d98cc2f9c4e0fe9a09132b^1 096ba3138fe4dda182d98cc2f9c4e0fe9a09132b -- <file>\n\n  PR #1665 — refactor(viewer): extract DocumentViewer shell modules (Phase 1) (#1665)\n    landed 2026-08-07T01:34:42Z as bd46a39ac02e\n    1 of 9 changed file(s) match the pre-merge tree entry:\n      - src/components/document-viewer/use-pdf-viewer-preference.ts (added by the PR, absent now)\n    Inspect: git diff bd46a39ac02e604eb45178b5ed38d39f06cc6830^1 bd46a39ac02e604eb45178b5ed38d39f06cc6830 -- <file>\n\n  PR #1759 — Add Differentials Presentations catalogue tab (#1759)\n    landed 2026-08-08T20:38:06Z as 00cf695806c8\n    1 of 23 changed file(s) match the pre-merge tree entry:\n      - src/app/(search-app)/differentials/compare/route.ts (added by the PR, absent now)\n    Inspect: git diff 00cf695806c8f23250b527e8666caafce03549d0^1 00cf695806c8f23250b527e8666caafce03549d0 -- <file>\n\n  PR #1796 — Merge pull request #1796 from BigSimmo/dependabot/docker/docker-images-263a700181\n    landed 2026-08-10T23:31:32+08:00 as 9a3ca935abe4\n    1 of 3 changed file(s) match the pre-merge tree entry:\n      - worker/validate-runtime.ts\n    Inspect: git diff 9a3ca935abe40743a8ae69222a8c6a80485869da^1 9a3ca935abe40743a8ae69222a8c6a80485869da -- <file>\n\n  PR #1803 — Retire the --shadow-tight role alias onto the --e1 elevation tier (#1803)\n    landed 2026-08-10T14:27:54Z as 9d8370abf287\n    1 of 82 changed file(s) match the pre-merge tree entry:\n      - docs/design-system/TOKENS.md\n    Inspect: git diff 9d8370abf287f7e4e20cececd9c3ccdb01b0d78d^1 9d8370abf287f7e4e20cececd9c3ccdb01b0d78d -- <file>\n\n  PR #1811 — Merge pull request #1811 from BigSimmo/codex/update-search-page-routing-to-new-version\n    landed 2026-08-11T16:12:52+08:00 as cb23f868c51b\n    1 of 3 changed file(s) match the pre-merge tree entry:\n      - tests/mode-secondary-navigation.test.ts\n    Inspect: git diff cb23f868c51b289dbfb6fd3944c63e5da3a194c5^1 cb23f868c51b289dbfb6fd3944c63e5da3a194c5 -- <file>\n\n  PR #1873 — Merge pull request #1873 from BigSimmo/codex/ledger-conflict-guards-publish\n    landed 2026-08-13T09:07:02+08:00 as 72bf435840ce\n    1 of 26 changed file(s) match the pre-merge tree entry:\n      - .github/workflows/pr1873-merge-main-v2.yml (added by the PR, absent now)\n    Inspect: git diff 72bf435840ce22911001088c02b383c638b110dc^1 72bf435840ce22911001088c02b383c638b110dc -- <file>\n\n  PR #1893 — Merge pull request #1893 from BigSimmo/codex/keep-pr-auto-merge\n    landed 2026-08-13T06:11:48+08:00 as 18cb6889cb36\n    1 of 1 changed file(s) match the pre-merge tree entry:\n      - .github/workflows/keep-pr-auto-merge.yml (added by the PR, absent now)\n    Inspect: git diff 18cb6889cb36acae352fd526962f9ff86cfe33ef^1 18cb6889cb36acae352fd526962f9ff86cfe33ef -- <file>\n\n  PR #1900 — docs(issues): capture the #290 recurrence playbook — window unconfirmed, reporter-stranding mechanism first (#1900)\n    landed 2026-08-13T04:07:28Z as a5f03ccc3390\n    1 of 1 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/bbf8ba3d-cdfb-49ef-80f2-09964ac8483d.json (added by the PR, absent now)\n    Inspect: git diff a5f03ccc3390803a2b9de1d91701cf3a9d0455a8^1 a5f03ccc3390803a2b9de1d91701cf3a9d0455a8 -- <file>\n\n  PR #1921 — docs(issues): close out PR E (therapy-compass) — already merged, close the rollout tracking row (#1921)\n    landed 2026-08-13T20:21:57Z as db274b88e889\n    1 of 2 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/02879c2f-f7c7-4698-bc2e-cd5555cc2f37.json (added by the PR, absent now)\n    Inspect: git diff db274b88e889b902921c46e7646eb6de50e419bb^1 db274b88e889b902921c46e7646eb6de50e419bb -- <file>\n\n  PR #1924 — docs(issues): re-file the #210 correction lost in the inbox migration (#1924)\n    landed 2026-08-13T20:49:54Z as cf07f4e3d4d0\n    1 of 2 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/24586190-0756-488d-941e-70a970c13cce.json (added by the PR, absent now)\n    Inspect: git diff cf07f4e3d4d023934a4e28ba9e41526ce166b1a6^1 cf07f4e3d4d023934a4e28ba9e41526ce166b1a6 -- <file>\n\n  PR #1938 — ci(drift): route live-drift failures to a pinned issue and trigger on migrations (#1938)\n    landed 2026-08-14T11:10:15Z as 79b01b3f4a9a\n    1 of 3 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/17e1baf4-7d8f-4494-acd6-a845ade305ca.json (added by the PR, absent now)\n    Inspect: git diff 79b01b3f4a9a7d78ca7db330fc122a46d52763a9^1 79b01b3f4a9a7d78ca7db330fc122a46d52763a9 -- <file>\n\n  PR #1943 — docs(issues): close #310 — the fuzzy catalogue cap already landed on main (#1943)\n    landed 2026-08-14T20:03:29+08:00 as 408747a0439e\n    1 of 1 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/00428ff0-1b45-4066-9838-94216fa8b6eb.json (added by the PR, absent now)\n    Inspect: git diff 408747a0439e24a09d0df6fc94d9233ed0a95caf^1 408747a0439e24a09d0df6fc94d9233ed0a95caf -- <file>\n\n  PR #1945 — Merge pull request #1945 from BigSimmo/claude/ledger-review-triage-yi63ao\n    landed 2026-08-14T20:55:27+08:00 as f368f8d7e796\n    1 of 2 changed file(s) match the pre-merge tree entry:\n      - docs/outstanding-issues-inbox/01580a63-502e-4ee9-bdf2-a5bf492f7dee.json (added by the PR, absent now)\n    Inspect: git diff f368f8d7e796429d3d6f7a45fa0c39664cfb33af^1 f368f8d7e796429d3d6f7a45fa0c39664cfb33af -- <file>\n\nConfirmed losses are re-landed as their own pull request; record the decision with npm run issues:add.) and focused tests. It compares every changed file in a bounded main-history window with the landing commit's first parent, then reports possible reverts for human review. The implementation independently rediscovered the acf78bf casualties, including the #1803 token-retirement loss, and deliberately remains advisory because blob equality cannot distinguish a deliberate revert from an accidental merge-resolution loss. **Remaining:** decide whether it runs after merges or on a schedule, who triages positive findings, and whether the separate branch-versus-squash inbox-request-loss case should be a second detector or a mode of the same tool. A scheduled or required check without a named human disposition path would become ignorable noise. **Stop:** do not reimplement the delivered script, and do not make either detector blocking or auto-close findings until that ownership decision exists.",
+    "source": "session 2026-08-13 blob sweep; PR #1944 audit implementation and tests; PR #1937 inbox-loss case; consolidated by PR #1956 review follow-up"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/568597bd-fc9f-47d6-b582-443812115e67.json b/docs/outstanding-issues-inbox/applied/568597bd-fc9f-47d6-b582-443812115e67.json
new file mode 100644
index 0000000000..add66a2d5a
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/568597bd-fc9f-47d6-b582-443812115e67.json
@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "id": "568597bd-fc9f-47d6-b582-443812115e67",
+  "createdOn": "2026-08-15",
+  "action": "add",
+  "payload": {
+    "pri": "P3",
+    "type": "rec",
+    "summary": "The mode-page comps and the results-band weighting contract disagree about query vs count emphasis",
+    "detail": "Found while shipping #163 (PR #1982). The perfected-combined comps draw the search query large and bold with the match count small and muted beside it, on both /tools and /services. Production does the reverse: SearchResultsHeaderBand renders the count first at font-weight 600 with the query at 450 and muted, and that is not an accident — docs/search-chrome-behaviour.md 'Results band' rules 1 and 2 argue for it explicitly (the query is the sole heading and the count is never one; nothing in the band is bold; the two weights are deliberately near-adjacent steps of one scale separated by tabular numerals and a hairline rather than by shouting). The band is shared by twelve modes and is a visual-baseline target captured from /services?q=CMHT&run=1 (tests/ui-visual-baseline.spec.ts), so changing it is a repo-wide change with a baseline refresh, not a per-mode tweak. #163 was closed without touching it because the outcome that row asked for — query-as-H1 rather than a match-count heading — is already true either way. Next: decide deliberately which artefact is authoritative. If the comps win, the change is a shared-band edit plus a rewrite of Results band rules 1-2 plus refreshed search-results-band and search-results-band-phone baselines, and it should be one PR covering all twelve modes. If the contract wins, the comps should carry a note so the next implementer does not re-open this. Stop: do not add a per-mode variant prop to make services alone read query-dominant — that makes shared chrome mode-conditional to settle a question that has one answer.",
+    "source": "session 2026-08-15; PR #1982; docs/search-chrome-behaviour.md Results band rules 1-2"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/5cf082dd-60c3-42ef-95dc-82b9c255e9be.json b/docs/outstanding-issues-inbox/applied/5cf082dd-60c3-42ef-95dc-82b9c255e9be.json
new file mode 100644
index 0000000000..2fceedae3f
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/5cf082dd-60c3-42ef-95dc-82b9c255e9be.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "5cf082dd-60c3-42ef-95dc-82b9c255e9be",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#210",
+    "detail": "CORRECTION 2026-08-14: an earlier queued request for this row claimed `done`, citing PR #1953. That was premature -- PR #1953 is still open, not merged; scripts/run-playwright.mjs on main does not yet carry the fix. Do not close this row until PR #1953 actually merges and the fix is confirmed present on main. What PR #1953 contains, once it lands: an explicit include/exclude added to the generated isolated child tsconfig, plus a glob-consolidation correction pushed to the same branch after a Codex review finding was investigated and found NOT to hold against real Next.js build behaviour (verified via the actual runTypeCheck -> parseJsonConfigFileContent -> createProgram call chain, not the tsc --showConfig CLI-display path the reviewer's probe used). Empirically confirmed via planted-file probes in that session: stale repo-root .next/dev/types no longer leak into the isolated build, and the run's own generated route types remain present in the real TypeScript program. Items 1 and 2 of this row were already closed/refuted before that PR; it addresses item 3, the last open part -- but only once merged.",
+    "source": "session 2026-08-14 ledger correction; PR #1953 (open, not yet merged as of this correction)"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/5cf244c3-1b68-4214-8097-767b11a49e13.json b/docs/outstanding-issues-inbox/applied/5cf244c3-1b68-4214-8097-767b11a49e13.json
new file mode 100644
index 0000000000..1f1ddc4661
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/5cf244c3-1b68-4214-8097-767b11a49e13.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "5cf244c3-1b68-4214-8097-767b11a49e13",
+  "createdOn": "2026-08-15",
+  "action": "done",
+  "payload": {
+    "id": "#164",
+    "outcome": "CLOSED 2026-08-15 by PR #1983. /favourites is one dashboard+search workspace; no ModeHome was reintroduced and no separate Favourites home route exists. DELIVERED: the 'Favourites command library' marketing H1, its heart icon tile and its explanatory subtitle are retired for a plain Favourites heading with the item count beside it as non-heading text; the desktop FavouritesSidebar plus the phone FavouritesMobileQuickViews and FavouritesMobileBrowseRail collapse into one chip rail carrying sets, Pinned/Source-backed and types with counts, after which favourites-library-nav.tsx had no callers and was deleted (529 lines, and it paid down one gate-8 edge conflict as a side effect: 25 to 24); the empty query shows Continue then Recent and Your sets side by side, a typed query demotes that band to a collapsed disclosure and filters the table in place with an 'N matches for ...' header; and the redundant filter computation is gone — filteredItems and the table's own tableRows were derived independently from identical inputs, so the band count and the table count were two answers to one question, and the page now derives rows once and passes them down. IN-PLACE FILTERING IS REAL, not just same-surface: the page reads the shared composer's live draft via useSearchCommand seeded from the route's submitted ?q=, the same pattern tools-search-results-page already uses, so typing filters without navigating and without a second input and the one-composer contract is untouched. NOT DONE, deliberately and worth knowing: Continue and Recent still render from the existing derivation, where lastUsedByItemId and pinnedItemIds are hard-coded five-entry literals for demo slugs and real registry items fall back to the literal string 'Saved'. Direction B leads with both surfaces, so they want a genuine per-item last-opened timestamp; that is a data-layer change and building it here would have silently rescoped this row. Captured as its own row. Verification: verify:pr-local all ten selected gates passed, unit suite 607 files / 6584 passed; UI proof delegated to CI Production UI (chromium-1194 vs pinned 1234, #255/#312)."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/5db479fa-07fc-4e9e-a377-93b4e27797ee.json b/docs/outstanding-issues-inbox/applied/5db479fa-07fc-4e9e-a377-93b4e27797ee.json
new file mode 100644
index 0000000000..5dc89e4fb9
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/5db479fa-07fc-4e9e-a377-93b4e27797ee.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "5db479fa-07fc-4e9e-a377-93b4e27797ee",
+  "createdOn": "2026-08-14",
+  "action": "cancel",
+  "payload": {
+    "requestId": "21b6525a-dd2d-4dcc-95d5-c3c777420adf",
+    "reason": "Superseded by f3b63187-c295-4f6a-8ecd-602f348835c4, which closes duplicate #333 and preserves its evidence on #331."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/606b1573-6217-457a-9183-7f8e550d3094.json b/docs/outstanding-issues-inbox/applied/606b1573-6217-457a-9183-7f8e550d3094.json
new file mode 100644
index 0000000000..1115a1f5da
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/606b1573-6217-457a-9183-7f8e550d3094.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "606b1573-6217-457a-9183-7f8e550d3094",
+  "createdOn": "2026-08-14",
+  "action": "cancel",
+  "payload": {
+    "requestId": "7f5e6922-8d0b-424a-b359-12bed3a4e315",
+    "reason": "superseded: merged verbatim into the combined #231 update queued in this same PR alongside the 2026-08-14 incident rung-2 evidence"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/60fea622-a448-4e8f-a5d3-0122ab08b2d0.json b/docs/outstanding-issues-inbox/applied/60fea622-a448-4e8f-a5d3-0122ab08b2d0.json
new file mode 100644
index 0000000000..5238072cb4
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/60fea622-a448-4e8f-a5d3-0122ab08b2d0.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "60fea622-a448-4e8f-a5d3-0122ab08b2d0",
+  "createdOn": "2026-08-15",
+  "action": "update",
+  "payload": {
+    "id": "#316",
+    "summary": "Live DB has 20 currently missing repo-defined indexes and 10 retrieval RPC bodies diverge; weekly live-drift has been red since 2026-07-26 with no routing",
+    "source": "PR #1968 review against docs/audit/live-drift-forensics-2026-08.md, 2026-08-15"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/63419f06-c12a-4a84-a684-6e177f527365.json b/docs/outstanding-issues-inbox/applied/63419f06-c12a-4a84-a684-6e177f527365.json
similarity index 100%
rename from docs/outstanding-issues-inbox/63419f06-c12a-4a84-a684-6e177f527365.json
rename to docs/outstanding-issues-inbox/applied/63419f06-c12a-4a84-a684-6e177f527365.json
diff --git a/docs/outstanding-issues-inbox/69b9cd4a-9c2a-4e37-a146-48c7e540b87e.json b/docs/outstanding-issues-inbox/applied/69b9cd4a-9c2a-4e37-a146-48c7e540b87e.json
similarity index 100%
rename from docs/outstanding-issues-inbox/69b9cd4a-9c2a-4e37-a146-48c7e540b87e.json
rename to docs/outstanding-issues-inbox/applied/69b9cd4a-9c2a-4e37-a146-48c7e540b87e.json
diff --git a/docs/outstanding-issues-inbox/applied/6b09c1df-5f7c-4103-af3c-aead33eafb00.json b/docs/outstanding-issues-inbox/applied/6b09c1df-5f7c-4103-af3c-aead33eafb00.json
new file mode 100644
index 0000000000..82fe278626
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/6b09c1df-5f7c-4103-af3c-aead33eafb00.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "6b09c1df-5f7c-4103-af3c-aead33eafb00",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#316",
+    "detail": "MISSING"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/6e354901-7694-40e0-b03d-8c398cec7b05.json b/docs/outstanding-issues-inbox/applied/6e354901-7694-40e0-b03d-8c398cec7b05.json
new file mode 100644
index 0000000000..b9f1b5a8b7
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/6e354901-7694-40e0-b03d-8c398cec7b05.json
@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "id": "6e354901-7694-40e0-b03d-8c398cec7b05",
+  "createdOn": "2026-08-15",
+  "action": "add",
+  "payload": {
+    "pri": "P2",
+    "type": "task",
+    "summary": "Route the remaining ~22 unguarded source-slice test windows through the guarded helper",
+    "detail": "PARTIALLY DONE 2026-08-15 by PR #1985, which added tests/helpers/source-contract.ts and migrated the three worst files. The hazard this closes is a silent pass, not fragility: the idiom source.slice(source.indexOf(start), source.indexOf(end)) returns -1 for a missing end marker, and slice(n, -1) does not throw — it returns the rest of the file bar one character. A renamed end marker therefore converts a scoped assertion into a whole-file assertion and every positive toContain in it keeps passing for the wrong reason. The mirror case, a missing start, yields slice(-1, n) so every negative assertion passes vacuously. Neither shows up as a failure. The helper throws on a missing start, a missing end, and an AMBIGUOUS start (a window anchored on a string that appears twice silently covers only the first hit). MIGRATED: search-route-ownership.test.ts (three windows, including one whose end marker is an indentation depth and one anchored on a comment string), document-detail-performance.test.ts (end marker was the next literal 'useEffect' token, of which DocumentViewer has several), therapy-compass-responsive-contract.test.ts. REMAINING, roughly 22 windows across ~11 files, none migrated: audit-navigation-auth-regressions.test.ts is the densest and was deliberately skipped because PR #1983 edits the same file and the anti-churn rule prefers one late sync to a merge fight — do it once #1983 lands. Also tools-search-directions-mockups.test.ts, in-page-nav-playwright-contract.test.ts and document-section-nav-contract.test.ts (the last two slice ui-smoke.spec.ts between Playwright test titles, so renaming OR reordering an unrelated spec silently rescopes them), and rag-retrieval-parallelism.test.ts, which is left for a session that flags the RAG surface first per AGENTS.md. A REAL COVERAGE HOLE was found while surveying and is NOT yet fixed: audit-navigation-auth-regressions.test.ts around line 285 anchors on '{showUniversalAlsoMatches &&', which occurs TWICE in ClinicalDashboard.tsx (the second around line 3832 sits outside the window), so its not.toContain check does not enforce the named contract across the file. The new helper would reject that anchor outright, which is how it was found. Fix it in the same pass as that file's migration. STOP: do not loosen the demo-data boundary pins in favourites-demo-boundary.test.ts. The exact conditional-spread form '...(demoMode ? prototypeFavouriteItems : [])' with its paired negative is the live-vs-demo privacy contract, and its strictness is the point. Likewise leave the SQL windows ending on '$$;' and header-scroll-hide-contract.test.ts anchoring on the matching '</PhoneHeaderCollapsePortal>' closing tag — those are true structural terminators and are the model the rest should move toward.",
+    "source": "session 2026-08-15; PR #1985; tests/helpers/source-contract.ts"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/71d61764-9d93-43bd-a3d3-230f5ad78418.json b/docs/outstanding-issues-inbox/applied/71d61764-9d93-43bd-a3d3-230f5ad78418.json
new file mode 100644
index 0000000000..5d6e6b12b9
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/71d61764-9d93-43bd-a3d3-230f5ad78418.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "71d61764-9d93-43bd-a3d3-230f5ad78418",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#258",
+    "detail": "GAP RECORDED 2026-08-14 in PR #1944 — docs/pr-handoff-stop-cross-agent-gap.md. This is the row's own stated fallback (\"If no mechanism exists at all, record that explicitly here so the gap is a known limit rather than an open task\"), so the row stays open but is no longer unexamined. Checked, not assumed: .claude/settings.json is read only by Claude Code; plugins/clinical-kb/.codex-plugin/plugin.json declares name/version/description/author/repository/keywords/skills and an interface block with NO hook, event, or pre-tool-interception field, shipping exactly one skill; .cursor/ holds settings.json (plugin enablement only), mcp.json, agents/ and skills/ with no deny path. So the cheapest-first option the row proposed is currently unavailable in both tools. Worth noting because it sharpens the cost: .cursor/agents/pr-babysit.md exists, meaning Cursor ships a documented agent for exactly the PR-following behaviour this rule restricts, with nothing bounding it. The doc records the Claude Code mechanism in enough detail to reimplement (session-scoped marker under the absolute git dir, fail-open on an unidentifiable session id, never pruning a sibling's marker, post-mode scanning only the request half so a command that merely prints a PR URL cannot arm it, and the CLAUDE_ALLOW_PR_FOLLOW=1 prefix unlock that a mention alone cannot trigger), plus the three questions any parity mechanism must answer. It is explicit that the wrapper fallback is advisory only — it cannot touch the MCP-connector or loop-machinery classes, so it makes a violation detectable after the fact rather than prevented. Next: re-check the Codex and Cursor manifests when either ships hook support; close only when a mechanism exists or the limit is accepted deliberately. Stop unchanged: do not weaken the Claude Code hook for symmetry, and do not keep a second copy of the deny list."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/7268da45-5b77-4583-a3cb-27e5ec7067b1.json b/docs/outstanding-issues-inbox/applied/7268da45-5b77-4583-a3cb-27e5ec7067b1.json
similarity index 100%
rename from docs/outstanding-issues-inbox/7268da45-5b77-4583-a3cb-27e5ec7067b1.json
rename to docs/outstanding-issues-inbox/applied/7268da45-5b77-4583-a3cb-27e5ec7067b1.json
diff --git a/docs/outstanding-issues-inbox/74edc91b-042b-4e73-911c-286d0b38da45.json b/docs/outstanding-issues-inbox/applied/74edc91b-042b-4e73-911c-286d0b38da45.json
similarity index 100%
rename from docs/outstanding-issues-inbox/74edc91b-042b-4e73-911c-286d0b38da45.json
rename to docs/outstanding-issues-inbox/applied/74edc91b-042b-4e73-911c-286d0b38da45.json
diff --git a/docs/outstanding-issues-inbox/applied/7f5e6922-8d0b-424a-b359-12bed3a4e315.json b/docs/outstanding-issues-inbox/applied/7f5e6922-8d0b-424a-b359-12bed3a4e315.json
new file mode 100644
index 0000000000..7e926f32e7
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/7f5e6922-8d0b-424a-b359-12bed3a4e315.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "7f5e6922-8d0b-424a-b359-12bed3a4e315",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#231",
+    "detail": "PARTIAL 2026-08-12: This PR fixes the clinically consequential stale-fallback path: every answer whose routing or degraded reason contains generation_fallback is excluded from rag_response_cache. Offline evidence: 96 focused answer-route tests and 574 RAG fixture/contract tests passed. Approved live baseline/final canaries preserved 36/36 document and content recall at 1.0 with zero per-case reciprocal-rank regressions; the final 44-case answer gate had zero citation or numeric-grounding failures. A budget extension was tested and rejected: four cache-bypassed 'Lithium dosing?' probes remained grounded, cited safe extractive fallbacks at 35-40 second candidate budgets; the decisive 40-second probe completed generation in 25.272 seconds and 27.237 seconds total with route_deadline_exceeded=false, but failed generation quality. Therefore OPENAI_ANSWER_TIMEOUT_MS and the route budget are not the current residual binding cause. INSTRUMENT NOW EXISTS 2026-08-14: the \"Next: instrument\" half of this row is done. Commit a3bc4da adds scripts/probe-generation-quality.ts — one cache-bypassed live answer reporting the structured generation_quality_gate_reasons, provider-backed, refusing demo mode, never caching or logging the probe. The same commit adjudicates PR #1861: superseded for phase 1, close recommended, with the numeric-retry half deferred to phase 2 pending probe evidence. So do not review #1861 as though it were the live fix, and do not re-implement the probe. Next: run scripts/probe-generation-quality.ts in an environment that has OPENAI and Supabase credentials — it is blocked in offline containers, which is why it has not been run yet — then make a separate bounded output-quality fix with an offline fixture and live canary. Stop: do not increase route/provider timeouts or cache any generation fallback."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/81845ded-27a8-43d8-9a56-d85a5515935b.json b/docs/outstanding-issues-inbox/applied/81845ded-27a8-43d8-9a56-d85a5515935b.json
new file mode 100644
index 0000000000..6e33fd7322
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/81845ded-27a8-43d8-9a56-d85a5515935b.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "81845ded-27a8-43d8-9a56-d85a5515935b",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#231",
+    "detail": "PARTIAL 2026-08-12: This PR fixes the clinically consequential stale-fallback path: every answer whose routing or degraded reason contains generation_fallback is excluded from rag_response_cache. Offline evidence: 96 focused answer-route tests and 574 RAG fixture/contract tests passed. Approved live baseline/final canaries preserved 36/36 document and content recall at 1.0 with zero per-case reciprocal-rank regressions; the final 44-case answer gate had zero citation or numeric-grounding failures. A budget extension was tested and rejected: four cache-bypassed 'Lithium dosing?' probes remained grounded, cited safe extractive fallbacks at 35-40 second candidate budgets; the decisive 40-second probe completed generation in 25.272 seconds and 27.237 seconds total with route_deadline_exceeded=false, but failed generation quality. Therefore OPENAI_ANSWER_TIMEOUT_MS and the route budget are not the current residual binding cause. INSTRUMENT NOW EXISTS 2026-08-14: the \"Next: instrument\" half of this row is done. Commit a3bc4da adds scripts/probe-generation-quality.ts — one cache-bypassed live answer reporting the structured generation_quality_gate_reasons, provider-backed, refusing demo mode, never caching or logging the probe. The same commit adjudicates PR #1861: superseded for phase 1, close recommended, with the numeric-retry half deferred to phase 2 pending probe evidence. So do not review #1861 as though it were the live fix, and do not re-implement the probe. Next: run scripts/probe-generation-quality.ts in an environment that has OPENAI and Supabase credentials — it is blocked in offline containers, which is why it has not been run yet — then make a separate bounded output-quality fix with an offline fixture and live canary. Stop: do not increase route/provider timeouts or cache any generation fallback. INCIDENT ADDENDUM 2026-08-14 (later the same day): rung-2 evidence was then measured live - supabase_rpc_latency_ms 31610 on a semantic query (route budget 25000 starved generation), caused by the #316 dropped trigram indexes; after their owner-approved restore, 1535 (text fast path) / 8519 (hybrid). Pre-generation latency was the binding residual cause of semantic-query source-only fallbacks in that window; evidence in docs/audit/live-drift-forensics-2026-08.md. S1 (A1 phase 2) must re-verify generation_quality_gate:* dominance on healthy latency (run the probe with node --env-file=.env.local, which the probe does not load itself) before choosing a code mitigation rung. The route-budget stop condition stands unchanged.",
+    "source": "sessions 2026-08-14: instrument adjudication + live incident probes (owner-authorized Supabase connector)"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/83ec71cf-db94-4110-ada8-ec7e730e5154.json b/docs/outstanding-issues-inbox/applied/83ec71cf-db94-4110-ada8-ec7e730e5154.json
new file mode 100644
index 0000000000..985a763619
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/83ec71cf-db94-4110-ada8-ec7e730e5154.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "83ec71cf-db94-4110-ada8-ec7e730e5154",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#211",
+    "detail": "**DEPRIORITISED 2026-08-12 (yield review against current main), and that judgment still holds** — each site is a local judgment, no open ledger row traces a defect to unchecked indexed access, and the diff conflicts with every open PR. Do it in scoped batches after the clinical and CI-trust work. This update carries that conclusion forward rather than replacing it; what has changed is that the batches now exist on paper and the count was wrong. **RE-MEASURED AND PLANNED 2026-08-14 in PR #1944.** The staged plan is docs/no-unchecked-indexed-access-migration-plan.md; the migration has NOT started and tsconfig.json is unchanged, so this row stays open and stays deprioritised. Measured against main at d47aa6d rather than reusing the 2026-08-02 figure: **1,445 errors across 269 files, up from 1,266**. The drift is itself a finding — the flag is off, so nothing stops new unchecked indexing landing, and any plan built on the stale count under-scopes. The measurement also reshapes the job in a way that supports doing it in batches: tests/ (713) plus design-scratch mockups (237) are two-thirds of the population and carry no production consequence, so the genuinely risky remainder is about 500 errors, not 1,445. Shape is 71 percent TS2532/TS18048, which a guard fixes; the 368 TS2345/TS2322 need a real decision about what the absent case means. Hot spots unchanged and confirmed: answer-verification.ts (41), rag-extractive-answer.ts (23), worker/main.ts (23), evidence.ts (19). Six stages, cheapest first, each flagged mechanical or manual with its own gate. Key constraint the plan records: noUncheckedIndexedAccess is a whole-project option and narrowing include does not isolate a directory, because TypeScript still reports errors in every transitively imported file — so the flag flips exactly once in the final PR and intermediate stages are verified by a baseline ratchet in the shape of scripts/design-system-contract-baseline.json. Stage 6 touches src/lib/rag/**, so the plan writes out the flag-before-editing, RAG impact line, and live-canary obligations. Stop unchanged: do not flip the flag on main ahead of the final stage."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/8c133c4e-23e7-427f-b1b8-6d6a64dfd381.json b/docs/outstanding-issues-inbox/applied/8c133c4e-23e7-427f-b1b8-6d6a64dfd381.json
new file mode 100644
index 0000000000..b3725adc73
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/8c133c4e-23e7-427f-b1b8-6d6a64dfd381.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "8c133c4e-23e7-427f-b1b8-6d6a64dfd381",
+  "createdOn": "2026-08-15",
+  "action": "update",
+  "payload": {
+    "id": "#265",
+    "detail": "GATE 2 CLOSED 2026-08-15 by PR #1984; gates 7 and 8 remain, and gate 8 is materially larger than this row said. Corrections first, because two figures here were stale: the debt for gate 8 is 25 conflicts across 12 files, not 27 across 15 — PR #1942 paid three files down without updating the prose, and both GATES.md section 3 and scripts/design-system-contract-baseline.json already said 25, which outranks the prose per docs/design-system/README.md. GATES.md carries 9 implemented-partial rows, not 10; the tenth grep hit is the legend. And #293 is resolved: commit 885c613 (PR #1962) IS on main — PR #1977 is already open to close that row, so do not queue another. GATE 2, what closed it: the row named two gaps, the rendered enumeration and the fixed-height h-10 case. The first landed in #1962. The second is closed by a new interactiveTapFloorDeclarations metric in check:design-system-contract — an interactive element (a, button, input, select, summary, textarea) declaring its OWN unprefixed min-h-* below the 48px token, ratcheted at 43 across 17 files with per-path pins; comparable arbitrary lengths and mutually exclusive/composed branches are evaluated independently, so a new sub-floor control anywhere in src/** fails today. Mutation-verified: lowering one shortlist button to min-h-9 produced both the total and matching per-path regression. Scoped to min-h-* and NOT h-*/size-* on purpose: a short h-4 on an interactive element is routinely the visible box of a control whose hit area belongs to a tap-sized wrapper (SelectionCheckbox in differentials-home.tsx, whose label ui-smoke asserts still meets the floor), and flagging those would pad the baseline with non-defects — the exact section 5 failure mode. One remaining limit recorded rather than hidden: the walker sees intrinsic lowercase tags only, so a floor on <Link> or another component wrapper is invisible to it (the pre-existing legacyTapClasses check shares that blind spot). The 43 recorded sites are real debt still owed. Also tightened legacyShadowAliases 119 to its measured 118 — one unit of stale slack found while working #163. GATE 8 — STOPPED DELIBERATELY, and the reason matters for whoever picks it up. The 25 conflicts are not 25 mechanical one-line edits. Inspected every site: the large majority are focus:ring-4 focus indicators co-existing with a border on inputs, selects and textareas (master-search-header 5, formulation-builder 3, and singles across formulation-compare, dashboard-nav, favourites, specifiers, DocumentTagCloud, ui-primitives), and only pwa-lifecycle's shared cardClassName is the decorative persistent double edge the rule was written for — one recipe counted 5 times. Retiring the focus-ring class means restyling focus indicators from ring to outline across roughly 17 controls, which is an accessibility-visible change needing focus-state proof in a browser. Three further constraints: this container cannot run Chromium (ships chromium-1194 against a pinned 1234, #255/#312) so that proof was unavailable; 8 of the 25 sit in files that open PRs #1976, #1982 and #1983 are editing; and pinning at zero without first widening the onePixelShadowSpreads property filter (design-system-contract-utils.mjs:1320 matches --e[0-4] and --shadow-* but not --glow-primary, --glow-soft or --ring-hairline, all of which carry 0 0 0 1px) would be a partly false close. Next for gate 8: decide the focus-indicator question first as a design-system ruling (ring vs outline for focus), then widen the spread filter, then retire and pin — with browser focus proof. GATE 7 untouched, unchanged from this row's description: no child/parent elevation check exists and no shared render-tree traversal helper exists to build one on; every spec inlines its own page.evaluate walk. The template is #1962's determinism scaffolding plus a computed-box-shadow to --e0..--e4 tier lookup built with the probe technique at ui-style-contract.spec.ts:265-289.",
+    "source": "session 2026-08-15; PR #1984; GATES.md; scripts/design-system-contract-baseline.json"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/9792c896-78d8-46ab-b194-6a52b7fd7cab.json b/docs/outstanding-issues-inbox/applied/9792c896-78d8-46ab-b194-6a52b7fd7cab.json
new file mode 100644
index 0000000000..d24e272a62
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/9792c896-78d8-46ab-b194-6a52b7fd7cab.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "9792c896-78d8-46ab-b194-6a52b7fd7cab",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#316",
+    "detail": "Phase 0 CLOSED 2026-08-14, including the forced-dispatch proof its definition of done required. Dispatched live-drift on main (run 31813064485): the drift job failed as expected, the always() capture step still ran, and the separate drift-routing job then created issue #1963 'Live drift check failing' automatically, carrying the run URL, job result, trigger and the full findings block. Failure routing is therefore proven end-to-end against the real repository, not just offline; PR #1951 adds a mutation-verified contract test so it stays proven. That run also supersedes the stale 2026-08-09 drift numbers this row was opened with. Measured now: 10 match_* function def_hash mismatches (UNCHANGED - Phase 3 is entirely outstanding and remains the highest-stakes unknown), 20 missing_live indexes (not 21), and the same 2 unexpected_live indexes (document_table_facts_document_id_idx, storage_cleanup_jobs_owner_id_idx). documents_title_trgm_idx and document_chunks_content_trgm_idx are no longer in the missing list, independently confirmed by direct read-only query against sjrfecxgysukkwxsowpy (both indisvalid/indisready, 648 kB and 68 MB), which corroborates the restoration recorded in PR #1960. Next: Phase 3 (RPC reconciliation) before Phase 4, per the plan's ordering — the change that can alter clinical answers goes before the ones that only speed them up."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/97e7beeb-97e5-43a6-b238-065b42070969.json b/docs/outstanding-issues-inbox/applied/97e7beeb-97e5-43a6-b238-065b42070969.json
new file mode 100644
index 0000000000..80f79abc47
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/97e7beeb-97e5-43a6-b238-065b42070969.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "97e7beeb-97e5-43a6-b238-065b42070969",
+  "createdOn": "2026-08-14",
+  "action": "done",
+  "payload": {
+    "id": "#194",
+    "outcome": "3 of 5 named backfill one-shots archived via PR #1947 (backfill-document-covers.mjs, backfill-document-tags.ts, backfill-enrichment.ts moved to scripts/archive/, npm scripts repointed, one test import updated). The other 2 (backfill-gold-document-labels.ts, backfill-smart-index.ts) were found already classified [live] ongoing tooling in docs/scripts-index.md and docs/codebase-index.md, not one-shot candidates -- archiving them would have contradicted the repo's own documented convention, so they were correctly left in place. The 'dead ci-change-scope token' claim was confirmed FALSE by grep: scripts/ci-change-scope.mjs is live, central CI tooling wired into ci.yml and four other verify scripts. No removal made."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/9b67dd0e-f11e-423e-be63-7e4d91f4dd82.json b/docs/outstanding-issues-inbox/applied/9b67dd0e-f11e-423e-be63-7e4d91f4dd82.json
new file mode 100644
index 0000000000..f375e01fbe
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/9b67dd0e-f11e-423e-be63-7e4d91f4dd82.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "9b67dd0e-f11e-423e-be63-7e4d91f4dd82",
+  "createdOn": "2026-08-14",
+  "action": "done",
+  "payload": {
+    "id": "#335",
+    "outcome": "Closed 2026-08-15 as duplicate follow-up of #324. The delivered file-level audit, the remaining schedule/owner decision, and the distinct inbox-request-loss scope are all retained in #324; no scheduling or CI policy was changed by this consolidation."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/a780ce8a-a373-4c95-974f-0692af775ff6.json b/docs/outstanding-issues-inbox/applied/a780ce8a-a373-4c95-974f-0692af775ff6.json
new file mode 100644
index 0000000000..3e243cfb2f
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/a780ce8a-a373-4c95-974f-0692af775ff6.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "a780ce8a-a373-4c95-974f-0692af775ff6",
+  "createdOn": "2026-08-14",
+  "action": "done",
+  "payload": {
+    "id": "#313",
+    "outcome": "Closed 2026-08-14 by PR #1944. scripts/check-ledger-write-discipline.mjs now reads git status for the paths it governs (docs/outstanding-issues.md, docs/branch-review-ledger.md, and docs/outstanding-issues-inbox/ including applied/) and refuses to report any verdict while one of them is dirty, naming each offending path and its status. Fixed as the row asked — the check was right, it just was not being asked the right question — rather than by relaxing the discipline. Two things only surfaced by running it: the module git() helper trims its output, which ate the leading space of porcelain's \" M path\" status field and shifted every path by one character so the guard silently never fired (the refusal now reads porcelain untrimmed, and tests/ledger-write-discipline.test.ts pins that specific shift); and scripts/guard-push.mjs:899 invokes this gate with an explicit committed --head at a moment when the tree is legitimately dirty, so the refusal fires only when head resolves to the default HEAD, leaving pre-push and clean CI unaffected. No override env var: both callers are unaffected by construction, so an escape hatch would only reopen the hole. Self-test extended with the dirty-tree case plus 9 focused tests. NOT addressed here, still open: the row's related contributing factor that node scripts/outstanding-issues.mjs done and npm run issues:done are different tools with nothing at the call site saying so."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/a860ce7a-5ecf-4f30-a3b9-5c22d1d914b9.json b/docs/outstanding-issues-inbox/applied/a860ce7a-5ecf-4f30-a3b9-5c22d1d914b9.json
similarity index 100%
rename from docs/outstanding-issues-inbox/a860ce7a-5ecf-4f30-a3b9-5c22d1d914b9.json
rename to docs/outstanding-issues-inbox/applied/a860ce7a-5ecf-4f30-a3b9-5c22d1d914b9.json
diff --git a/docs/outstanding-issues-inbox/applied/b53c5e20-2c6f-41da-a202-bcf5c7609938.json b/docs/outstanding-issues-inbox/applied/b53c5e20-2c6f-41da-a202-bcf5c7609938.json
new file mode 100644
index 0000000000..fd3a8f9733
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/b53c5e20-2c6f-41da-a202-bcf5c7609938.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "b53c5e20-2c6f-41da-a202-bcf5c7609938",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#215",
+    "detail": "CORRECTION 2026-08-14: an earlier queued request for this row claimed `done`, citing PR #1949. That was premature -- PR #1949 is still open, not merged, and its `Production UI` and `PR required` checks are currently failing; src/components/pwa-lifecycle.tsx on main does not yet carry the change. Do not close this row until PR #1949 actually merges and the fix is confirmed present on main. What PR #1949 contains, once it lands: (a) decoding=\"async\" added to the PWA install-sheet icon in pwa-lifecycle.tsx, matching the image-lightbox.tsx / non-pdf-source-preview.tsx pattern. (b) Demo PNG-to-WebP conversion explicitly declined rather than done: no real conversion tooling available without adding a new dependency (sharp is only a peer-dep override pin, not usable standalone), SignedImage deliberately sets unoptimized on next/image for signed-URL-security reasons unrelated to demo assets, and the payoff is ~185KB on assets that never reach production users. That decision stands regardless of PR #1949's merge state.",
+    "source": "session 2026-08-14 ledger correction; PR #1949 (open, CI red as of this correction)"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/b5f28517-89c9-455d-a4b4-202608141940.json b/docs/outstanding-issues-inbox/applied/b5f28517-89c9-455d-a4b4-202608141940.json
similarity index 100%
rename from docs/outstanding-issues-inbox/b5f28517-89c9-455d-a4b4-202608141940.json
rename to docs/outstanding-issues-inbox/applied/b5f28517-89c9-455d-a4b4-202608141940.json
diff --git a/docs/outstanding-issues-inbox/b7a5bee9-bddc-4a7a-9614-a49301c00cc8.json b/docs/outstanding-issues-inbox/applied/b7a5bee9-bddc-4a7a-9614-a49301c00cc8.json
similarity index 100%
rename from docs/outstanding-issues-inbox/b7a5bee9-bddc-4a7a-9614-a49301c00cc8.json
rename to docs/outstanding-issues-inbox/applied/b7a5bee9-bddc-4a7a-9614-a49301c00cc8.json
diff --git a/docs/outstanding-issues-inbox/b7c0f9f6-c95d-413f-9bdd-6b6ad9cbcb91.json b/docs/outstanding-issues-inbox/applied/b7c0f9f6-c95d-413f-9bdd-6b6ad9cbcb91.json
similarity index 100%
rename from docs/outstanding-issues-inbox/b7c0f9f6-c95d-413f-9bdd-6b6ad9cbcb91.json
rename to docs/outstanding-issues-inbox/applied/b7c0f9f6-c95d-413f-9bdd-6b6ad9cbcb91.json
diff --git a/docs/outstanding-issues-inbox/applied/b935dad0-394c-435a-acc5-21df750c7e52.json b/docs/outstanding-issues-inbox/applied/b935dad0-394c-435a-acc5-21df750c7e52.json
new file mode 100644
index 0000000000..b5149fa44f
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/b935dad0-394c-435a-acc5-21df750c7e52.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "b935dad0-394c-435a-acc5-21df750c7e52",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#293",
+    "detail": "CORRECTION 2026-08-14: an earlier queued request for this row claimed `done`, citing PR #1962. That was premature -- PR #1962 is still open, not merged; tests/ui-style-contract.spec.ts on main does not yet carry the new test. Do not close this row until PR #1962 actually merges and the test is confirmed present on main. What PR #1962 contains, once it lands: Finding 1 (min-height override) reconfirmed already refuted/intentional, untouched -- no code change needed there. Finding 2 (nondeterministic enumeration): confirmed via git history it was written once but reverted rather than landed, so there was no code to fix, only a missing regression test to build. The new Playwright test runs on /forms's static home (avoids the original live-search route race), at a 390x844 phone viewport (avoids the sm: release that refuted Finding 1), polls until 3 consecutive enumeration reads agree instead of trusting networkidle, explicitly sorts the shape list, and repeats 3 full navigate-and-enumerate cycles inside the test asserting an exact match. Full spec file passed 10/10 in that session's own run -- but that proof is local to the branch until the PR merges.",
+    "source": "session 2026-08-14 ledger correction; PR #1962 (open, not yet merged as of this correction)"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/bbf21714-0ef9-4c2f-942f-1b8d7e328ac8.json b/docs/outstanding-issues-inbox/applied/bbf21714-0ef9-4c2f-942f-1b8d7e328ac8.json
new file mode 100644
index 0000000000..abf9fc0d02
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/bbf21714-0ef9-4c2f-942f-1b8d7e328ac8.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "bbf21714-0ef9-4c2f-942f-1b8d7e328ac8",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#316",
+    "detail": "2026-08-14 incident session: two of the 21 missing indexes (documents_title_trgm_idx, document_chunks_content_trgm_idx) were the retrieval-critical pair; restored live via owner-approved CREATE INDEX CONCURRENTLY + ANALYZE. Before/after supabase_rpc_latency_ms 31610 -> 1535 (text) / 8519 (hybrid). Forensics: indexes existed 2026-08-04 (guard 20260804110240 passed) and were dropped by 2026-08-09; no app code drops indexes - owner to check dashboard audit for manual/advisor DROP INDEX. Evidence: docs/audit/live-drift-forensics-2026-08.md. Remaining drift findings + 10 diverged match_* RPC bodies stay with docs/database-remediation-plan.md. Drift routing: PR #1939.",
+    "source": "session 2026-08-14 live incident (owner-authorized Supabase connector)"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/bcea44bc-5738-41b8-96f1-e96b1488ab29.json b/docs/outstanding-issues-inbox/applied/bcea44bc-5738-41b8-96f1-e96b1488ab29.json
new file mode 100644
index 0000000000..eaccc88c12
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/bcea44bc-5738-41b8-96f1-e96b1488ab29.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "bcea44bc-5738-41b8-96f1-e96b1488ab29",
+  "createdOn": "2026-08-14",
+  "action": "cancel",
+  "payload": {
+    "requestId": "5cf082dd-60c3-42ef-95dc-82b9c255e9be",
+    "reason": "The queued correction is stale: PR #1953's isolated Playwright tsconfig include/exclude fix is now on main."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/bd11cfe9-1627-425f-a8f7-e0e202b980a4.json b/docs/outstanding-issues-inbox/applied/bd11cfe9-1627-425f-a8f7-e0e202b980a4.json
new file mode 100644
index 0000000000..cf3b2c9214
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/bd11cfe9-1627-425f-a8f7-e0e202b980a4.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "bd11cfe9-1627-425f-a8f7-e0e202b980a4",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#235",
+    "detail": "CLOSURE ATTEMPTED AND REJECTED 2026-08-14 — read this before closing again. PR #1940 queued a `done` for this row citing ADOPTION.md section 7.1's per-surface executable-evidence table; the closure was cancelled on review with the reason \"executable evidence does not replace the requested desktop and phone proof shots\". The cancellation is correct, and the trap is worth naming: section 7.1 opens with \"This PR records executable evidence RATHER THAN committing image baselines\", so the very section that looks like the evidence says in its first line that it is not. A test that proves a component is mounted is not a picture of the surface, and this row asks for the picture. IN FLIGHT note retired: PR #1842 merged, so the do-not-start warning no longer applies. The requirement is unchanged. The adoption contract asks for a proof shot per adopted surface. Wave 5 captured four - DSM header, settings rows, patient panel, answer surface - and none for the forms fold, the catalogue and docs surfaces, the headers convergence, or the empty states adopted since. Section 7 therefore reads as complete while most of the adoption is unevidenced, which matters because the proof shot is what a later reader uses to tell an intended restyle from a regression (the #229 DSM eyebrow was almost rediscovered as a defect for exactly this reason). Next action: capture the missing shots against a warmed local server (npm run ensure) and attach them to section 7. Cheap and mechanical - no gate, no provider access. Stop: this is not the visual-baseline harness (#118) - do not commit Playwright snapshot PNGs or flip that job to blocking. Stop: do not close this row on unit, DOM or contract evidence of any kind."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/c3622ee1-872f-4476-8b12-20e97057c5d5.json b/docs/outstanding-issues-inbox/applied/c3622ee1-872f-4476-8b12-20e97057c5d5.json
new file mode 100644
index 0000000000..636a08df28
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/c3622ee1-872f-4476-8b12-20e97057c5d5.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "c3622ee1-872f-4476-8b12-20e97057c5d5",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#248",
+    "detail": "APPEND 2026-08-13: the prior closure is withdrawn. Repository and live-drift evidence establishes that 20260705180000_reconcile_search_health_indexes.sql is recorded as applied while documents_title_trgm_idx and document_chunks_content_trgm_idx are missing on live. Supabase transaction semantics exclude a persisted partial migration, but the present record does not distinguish skipped DDL/history repair from indexes created and later dropped. In an approved read-only window, query supabase_migrations.schema_migrations for the 20260705180000 statements fingerprint and inspect the relevant audit/history evidence; retain both hypotheses until that evidence establishes the cause. Separately, scheduled check:drift did detect the missing indexes, but red runs were not routed. FINGERPRINT CAPTURED 2026-08-14 (read-only connector session): the requested statements fingerprint is done and is recorded in forensics 1.1 and 1.3. 20260705180000 carries stmt_count 14 and does NOT carry the mark-applied signal, so its DDL was recorded as executed - which eliminates the skipped-DDL/history-repair hypothesis for this migration and leaves created-then-dropped. The same check across four further migrations that define still-absent indexes returns the same answer (20260528007000 stmt_count 32, 20260608001000 36, 20260712165211 27, 20260717170000 11, none mark-applied), so this is not confined to one migration. Also ruled out: invalid-but-present indexes - pg_index filtered on indisvalid/indisready false returns zero rows across public. What remains genuinely unknown is the actor: no app, worker or edge-function code issues DROP INDEX, so a manual or advisor-accepted dashboard drop is the leading inference and NOT an established attribution. Next: the dashboard audit/query-history pairing for the affected windows, which is owner-only. Keep this row open until that pairing lands - the mechanism question is answered, the attribution question is not."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/c3d91fce-52e5-41ed-8648-b2bf5e95b32c.json b/docs/outstanding-issues-inbox/applied/c3d91fce-52e5-41ed-8648-b2bf5e95b32c.json
new file mode 100644
index 0000000000..308af5387a
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/c3d91fce-52e5-41ed-8648-b2bf5e95b32c.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "c3d91fce-52e5-41ed-8648-b2bf5e95b32c",
+  "createdOn": "2026-08-14",
+  "action": "done",
+  "payload": {
+    "id": "#331",
+    "outcome": "Not a comparison bug. Investigated 2026-08-14 in PR #1951: the staleness was real and wrapping-only. Normalising whitespace on the committed and regenerated docs/medication-interaction-lexicon-review.md leaves them byte-identical across all 28 catalogue terms, so no content changed, but the committed line wrapping genuinely differed from the generator's. The reason three branches saw it with 'zero diff on their branch' is that it was already stale on main, so every branch inherited the failure regardless of what it touched — git diff origin/main was the wrong instrument, since main itself carried the stale copy. It also escaped npm run format because prettier runs proseWrap: preserve, which accepts both wrappings. Fixed by regenerating with npm run medications:lexicon-report followed by prettier (the order the check expects). The remaining open question — that no CI job runs this check — is tracked in #333 rather than here."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/c5e84848-9a84-442e-a818-1b53df5693fa.json b/docs/outstanding-issues-inbox/applied/c5e84848-9a84-442e-a818-1b53df5693fa.json
new file mode 100644
index 0000000000..146456598f
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/c5e84848-9a84-442e-a818-1b53df5693fa.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "c5e84848-9a84-442e-a818-1b53df5693fa",
+  "createdOn": "2026-08-14",
+  "action": "done",
+  "payload": {
+    "id": "#189",
+    "outcome": "Route-level budget pinned via PR #1950 (16 round trips: auth/ratelimit/scope/enrichment/telemetry). The x3 text-RPC fan-out (match_document_chunks_text_v2 / match_document_table_facts_text_v2) is disposed as INTENTIONAL: src/lib/rag/rag-candidate-sources.ts fans out maxTextRpcQueryVariants (3) lexical query-variant phrasings for recall, with an existing PT-02 early exit (firstVariantPoolIsStrong) that skips sibling RPCs when the primary pool is already strong. No retrieval-behaviour change made; collapsing further would need a RAG flag plus a live canary, out of scope for this PR."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/c63161f6-21b8-40ec-927c-684e22791066.json b/docs/outstanding-issues-inbox/applied/c63161f6-21b8-40ec-927c-684e22791066.json
new file mode 100644
index 0000000000..04ba762901
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/c63161f6-21b8-40ec-927c-684e22791066.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "c63161f6-21b8-40ec-927c-684e22791066",
+  "createdOn": "2026-08-14",
+  "action": "cancel",
+  "payload": {
+    "requestId": "c3d91fce-52e5-41ed-8648-b2bf5e95b32c",
+    "reason": "Superseded by fbfe982f-cd2f-49c9-a94e-908a99efa6b8, the current #331 update consolidating the authoritative remaining work."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/ce304701-1e01-4cfb-bf9c-202608141940.json b/docs/outstanding-issues-inbox/applied/ce304701-1e01-4cfb-bf9c-202608141940.json
similarity index 100%
rename from docs/outstanding-issues-inbox/ce304701-1e01-4cfb-bf9c-202608141940.json
rename to docs/outstanding-issues-inbox/applied/ce304701-1e01-4cfb-bf9c-202608141940.json
diff --git a/docs/outstanding-issues-inbox/applied/d194f4ec-568c-4689-a411-22447c59fb53.json b/docs/outstanding-issues-inbox/applied/d194f4ec-568c-4689-a411-22447c59fb53.json
new file mode 100644
index 0000000000..7b08a9fc48
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/d194f4ec-568c-4689-a411-22447c59fb53.json
@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "id": "d194f4ec-568c-4689-a411-22447c59fb53",
+  "createdOn": "2026-08-15",
+  "action": "add",
+  "payload": {
+    "pri": "P2",
+    "type": "issue",
+    "summary": "Recurring 'Unhandled server request error' on /api/search and /api/search/universal is untriaged",
+    "detail": "Three Sentry issue groups in clinibase-xz over 24h (JAVASCRIPT-NEXTJS-Y, -Z, -10), 17 events, 0 users impacted, all titled 'Error: Unhandled server request error' with culprit chunk 1261.js:2:4801. Top frames are /api/search/route.js and /api/search/universal/route.js. First seen 2026-08-14T08:44:37Z on release c9b089c92c975297c10649b005401d5ae337cf48, roughly six hours BEFORE PR #1946 merged, so it is not caused by the retrieval row contract; the post-merge group is the same error refingerprinted by the release change. The error string does not appear anywhere in repo source, so it likely originates in a dependency or an instrumentation wrapper — origin unidentified. Nobody owns this. Next step: identify what throws it, then decide whether it is a bot/scanner artefact or a real request-handling gap.",
+    "source": "Sentry clinibase-xz, reviewed 2026-08-15"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/d226dce3-76a2-4ccc-9723-5e7ca03a6c5d.json b/docs/outstanding-issues-inbox/applied/d226dce3-76a2-4ccc-9723-5e7ca03a6c5d.json
new file mode 100644
index 0000000000..781985910b
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/d226dce3-76a2-4ccc-9723-5e7ca03a6c5d.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "d226dce3-76a2-4ccc-9723-5e7ca03a6c5d",
+  "createdOn": "2026-08-14",
+  "action": "cancel",
+  "payload": {
+    "requestId": "4bc449a1-ec81-426d-aadd-8a78abec21cf",
+    "reason": "This aborted command captured audit output inside the immutable detail field; apply the corrected #324 update 19762e55-fa25-41de-a5a2-7f4932a545fe instead."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/d229e6b5-a31a-44a9-8a7b-536e7f8ccf50.json b/docs/outstanding-issues-inbox/applied/d229e6b5-a31a-44a9-8a7b-536e7f8ccf50.json
new file mode 100644
index 0000000000..7a7f489744
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/d229e6b5-a31a-44a9-8a7b-536e7f8ccf50.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "d229e6b5-a31a-44a9-8a7b-536e7f8ccf50",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#168",
+    "detail": "DESIGNED 2026-08-14 in PR #1944 — docs/ledger-id-scheme-proposal.md. Design only, nothing implemented, so this row stays open. Recommends a ULID as the durable id with a short derived display form, the property that matters being that the display form is derived rather than stored: a clash there is a rendering fix (take one more character) rather than a renumber. UUIDv7 noted as an equally good fit. Records why timestamp-plus-slug and content hashes were rejected — the slug wants to change when a row is re-scoped, which is renumbering under another name, and a content hash is neither sortable nor stable. Migration is additive because the 314 existing sequential ids keep their numbers permanently: they are cited across the ledger, docs/branch-review-records/, AGENTS.md, the skills and the commit history, so renumbering would invalidate every citation while producing exactly the churn this row exists to end. Four steps, widening validators before allocation changes, with every current #NNN assumption enumerated by file and symbol (ledger-inbox.mjs validateRequest twice; check-outstanding-issues.mjs ID_CELL, the MARKER parse, the nextId-above-highest assertion and its padStart formatting; outstanding-issues.mjs allocator; issues-report.mjs and the issues-surface hook). Stop unchanged and now load-bearing on step ordering: do not reinstate merge=union while ids are sequential — it only becomes safe after the marker is gone."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/d2e60a94-b12a-4502-a8b9-3dc8406cc8c8.json b/docs/outstanding-issues-inbox/applied/d2e60a94-b12a-4502-a8b9-3dc8406cc8c8.json
new file mode 100644
index 0000000000..51fffaadae
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/d2e60a94-b12a-4502-a8b9-3dc8406cc8c8.json
@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "id": "d2e60a94-b12a-4502-a8b9-3dc8406cc8c8",
+  "createdOn": "2026-08-14",
+  "action": "add",
+  "payload": {
+    "pri": "P3",
+    "type": "issue",
+    "summary": "The visual ISSUES-LIST.html register cannot be refreshed from any non-Windows session, so it drifts silently as work moves to cloud sessions",
+    "detail": "**Outcome:** either the rendered register is refreshable from any session that can reconcile, or it is retired and the Markdown ledger is the only artifact. **Detail, observed 2026-08-14 during the reconciliation in PR #1956.** `.claude/skills/issues/SKILL.md` refreshes the register by invoking `refresh-issues-list.ps1` under the operator's Windows `.codex\\scripts` directory and writing `ISSUES-LIST.html` into their OneDrive folder — both absolute Windows paths. A Linux, container, or Codex/Claude Cloud session can run `npm run issues:reconcile` perfectly well (it did: 35 requests, write-discipline verified) but cannot run the refresh and cannot even check how stale the artifact is. The skill already handles this correctly for a single run — it says a stale visual artifact must not invalidate a valid canonical transaction, which is the right call — so this is not a correctness bug. The problem is cumulative: every cloud reconciliation widens the gap, and nothing measures it, so a reader opening the HTML has no way to tell whether it is an hour or a month behind. **Why it is P3 and not higher:** `docs/outstanding-issues.md` is the canonical rendered source and is always current; only the convenience artifact drifts. **Next, cheapest first:** decide whether the register is still wanted. If yes, the smallest fix is a stamp rather than a port — have the refresh write the reconciliation commit SHA into the HTML so staleness is visible at a glance, and have reconcile print a reminder naming the commit that needs it. A full cross-platform port (a Node renderer under `scripts/`) is the larger option and probably only worth it if the register is load-bearing for someone. If nobody reads it, retiring it and deleting that skill section is cheaper than either. **Stop:** do not improvise a substitute renderer or hand-write the HTML from a cloud session — an artifact that looks refreshed but was produced by a different generator is worse than one that is visibly stale.",
+    "source": "PR #1956 reconciliation; .claude/skills/issues/SKILL.md refresh section; session 2026-08-14"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/d3b2fe49-3282-4756-9135-7c555dede447.json b/docs/outstanding-issues-inbox/applied/d3b2fe49-3282-4756-9135-7c555dede447.json
similarity index 100%
rename from docs/outstanding-issues-inbox/d3b2fe49-3282-4756-9135-7c555dede447.json
rename to docs/outstanding-issues-inbox/applied/d3b2fe49-3282-4756-9135-7c555dede447.json
diff --git a/docs/outstanding-issues-inbox/applied/d52dbc3d-6759-4f6e-9089-24059830ed5a.json b/docs/outstanding-issues-inbox/applied/d52dbc3d-6759-4f6e-9089-24059830ed5a.json
new file mode 100644
index 0000000000..9da2045b10
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/d52dbc3d-6759-4f6e-9089-24059830ed5a.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "d52dbc3d-6759-4f6e-9089-24059830ed5a",
+  "createdOn": "2026-08-14",
+  "action": "cancel",
+  "payload": {
+    "requestId": "19fb70c0-1fd4-43a8-a4f4-efa9c31d16b1",
+    "reason": "superseded: merged into the combined #231 update queued in this same PR"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/d656dcb5-3228-4ab8-b40c-b0377e63cb94.json b/docs/outstanding-issues-inbox/applied/d656dcb5-3228-4ab8-b40c-b0377e63cb94.json
new file mode 100644
index 0000000000..9540c13114
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/d656dcb5-3228-4ab8-b40c-b0377e63cb94.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "d656dcb5-3228-4ab8-b40c-b0377e63cb94",
+  "createdOn": "2026-08-15",
+  "action": "done",
+  "payload": {
+    "id": "#293",
+    "outcome": "Closed after PR #1962 landed on main (commit 885c613): tests/ui-style-contract.spec.ts now has a deterministic Gate 2 tap-carrier enumeration test at a 390x844 phone viewport on /forms's static home, polling until 3 consecutive reads agree. Finding 1 (min-height override) was already refuted as intentional (sm: desktop release of the phone-only floor); this closes Finding 2, the last open part."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/d9a7e3fc-06e9-45ca-ab2a-202608141940.json b/docs/outstanding-issues-inbox/applied/d9a7e3fc-06e9-45ca-ab2a-202608141940.json
similarity index 100%
rename from docs/outstanding-issues-inbox/d9a7e3fc-06e9-45ca-ab2a-202608141940.json
rename to docs/outstanding-issues-inbox/applied/d9a7e3fc-06e9-45ca-ab2a-202608141940.json
diff --git a/docs/outstanding-issues-inbox/dcb09280-0436-4651-a707-b0007e872d7b.json b/docs/outstanding-issues-inbox/applied/dcb09280-0436-4651-a707-b0007e872d7b.json
similarity index 100%
rename from docs/outstanding-issues-inbox/dcb09280-0436-4651-a707-b0007e872d7b.json
rename to docs/outstanding-issues-inbox/applied/dcb09280-0436-4651-a707-b0007e872d7b.json
diff --git a/docs/outstanding-issues-inbox/applied/ddef5391-d476-417f-b0c8-662e44c54f8b.json b/docs/outstanding-issues-inbox/applied/ddef5391-d476-417f-b0c8-662e44c54f8b.json
new file mode 100644
index 0000000000..8188137dd7
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/ddef5391-d476-417f-b0c8-662e44c54f8b.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "ddef5391-d476-417f-b0c8-662e44c54f8b",
+  "createdOn": "2026-08-14",
+  "action": "cancel",
+  "payload": {
+    "requestId": "9b67dd0e-f11e-423e-be63-7e4d91f4dd82",
+    "reason": "This duplicate #335 closure was created by the aborted command; apply the identical intended closure 2b7856a5-fe32-49b8-9e3c-819d961784c6 instead."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/ded27e2f-5c71-43b8-99dc-ffffa6294ba3.json b/docs/outstanding-issues-inbox/applied/ded27e2f-5c71-43b8-99dc-ffffa6294ba3.json
similarity index 100%
rename from docs/outstanding-issues-inbox/ded27e2f-5c71-43b8-99dc-ffffa6294ba3.json
rename to docs/outstanding-issues-inbox/applied/ded27e2f-5c71-43b8-99dc-ffffa6294ba3.json
diff --git a/docs/outstanding-issues-inbox/e4a11465-348c-49e5-8a0a-202608141941.json b/docs/outstanding-issues-inbox/applied/e4a11465-348c-49e5-8a0a-202608141941.json
similarity index 100%
rename from docs/outstanding-issues-inbox/e4a11465-348c-49e5-8a0a-202608141941.json
rename to docs/outstanding-issues-inbox/applied/e4a11465-348c-49e5-8a0a-202608141941.json
diff --git a/docs/outstanding-issues-inbox/applied/e684a311-2a0d-4c21-ba18-13afde3b62f8.json b/docs/outstanding-issues-inbox/applied/e684a311-2a0d-4c21-ba18-13afde3b62f8.json
new file mode 100644
index 0000000000..9a13149e00
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/e684a311-2a0d-4c21-ba18-13afde3b62f8.json
@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "id": "e684a311-2a0d-4c21-ba18-13afde3b62f8",
+  "createdOn": "2026-08-14",
+  "action": "add",
+  "payload": {
+    "pri": "P2",
+    "type": "rec",
+    "summary": "Merge-loss detection covers file-level reverts and inbox-request loss separately; neither covers the other, and the scheduled run is undecided",
+    "detail": "**Outcome:** one decision about how merge loss is detected on this repo, rather than two half-overlapping checks and an undecided schedule. **Detail.** Two detectors now exist for the same underlying hazard — content that reached main and then stopped being there — and they measure different things. (1) PR #1944 added scripts/audit-merge-loss.mjs (npm run audit:merge-loss): for every PR landing on origin/main in a bounded window it compares the ref's current blob for each file that landing changed against the blob at the landing's first parent, so it catches a landing whose CONTENT was reverted by a later merge resolution. Validated by independently rediscovering the acf78bf casualties (#1803 with 53 files, #1800, #1804, #1796, #1811). (2) PR #1937 filed a request about a queued inbox request that existed on a branch and never reached main through that branch's squash — a file that never landed at all, which detector (1) cannot see, because it only ever examines what a landing actually contributed. Conversely #1937's own cancel request warns that comparing all historical branch additions against the squash produces FALSE losses when a PR deliberately removes a file during review; detector (1) avoids that by construction (it diffs merge^1 against merge, not the branch's whole history), which is worth reusing rather than rediscovering. **Three things to decide, ideally together.** (a) Whether detector (1) gets a scheduled or post-merge run. PR #1944 deliberately shipped script-plus-test only: scheduling is an operational change needing its own PR and explicit approval, and joining verify:cheap:internal would force a matching static-pr step in ci.yml via check-gate-manifest. Until something runs it, it only helps whoever remembers to type it. (b) Whether the branch-versus-squash case becomes a second check or a mode of the same script. (c) What a positive costs a human: detector (1) is advisory and exits 0 on purpose, because a deliberate revert is byte-identical to an accidental one at blob level — a scheduled run therefore needs a named owner to triage it, or it becomes ignorable noise. **Next:** decide (a) first; it is the cheapest and it is what turns an existing script into an actual control. **Stop:** do not make either detector auto-fail without deciding (c) — an advisory check flipped to blocking on a signal that cannot distinguish intent will be silenced rather than triaged.",
+    "source": "PR #1944 (scripts/audit-merge-loss.mjs); PR #1937 and its cancel request 63419f06; inbox request 829597d4; acf78bf; session 2026-08-14"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/ec6d0c23-2f19-4159-9c73-49bdc103b61e.json b/docs/outstanding-issues-inbox/applied/ec6d0c23-2f19-4159-9c73-49bdc103b61e.json
new file mode 100644
index 0000000000..abf833b2ff
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/ec6d0c23-2f19-4159-9c73-49bdc103b61e.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "ec6d0c23-2f19-4159-9c73-49bdc103b61e",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#237",
+    "detail": "CLOSURE ATTEMPTED AND REJECTED 2026-08-14 — read this before closing again. PR #1940 queued a `done` for this row citing tests/accessible-table.dom.test.tsx:110 (\"keeps the full missing-value phrase readable in the dense 320px preview\"); the closure was cancelled on review with the reason \"the jsdom assertion does not verify the requested real 320px browser visual pass\". The cancellation is correct. jsdom does not lay out text, so a 320px assertion there proves the string is present, not that it fits, wraps or stays legible at that width — which is the whole question for a low-confidence extraction in a sparse grid. IN FLIGHT note retired: PR #1841 merged, so the do-not-start warning no longer applies. The requirement is unchanged. PR #1616 clinical MissingValue phrases increase text volume in sparse OCR grids; the contract forbids abbreviating to a dash. Next: open one real lowConfidence extraction at 320px phone width in an actual browser (npm run ensure, then a phone viewport) and accept or adjust dense preview column widths before committing Linux screenshots (#118). Stop: do not close this row on a jsdom, DOM-testing-library or snapshot-string assertion — only a real browser at 320px settles it."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/ef62d13b-6852-4a12-a1d3-4d7e22ec1232.json b/docs/outstanding-issues-inbox/applied/ef62d13b-6852-4a12-a1d3-4d7e22ec1232.json
new file mode 100644
index 0000000000..66926af268
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/ef62d13b-6852-4a12-a1d3-4d7e22ec1232.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "ef62d13b-6852-4a12-a1d3-4d7e22ec1232",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#331",
+    "detail": "**Outcome:** one authoritative owner for the medication-report staleness problem, including its missing CI coverage. **Evidence:** on 2026-08-14,  reported the review document stale on three independently authored branches (#1947, #1949, #1950) although the document, lexicon sources, medication snapshot, and interaction index were untouched. The symptom must therefore be investigated against a clean current main rather than fixed opportunistically in unrelated work. **Scope:** this row also carries the CI evidence formerly duplicated in #333: the check is reached only at the end of  and no workflow invokes it, so CI can stay green while a local PR preflight fails. **Next:** inspect the generator and its staleness comparison against current main; if the report is genuinely stale, regenerate it in a dedicated clinical-document change, otherwise fix the comparison. In the same decision, either make the validated check part of the appropriate CI contract or move it out of the local preflight so its enforcement matches its ownership. **Stop:** do not delete or weaken the check merely to green an unrelated preflight, and do not regenerate a clinical-facing artifact without checking whether the diff changes clinical content.",
+    "source": "PR #1947, PR #1949 and PR #1950 clean-branch reproductions; PR #1942 preflight; session 2026-08-14; consolidated by PR #1956 review follow-up"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/f3b63187-c295-4f6a-8ecd-602f348835c4.json b/docs/outstanding-issues-inbox/applied/f3b63187-c295-4f6a-8ecd-602f348835c4.json
new file mode 100644
index 0000000000..ec94efd66f
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/f3b63187-c295-4f6a-8ecd-602f348835c4.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "f3b63187-c295-4f6a-8ecd-602f348835c4",
+  "createdOn": "2026-08-14",
+  "action": "done",
+  "payload": {
+    "id": "#333",
+    "outcome": "Closed 2026-08-15 as a duplicate of #331. Its clean-main and missing-CI evidence is preserved in #331, which is now the single owner of both the staleness diagnosis and the CI/local-preflight enforcement decision; no medication report was regenerated or clinical content changed."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/f825f6b9-94ec-4af1-929c-202608141941.json b/docs/outstanding-issues-inbox/applied/f825f6b9-94ec-4af1-929c-202608141941.json
similarity index 100%
rename from docs/outstanding-issues-inbox/f825f6b9-94ec-4af1-929c-202608141941.json
rename to docs/outstanding-issues-inbox/applied/f825f6b9-94ec-4af1-929c-202608141941.json
diff --git a/docs/outstanding-issues-inbox/applied/f86a3002-5019-4ae4-93fb-d01a05a7bae6.json b/docs/outstanding-issues-inbox/applied/f86a3002-5019-4ae4-93fb-d01a05a7bae6.json
new file mode 100644
index 0000000000..e2008df85e
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/f86a3002-5019-4ae4-93fb-d01a05a7bae6.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "f86a3002-5019-4ae4-93fb-d01a05a7bae6",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#308",
+    "detail": "Measured 2026-08-12 during the #147 close-out, twice, on the offline Lighthouse harness (Chromium 141): desktop /documents/search CLS **0.119**, against a committed baseline that also reads **0.119**. So this is long-standing and deterministic, not a regression — and it is above the 0.1 threshold. It sits outside #147's scope, which was mobile only, and it contradicts that row's claim that 'desktop passes everywhere: 0.016-0.097' — that range is stale. Companion desktop values from the same runs, all passing: /dsm 0.014, /forms 0.059-0.064, / 0.006, /therapy-compass 0.000. Desktop attribution completed 2026-08-14: a Playwright + PerformanceObserver(layout-shift) harness against an offline production build at 1350x940 DPR 1 recorded **0.118** CLS. This is a separate attribution measurement, not a replacement for the canonical 0.119 Lighthouse value. One first-paint+~0.3-0.5s event contributed ~99.98% of that harness total: MasterSearchHeader's composer-adoption effect portals the search composer into GlobalSearchShell's desktop slot, while the header shrinks 184px and the slot grows 0 -> 184px. This is shared desktop search-chrome timing, not page-local. Next: reserve the settled height at the adoption boundary under the one-composer/hidden-means-zero-reserve contracts, then re-measure with the same harness. Stop: do not raise the CLS budget; do not read local LCP or TBT from the loopback harness; and do not use a blanket min-height that hides the shift without matching the header reserve.",
+    "source": "Local offline verify:lighthouse runs 2026-08-12 (two runs, identical CLS); #147 close-out; lighthouse-budget.json. Attribution: session 2026-08-14, PR branch codex/visual-layout-polish; desktop CLS script adapted from scripts/measure-cls-attribution.mjs (offline, not committed)."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/f9f40594-a816-45a8-954a-3fcecf6d5d05.json b/docs/outstanding-issues-inbox/applied/f9f40594-a816-45a8-954a-3fcecf6d5d05.json
similarity index 100%
rename from docs/outstanding-issues-inbox/f9f40594-a816-45a8-954a-3fcecf6d5d05.json
rename to docs/outstanding-issues-inbox/applied/f9f40594-a816-45a8-954a-3fcecf6d5d05.json
diff --git a/docs/outstanding-issues-inbox/applied/fbfe982f-cd2f-49c9-a94e-908a99efa6b8.json b/docs/outstanding-issues-inbox/applied/fbfe982f-cd2f-49c9-a94e-908a99efa6b8.json
new file mode 100644
index 0000000000..61b0669aa9
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/fbfe982f-cd2f-49c9-a94e-908a99efa6b8.json
@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "id": "fbfe982f-cd2f-49c9-a94e-908a99efa6b8",
+  "createdOn": "2026-08-14",
+  "action": "update",
+  "payload": {
+    "id": "#331",
+    "detail": "**Outcome:** one authoritative owner for the medication-report staleness problem, including its missing CI coverage. **Evidence:** on 2026-08-14, check:medication-lexicon-report reported the review document stale on three independently authored branches (#1947, #1949, #1950) although the document, lexicon sources, medication snapshot, and interaction index were untouched. The symptom must therefore be investigated against a clean current main rather than fixed opportunistically in unrelated work. **Scope:** this row also carries the CI evidence formerly duplicated in #333: the check is reached only at the end of verify:pr-local and no workflow invokes it, so CI can stay green while a local PR preflight fails. **Next:** inspect the generator and its staleness comparison against current main; if the report is genuinely stale, regenerate it in a dedicated clinical-document change, otherwise fix the comparison. In the same decision, either make the validated check part of the appropriate CI contract or move it out of the local preflight so its enforcement matches its ownership. **Stop:** do not delete or weaken the check merely to green an unrelated preflight, and do not regenerate a clinical-facing artifact without checking whether the diff changes clinical content.",
+    "source": "PR #1947, PR #1949 and PR #1950 clean-branch reproductions; PR #1942 preflight; session 2026-08-14; consolidated by PR #1956 review follow-up"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/fc23f1ec-c597-4690-b256-2263ecf73c86.json b/docs/outstanding-issues-inbox/applied/fc23f1ec-c597-4690-b256-2263ecf73c86.json
similarity index 100%
rename from docs/outstanding-issues-inbox/fc23f1ec-c597-4690-b256-2263ecf73c86.json
rename to docs/outstanding-issues-inbox/applied/fc23f1ec-c597-4690-b256-2263ecf73c86.json
diff --git a/docs/outstanding-issues-inbox/applied/fd42e1f9-4012-4296-b7c2-102c7d199738.json b/docs/outstanding-issues-inbox/applied/fd42e1f9-4012-4296-b7c2-102c7d199738.json
new file mode 100644
index 0000000000..ae5f752687
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/fd42e1f9-4012-4296-b7c2-102c7d199738.json
@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "id": "fd42e1f9-4012-4296-b7c2-102c7d199738",
+  "createdOn": "2026-08-15",
+  "action": "add",
+  "payload": {
+    "pri": "P3",
+    "type": "task",
+    "summary": "Make the retrieval row contract's source_metadata pin structural, not data-guaranteed",
+    "detail": "rag-row-contracts.ts pins source_metadata to a JSON object via z.record(...), but documents.metadata is bare jsonb and permits arrays and scalars. Measured against the live project (sjrfecxgysukkwxsowpy) on 2026-08-15: all 2851 documents are object-typed, so nothing breaks today and no live errors exist. The guarantee is data, not schema — a future ingest path could violate it and take retrieval down for that document's chunks. Fix is either a check (jsonb_typeof(metadata) = 'object') constraint on public.documents, or loosening the pin. Every other required field in that contract is backed by a not-null constraint.",
+    "source": "PR #1946 review + live Supabase verification 2026-08-15"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/applied/fd548180-f031-44d8-bd70-24c3b03c5f21.json b/docs/outstanding-issues-inbox/applied/fd548180-f031-44d8-bd70-24c3b03c5f21.json
new file mode 100644
index 0000000000..2963919720
--- /dev/null
+++ b/docs/outstanding-issues-inbox/applied/fd548180-f031-44d8-bd70-24c3b03c5f21.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "fd548180-f031-44d8-bd70-24c3b03c5f21",
+  "createdOn": "2026-08-14",
+  "action": "cancel",
+  "payload": {
+    "requestId": "6b09c1df-5f7c-4103-af3c-aead33eafb00",
+    "reason": "Queued in error: a shell substitution resolved to the placeholder text MISSING instead of the intended detail. Replaced by the correct combined update in the same batch."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/e54f04f8-09bb-4887-b3e4-a5cd99958798.json b/docs/outstanding-issues-inbox/e54f04f8-09bb-4887-b3e4-a5cd99958798.json
new file mode 100644
index 0000000000..5d8ddfb0f8
--- /dev/null
+++ b/docs/outstanding-issues-inbox/e54f04f8-09bb-4887-b3e4-a5cd99958798.json
@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "id": "e54f04f8-09bb-4887-b3e4-a5cd99958798",
+  "createdOn": "2026-08-15",
+  "action": "done",
+  "payload": {
+    "id": "#238",
+    "outcome": "Completed on clean current main 512b8c20 with real Chromium journeys across all five required Sheet host contexts. Repository wrapper result: 5 passed in 23.8s, covering settings via ClinicalSidebar at phone widths with close/Escape, source-backed answer Sources/safety sheets with focus return, answer Sources/Clinical notes/Evidence sheets, the mobile launcher detail sheet, and the form section-navigation sheet. This is host-level browser evidence, not generic Sheet unit coverage."
+  }
+}
diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md
index a08da1fee5..3b89830149 100644
--- a/docs/outstanding-issues.md
+++ b/docs/outstanding-issues.md
@@ -78,47 +78,35 @@ removed after current-main verification; it is not missing recommended work.
 | 23 | `#102` | A3 | Operator — Supabase + Specialist | Next approved index window, after the ordering question is settled | 1–2 hours plus apply | Author the migration (operator SQL alone never reaches staging/DR/local replay), then apply → mirror `schema.sql` → regenerate drift manifest → register `required_indexes`. **Stop:** the RAG-path index is canary-gated, and ordering `fetchDocumentTitleAliasRows`'s unordered `.limit(12)` does not lift that — an imposed order can select a different twelve, so it is a second canary-gated change, not a way out of the first. The byte-identical claim was retracted. |
 | 24 | `#099` | A3 | Specialist — answer path | After `#098` | Half a day per sub-item | Remaining fixed per-request round trips: the 8 `setCachedSearch` deferrals (abort semantics + mutation window), the anonymous subject+global limiter pair (needs a new atomic RPC first), and proxy→route identity duplication. Stop before hand-authoring locking SQL. |
 | 25 | `#162` | A3 | High — frontend/UI | When starting the mode search redesign package | 0.5–1.5 days | Redesign `/tools?q=` as Compact Results Instrument (direction A): query-as-H1, one composer, dense tool rows, demote cross-mode cards, remove success-green filter banner and home hero on results. Comps in `public/mockups/mode-page-redesign-2026-07/tools-search/`. Verify phone+desktop chrome ownership and `verify:phone-chrome` / focused UI. Stop if scope expands into Tools home redesign without an explicit ask. |
-| 26 | `#163` | A3 | High — frontend/UI | After or with `#162` | 0.5–1.5 days | Redesign `/services?q=` as Progressive Referral Workflow (direction B): H1 = query (not match count), progressive shortlist/compare (no always-on decision panel or giant step rail). Comps in `public/mockups/mode-page-redesign-2026-07/services-search/`. Verify referral shortlist still works; stop before changing Services home ModeHome. |
-| 27 | `#164` | A3 | High — frontend/UI | Product confirmed Favourites is hybrid dashboard+search (no ModeHome) | 1–2 days | Redesign Favourites as one dashboard + search page: recommended Search-Led Workspace (direction B) — persistent search, sets as chips, Continue + recent + table on empty query, in-place filter on typed query. Comps in `public/mockups/mode-page-redesign-2026-07/favourites-hybrid/`. Do not reintroduce ModeHome for Favourites. Verify desktop+phone; stop before splitting into separate ModeHome routes. |
-| 28 | `#090` | A3 | High — eslint toolchain | When ESLint 10 plugin peers are compatible | blocked; revisit monthly | Upgrade the eslint ecosystem to clear remaining dev-scoped high advisories — full `npm audit` reports zero high advisories from the eslint toolchain. |
-| 29 | `#100` | A3 | Specialist — answer streaming | After offline Phase 0/1 design proof | provider-gated rollout | Buffered answer generation has no incremental verified delivery — [`verified-answer-incremental-delivery-design.md`](verified-answer-incremental-delivery-design.md) records the clinical-governance decision and staged co… |
-| 30 | `#150` | Optional | Operator — review tooling | Next CodeRabbit billing/policy decision | 30–60 min decision | CodeRabbit reviewed none of a full day's PRs; spending cap reached — the repo's second automated reviewer is either funded or acknowledged as absent, rather than appearing to review while skipping. |
-| 31 | `#165` | A2 | High — clinical UI | Next answer-home UX pass | 0.5–1 day | Adopt a consolidated answer-home notice block — the studies exist, nothing adopts them — the answer hero states its safety obligation, its scope, and its verification requirement as one block in one voice. |
-| 32 | `#168` | A3 | High — ledger architecture | With #156 / id-scheme redesign | design first | Sequential issue ids force every concurrent append to conflict — two sessions can append to this ledger at the same time without conflicting. |
-| 33 | `#169` | A3 | High — git hygiene | Next branch cleanup batch | 1–2 hours | Local branches carry work that exists on no remote — committed work is not lost when a machine or worktree is reclaimed. |
-| 34 | `#175` | A2 | Operator — clinical data + Standard | Next therapy catalogue curation window | 2–4 hours | Therapy modality is now null on all 205 records and needs curation or removal — the Therapy detail and recommend screens either show a curated modality or stop carrying the field at all. |
-| 35 | `#178` | A3 | High — PR policy | Next pr-policy change | 1–2 hours | pr-policy does not flag operational risk bundled with clinical or UI risk — a PR that mixes operational-risk paths with clinical or UI risk is called out before it merges, because squash-merging that mix destroys per-it… |
-| 36 | `#189` | A2 | Specialist — search/RAG budgets | After #098 route residual; before collapsing RPCs | 2–4 hours + canary if behaviour | Pin /api/search route-level round trips and disposition the x3 text RPC probes — a counting-proxy budget drives `POST` `/api/search` (auth/ratelimit/scope/enrichment/telemetry), and the retrieval-core finding that `matc… |
-| 37 | `#036` | Optional | Specialist — privacy/schema | When visibility model is redesigned | design + migration | No explicit `is_public` visibility flag on documents — Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the prom… |
-| 38 | `#101` | A3 | Specialist — RAG/retrieval | After #098 harness + canary approval | canary-gated | Canary-gated retrieval parallelisation candidates — metadata and memory hydration shipped in PR #1474; visual hydration, scope enumeration, typeahead caching, and universal-search coalescing remain, each behind the RAG flag and live-canary criteria. |
-| 39 | `#190` | A3 | Specialist — RAG structure | On explicit X3 go-ahead | 1 PR per extraction unit | X3: Finish rag.ts monolith decomposition — `src/lib/rag/rag.ts` is decomposed into focused modules per `docs/maturity-backlog-workorders.md` X3, with existing offline RAG contracts green. |
-| 40 | `#191` | A3 | Operator — DB + Specialist | Approved live-DB window only | provider-gated | X5: ACL-migration consolidation (provider-gated) — ACL-related migrations are consolidated per maturity work-order X5 without weakening owner-scope/RLS. |
-| 41 | `#192` | A3 | High — test coverage | Next coverage-floor pass | 0.5–1 day | X6: Raise clinical/retrieval/answer coverage floors — coverage floors for clinical, retrieval, and answer domains meet the maturity X6 targets with CI enforcing them. |
-| 42 | `#193` | A3 | High — src/lib structure | After/with X3 non-protected clusters | 1 PR per cluster | X7: Complete the remaining src/lib domain-directory reorg — remaining `src/lib` clusters sit in their domain directories per X7 follow-on to X2. |
-| 43 | `#194` | A3 | High — scripts/docs hygiene | Next scripts archive pass | 1–2 hours | L1: Archive retired backfill one-shots and dead ci-change-scope token — retired `backfill:*` one-shots and the dead `ci-change-scope` token are archived/removed with docs/script index updated. |
-| 44 | `#195` | A3 | Operator — GitHub maintainer | Maintainer UI window | 30–60 min | M1: Repo-host hardening (branch protection and required checks) — GitHub branch-protection rulesets and required checks match audit §8 / maturity M1. |
-| 45 | `#183` | A2 | Operator — Sentry + Specialist | Next approved observability window with SENTRY_AUTH_TOKEN | 1–2 hours | Create Sentry metric alert for production DB span p95 > 500ms (`span.op:db`, environment production). **Stop:** no secret printing; blocked until token/env available. |
-| 46 | `#206` | A2 | Specialist — answer UI contract | With AnswerState producer work (`#207`) | 2–4 hours | `partial_retrieval` has no app-facing producer — decide RAG contract vs UI-only mapping before AnswerCard. **Stop:** no retrieval behaviour change without RAG flag. |
-| 47 | `#209` | A3 | High — design tokens / contrast | Next Gate 1 / warning-token pass | 1–2 hours | Add contrast pair for `--warning` used as body text (VerificationNotice / DoseLine). **Gate:** design-system contrast checks. **Stop:** do not invent a new status token without TOKENS.md. |
-| 48 | `#211` | A3 | High — TypeScript strictness | Dedicated migration branch | multi-PR | Plan and start `noUncheckedIndexedAccess` migration (1266 errors); highest-risk files first. **Stop:** do not flip the flag on main without a staged plan. |
-| 49 | `#212` | A3 | High — runtime validation | After highest-risk cast inventory | multi-PR | Replace `as unknown as` and unvalidated `JSON.parse` with Zod/guards at trust boundaries. **Stop:** RAG/provider boundaries need clinical/privacy care. |
-| 50 | `#213` | A3 | High — error handling | Next fetch/stream hardening pass | 0.5–1 day | Stop swallowing fetch/stream errors with empty catches; check `response.ok`. **Stop:** do not change telemetry contracts silently. |
-| 51 | `#215` | Optional | High — image perf | Next image/PWA pass | 2–4 hours | Image-optimization basics for lightbox, PWA lifecycle, demo PNGs. **Stop:** optional until measured need. |
-| 52 | `#221` | A3 | High — design-system convergence | After `#218` cn() decision | 0.5–1 day | Converge remaining local EmptyState/LoadingState/Chip duplicates. **Stop:** not piecemeal before cn()/Chip decisions. |
-| 53 | `#222` | A3 | High — headers / search chrome | During headers redesign decision | 2–4 hours | Decide whether mode-home-template / search-results-header-band are in PageHeader scope or permanently out. **Stop:** do not flatten phone composer ownership. |
-| 54 | `#233` | A3 | High — design-system docs | Next COMPONENTS.md docs PR | 1–2 hours | Refresh section 0 maturity matrix and document FormField optionality-marker contract. **Gate:** docs checks. **Stop:** docs-only; no product behaviour change. |
-| 55 | `#234` | A3 | High — design-system docs | With answer-surface docs | 30–60 min | Document `answer-copy-payload.ts` as the clipboard contract for three surfaces. **Stop:** do not add a second copy builder. |
-| 56 | `#235` | A3 | High — design-system evidence | Next warmed local proof-shot pass | 1–2 hours | Capture missing ADOPTION.md §7 proof shots for adopted surfaces. **Stop:** not visual-baseline PNGs (`#118`); no Playwright snapshot commit. |
-| 57 | `#237` | A3 | High — design-system a11y | Before freezing Linux visual baselines (#242) | 30–60 min | Eyeball low-confidence AccessibleTable densities at 320px; MissingValue phrases must remain readable. **Gate:** visual spot-check only. **Stop:** do not abbreviate MissingValue to a dash. |
-| 58 | `#238` | A3 | High — overlays/UI | After Sheet portal default change (#1616) | 30–60 min | Visual pass for Sheet portal default on settings, sidebar, and answer overlays under OverlayRoot. **Stop:** do not revert portal default without evidence. |
-| 59 | `#239` | Optional | High — phone chrome | When phone orientation QA is available | 15–30 min | Manual phone rotation check for ResizeObserver-only phone chrome reserve. **Gate:** `verify:phone-chrome` still owns automated coverage. **Stop:** do not widen reserve heuristics without reproduction. |
-| 60 | `#240` | Optional | High — design tokens | Next design-owner review | 15–30 min | Confirm tooltip visual hard-clip asymmetry with design owner (sr-only keeps full text). **Stop:** no product change without that confirmation. |
-| 61 | `#242` | A2 | High — design-system baselines | After human review of Linux baselines | 1–2 hours | Commit approved Linux visual baselines and promote adoption not-committed → committed. **Stop:** never commit baselines from an unreviewed machine run. |
-| 62 | `#245` | A3 | High — cross-mode links | Next CrossModeLinks / analytics pass | 30–60 min | responsive-compact CrossModeLinks keeps duplicate rails in the DOM; prefer one mount or accept test double-counts. **Stop:** do not break phone-only rail contract. |
-| 63 | `#248` | A2 | Operator — Supabase + Specialist | After PR #1614 symptom repair; approved live/history window | 1–2 hours | Investigate why 20260705180000 search-health indexes were missing on live despite applied history; decide if drift checks should catch this class. **Stop:** no hosted mutation without approval. |
+| 26 | `#090` | A3 | High — eslint toolchain | When ESLint 10 plugin peers are compatible | blocked; revisit monthly | Upgrade the eslint ecosystem to clear remaining dev-scoped high advisories — full `npm audit` reports zero high advisories from the eslint toolchain. |
+| 27 | `#100` | A3 | Specialist — answer streaming | After offline Phase 0/1 design proof | provider-gated rollout | Buffered answer generation has no incremental verified delivery — [`verified-answer-incremental-delivery-design.md`](verified-answer-incremental-delivery-design.md) records the clinical-governance decision and staged co… |
+| 28 | `#150` | Optional | Operator — review tooling | Next CodeRabbit billing/policy decision | 30–60 min decision | CodeRabbit reviewed none of a full day's PRs; spending cap reached — the repo's second automated reviewer is either funded or acknowledged as absent, rather than appearing to review while skipping. |
+| 29 | `#165` | A2 | High — clinical UI | Next answer-home UX pass | 0.5–1 day | Adopt a consolidated answer-home notice block — the studies exist, nothing adopts them — the answer hero states its safety obligation, its scope, and its verification requirement as one block in one voice. |
+| 30 | `#168` | A3 | High — ledger architecture | With #156 / id-scheme redesign | design first | Sequential issue ids force every concurrent append to conflict — two sessions can append to this ledger at the same time without conflicting. |
+| 31 | `#169` | A3 | High — git hygiene | Next branch cleanup batch | 1–2 hours | Local branches carry work that exists on no remote — committed work is not lost when a machine or worktree is reclaimed. |
+| 32 | `#175` | A2 | Operator — clinical data + Standard | Next therapy catalogue curation window | 2–4 hours | Therapy modality is now null on all 205 records and needs curation or removal — the Therapy detail and recommend screens either show a curated modality or stop carrying the field at all. |
+| 33 | `#036` | Optional | Specialist — privacy/schema | When visibility model is redesigned | design + migration | No explicit `is_public` visibility flag on documents — Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the prom… |
+| 34 | `#101` | A3 | Specialist — RAG/retrieval | After #098 harness + canary approval | canary-gated | Canary-gated retrieval parallelisation candidates — metadata and memory hydration shipped in PR #1474; visual hydration, scope enumeration, typeahead caching, and universal-search coalescing remain, each behind the RAG flag and live-canary criteria. |
+| 35 | `#190` | A3 | Specialist — RAG structure | On explicit X3 go-ahead | 1 PR per extraction unit | X3: Finish rag.ts monolith decomposition — `src/lib/rag/rag.ts` is decomposed into focused modules per `docs/maturity-backlog-workorders.md` X3, with existing offline RAG contracts green. |
+| 36 | `#191` | A3 | Operator — DB + Specialist | Approved live-DB window only | provider-gated | X5: ACL-migration consolidation (provider-gated) — ACL-related migrations are consolidated per maturity work-order X5 without weakening owner-scope/RLS. |
+| 37 | `#192` | A3 | High — test coverage | Next coverage-floor pass | 0.5–1 day | X6: Raise clinical/retrieval/answer coverage floors — coverage floors for clinical, retrieval, and answer domains meet the maturity X6 targets with CI enforcing them. |
+| 38 | `#193` | A3 | High — src/lib structure | After/with X3 non-protected clusters | 1 PR per cluster | X7: Complete the remaining src/lib domain-directory reorg — remaining `src/lib` clusters sit in their domain directories per X7 follow-on to X2. |
+| 39 | `#195` | A3 | Operator — GitHub maintainer | Maintainer UI window | 30–60 min | M1: Repo-host hardening (branch protection and required checks) — GitHub branch-protection rulesets and required checks match audit §8 / maturity M1. |
+| 40 | `#183` | A2 | Operator — Sentry + Specialist | Next approved observability window with SENTRY_AUTH_TOKEN | 1–2 hours | Create Sentry metric alert for production DB span p95 > 500ms (`span.op:db`, environment production). **Stop:** no secret printing; blocked until token/env available. |
+| 41 | `#206` | A2 | Specialist — answer UI contract | With AnswerState producer work (`#207`) | 2–4 hours | `partial_retrieval` has no app-facing producer — decide RAG contract vs UI-only mapping before AnswerCard. **Stop:** no retrieval behaviour change without RAG flag. |
+| 42 | `#211` | A3 | High — TypeScript strictness | Dedicated migration branch | multi-PR | Plan and start `noUncheckedIndexedAccess` migration (1266 errors); highest-risk files first. **Stop:** do not flip the flag on main without a staged plan. |
+| 43 | `#212` | A3 | High — runtime validation | After highest-risk cast inventory | multi-PR | Replace `as unknown as` and unvalidated `JSON.parse` with Zod/guards at trust boundaries. **Stop:** RAG/provider boundaries need clinical/privacy care. |
+| 44 | `#222` | A3 | High — headers / search chrome | During headers redesign decision | 2–4 hours | Decide whether mode-home-template / search-results-header-band are in PageHeader scope or permanently out. **Stop:** do not flatten phone composer ownership. |
+| 45 | `#235` | A3 | High — design-system evidence | Next warmed local proof-shot pass | 1–2 hours | Capture missing ADOPTION.md §7 proof shots for adopted surfaces. **Stop:** not visual-baseline PNGs (`#118`); no Playwright snapshot commit. |
+| 46 | `#237` | A3 | High — design-system a11y | Before freezing Linux visual baselines (#242) | 30–60 min | Eyeball low-confidence AccessibleTable densities at 320px; MissingValue phrases must remain readable. **Gate:** visual spot-check only. **Stop:** do not abbreviate MissingValue to a dash. |
+| 47 | `#238` | A3 | High — overlays/UI | After Sheet portal default change (#1616) | 30–60 min | Visual pass for Sheet portal default on settings, sidebar, and answer overlays under OverlayRoot. **Stop:** do not revert portal default without evidence. |
+| 48 | `#239` | Optional | High — phone chrome | When phone orientation QA is available | 15–30 min | Manual phone rotation check for ResizeObserver-only phone chrome reserve. **Gate:** `verify:phone-chrome` still owns automated coverage. **Stop:** do not widen reserve heuristics without reproduction. |
+| 49 | `#240` | Optional | High — design tokens | Next design-owner review | 15–30 min | Confirm tooltip visual hard-clip asymmetry with design owner (sr-only keeps full text). **Stop:** no product change without that confirmation. |
+| 50 | `#242` | A2 | High — design-system baselines | After human review of Linux baselines | 1–2 hours | Commit approved Linux visual baselines and promote adoption not-committed → committed. **Stop:** never commit baselines from an unreviewed machine run. |
+| 51 | `#248` | A2 | Operator — Supabase + Specialist | After PR #1614 symptom repair; approved live/history window | 1–2 hours | Investigate why 20260705180000 search-health indexes were missing on live despite applied history; decide if drift checks should catch this class. **Stop:** no hosted mutation without approval. |
 
 
-<!-- issues:next-id=331 -->
+<!-- issues:next-id=344 -->
 ## Open items
 
 > **Merged-main canary update (2026-07-23, run `30018289898`):** the new structured report correctly recorded evaluated tree `c24f2e8f2d30d0c59fc1eba025d3dcd63478137e`, run/attempt identity and `cross-region-runner` latency context. Golden retrieval remained 36/36 with document/content recall 1.0 and no failed cases. The 44-case answer gate had grounded-supported and unsupported-correct rates of 1.0, but failed because `neuroleptic-side-effect-escalation` again returned one citation where two are required (citation-failure rate 0.0227). `admission-discharge-comparison` again omitted the specific AKG admission document after `comparison_source_extractive_fallback`; `admission-discharge-coverage-paraphrase` was advisory-only at 24,870 ms. Answer cost was reported as `$0.234736`. Do not retry immediately: retain this as the first structured datapoint, compare it with the scheduled 2026-07-26 report, and keep retrieval/ranking unchanged.
@@ -164,84 +152,75 @@ removed after current-main verification; it is not missing recommended work.
 | #102 | P3 | task | Apply the additive `documents` index debt (operator) | **Outcome:** bare-column `ILIKE` and the paged status scan on `documents` are index-served on hosted. `documents_title_trgm_idx` indexes a CONCATENATED expression, so the bare-column predicates in `api/documents/route.ts:193` and `rag-candidate-sources.ts:477` (RAG path) cannot use it and fall back to scanning; `search-scope.ts:271-277` sorts per page against the single-column `documents_status_idx`. **Runbook prepared 2026-07-29 — NOT applied, item stays open:** three `CREATE INDEX CONCURRENTLY` statements authored and reviewed in `docs/operator-apply-performance-latency-remediation.md` — additive, though **the "recall is byte-identical" claim was RETRACTED on 2026-07-29 review**: `fetchDocumentTitleAliasRows` (`rag-candidate-sources.ts:482`) applies `.limit(12)` with no `ORDER BY`, so a new index can change which title-alias documents feed candidate assembly. Only the documents-list use stays ordering-safe; `(status,id)` is canary-gated too — see runbook, and making that `.limit(12)` deterministic first does **not** lift the gate — an unordered `LIMIT` has no stable selection to preserve, so imposing an order can pick a different twelve and is itself an ordering behaviour change on a retrieval surface, which AGENTS.md requires a canary pair for. Sequencing the ordering fix first is worthwhile (unordered `LIMIT` on a retrieval input is latent nondeterminism regardless) but yields two canary-gated changes, not one (PR #1377 review). **Deliberately NO migration file:** an additive-index migration without a synchronized `schema.sql` mirror and regenerated drift manifest is exactly what closed PR #1312, and the mirror cannot come first because `required_indexes` in `search_schema_health()` (`schema.sql:3178`) runs against live. **Next (operator):** **author the migration first** — `supabase/migrations/` is the source of truth and `schema.sql` only a mirror, so hand-run operator SQL never reaches staging, disaster-recovery replay, or a local `supabase db reset`, and a `required_indexes` registration would fail there (PR #1377 review); follow the `20260717170000_registry_projection_cleanup.sql` idempotent pattern. **That migration must also carry the health-function change** — `required_indexes` lives inside `search_schema_health()`, which is redefined by `create or replace function` in eleven migrations (copy `20260705180000_reconcile_search_health_indexes.sql:62`); editing `schema.sql:3177` alone moves only the mirror and leaves the indexes unmonitored on hosted (PR #1377 review). Then apply concurrently, confirm `indisvalid`, mirror both the index statements and the identical function body into `schema.sql`, run `npm run drift:manifest` (Docker), and deploy the migration LAST — in that order, in one change. Expect `check:drift` to report them as unexpected between steps 1 and 2. **Rollback is three deployed phases, not the reverse of one:** retract `required_indexes` via its own `create or replace function` migration and deploy → drop concurrently live → only then deploy the `schema.sql` removal plus an idempotent forward `drop index if exists` migration, because Supabase wraps migrations in a transaction and a plain `DROP INDEX` there takes the lock the concurrent procedure exists to avoid (PR #1377 review). | `docs/audit/latency-audit-2026-07-28.md` L2-3/L2-5; `docs/operator-apply-performance-latency-remediation.md` | 2026-07-29 |
 | #117 | P2 | rec | All live mobile routes breach LCP; shared render-blocking CSS and font are the current bottleneck | **Outcome:** `/therapy-compass` mobile LCP lands near the other mobile routes instead of double them. **Measured 2026-07-30** by the new pre-merge Lighthouse budget: mobile LCP 5229 ms, TBT 612 ms, CLS 0.142, against 2123-2460 ms on every other mobile route and 826 ms on desktop — so it is client-side work under mobile CPU/network throttling, not server latency. **Cause before this PR:** `useTherapyData` fetched `/therapy-compass-data/therapies-index.json` (the stable public alias served by a Next rewrite to the thin browse index; 205 records) for the home/search/pathways screens, so the download plus JSON parse sat on the critical path before content painted. **Current split:** home now fetches `public/therapy-compass-data/therapies-home.211dab554c4ec62d.json` (136,288 bytes raw), pathways use the thin browse index, and search loads the full prose corpus (#1471). 90% of the index weight is long-form clinical prose — indications 159 KB (26%), contraindicationsOrCautions 139 KB (23%), bestUsedFor 73 KB (12%), clinicalSummary 67 KB (11%), patientPopulation 59 KB (10%), targetSymptoms 48 KB (8%) — while name, slug, category, tags and setting together are 54 KB (7%). **Remaining decision for search/pathways: rendered on the card, matched by search, or neither.** `therapy-card.tsx` references five of those prose fields and the same index feeds the search screen, so stripping fields could silently change clinical display or search recall. **Next:** settle that per-field question, then either pre-truncate prose that only feeds card display, or move search matching server-side / load prose on first keystroke. **Gate:** `check:therapy-data-index` plus the therapy Playwright journeys; re-measure with `npm run verify:lighthouse`. **Stop:** do not drop a field from the catalogue payload without confirming no card renders it and no search path matches on it. Same class as #013 (route-chunk / catalogue JSON weight), different route and now measured. | PR #1915; live Web Vitals runs 31704500966 and 31704504389; codex/performance-css-delivery | 2026-07-30 |
 | #118 | P2 | task | Adopt the remaining visual baselines; Lighthouse now gates regressions | Lighthouse half resolved in PR #1915: authorized CI refresh run 31697669596 on current main produced all 10 route/strategy cells with one pinned HeadlessChrome/151 identity. The reviewed artifact was committed, lighthouse-budget.json enforce is true, the job no longer uses continue-on-error, merge_group coverage is restored, and pr-required now fails on a selected Lighthouse failure. The 2026-08-08 and 2026-08-13 complete baselines stayed within tolerance; the latter puts mobile LCP at 2357-2388 ms and Therapy is no longer an outlier. This relative local-production gate does not close #117 deployed-origin LCP work. Remaining #118 scope: adopt the CI-generated Linux visual snapshots and promote visual-baseline only after design-owner review and stable reruns. Stop: never use developer-machine snapshots or let a workflow update its own gate. | PR #1915; CI run 31697669596 artifact lighthouse-baseline-refresh-31697669596 | 2026-07-30 |
-| #150 | P2 | issue | CodeRabbit reviewed none of a full day's PRs; spending cap reached | IN FLIGHT 2026-08-12 in PR #1836 (finalize tooling follow-through notes). Checked against the open-PR list during the full ledger sweep. Do NOT start this row while that PR is open — duplicating a queued conversion is the exact failure #292 records, and it has happened twice. Re-verify this row against main after that PR merges, and close it there rather than here. **Outcome:** the repo's second automated reviewer is either funded or acknowledged as absent, rather than appearing to review while skipping. **Evidence 2026-07-30:** CodeRabbit posted "Review limit reached … Your organization has reached its usage spending cap" on **every** PR opened that day — #1404, #1430, #1444, #1445, #1479 — reviewing none of them. Each notice renders as an ordinary bot comment, so a skimming reader sees reviewer activity where there was no review. The Codex connector was the sole substantive reviewer across those PRs and found three real defects that had survived local gates and self-review: a proxy-variable inference in #1430, an `unset` vs `unspecified` git-attribute conflation in #1444, and an earlier P1 recursive-delete on an unvalidated `--dir`. **Next:** decide whether to raise the cap, switch to label-based opt-in so the budget lands on PRs that need it, or accept single-reviewer coverage explicitly. **ESCALATED 2026-07-30 — both reviewers are now capped, so this row's premise no longer holds.** The analysis above rests on the Codex connector being the surviving reviewer. On PR #1505 the Codex connector posted "You have reached your Codex usage limits for code reviews" while CodeRabbit posted its own spending-cap notice on the same PR. **That PR therefore received zero automated review**, and so will anything opened while both caps hold. This is not a second issue — it is the same one, with the fallback removed. **Why it is worth more than a status note:** on 2026-07-30 the single Codex finding on PR #1459 was correct and changed the outcome — it showed that a claimed `LoadingPanel` verification had matched `ModeHomePageSkeleton` instead, which caused `#105` to be closed on wrong evidence. Local gates did not catch it and neither did self-review; the review did. A window in which neither reviewer runs is a window in which that class of error lands. **Next:** the three options above now need deciding rather than deferring, because "accept single-reviewer coverage" is no longer one of them. Until then, treat any PR merged during a cap window as locally-gated only. **Stop:** do not read a CodeRabbit *or* Codex comment as a completed review without checking it is not a usage-limit notice — during this window both bots posted comments on every PR while reviewing none of them. | PRs #1404/#1430/#1444/#1445/#1479; `.coderabbit.yaml` | 2026-07-30 |
-| #162 | P2 | task | Redesign Tools search results state (Compact Results Instrument) | IN FLIGHT 2026-08-12 in PR #1839 (three runnable directions for the Tools search results state). Checked against the open-PR list during the full ledger sweep. Do NOT start this row while that PR is open — duplicating a queued conversion is the exact failure #292 records, and it has happened twice. Re-verify this row against main after that PR merges, and close it there rather than here. **Outcome:** `/tools?q=` is a committed results page: query-as-H1, one composer, dense tool rows; cross-mode demoted; no home hero / green filter banner / dual H1. **Product pick:** direction A from comps in `public/mockups/mode-page-redesign-2026-07/tools-search/`. **Next:** implement A on production Tools search; verify desktop+phone chrome ownership. **Stop:** do not redesign Tools home in the same PR unless asked. Renumbered after `main` took `#161` for mockup hover-token residue. | session 2026-07-31 mode-page design audit | 2026-07-31 |
-| #163 | P2 | task | Redesign Services search results (Progressive Referral Workflow) | **Outcome:** `/services?q=` uses query-as-H1 (not match-count), progressive shortlist/compare, no always-on decision panel or giant step rail. **Product pick:** direction B from comps in `public/mockups/mode-page-redesign-2026-07/services-search/`. **Next:** implement B; keep referral shortlist behaviour. **Stop:** do not change Services ModeHome in the same PR. | session 2026-07-31 mode-page design audit | 2026-07-31 |
-| #164 | P2 | task | Redesign Favourites as hybrid dashboard + search (no ModeHome) | **Outcome:** `/favourites` is one dashboard+search workspace; empty query shows Continue/recent/sets/table; typed query filters in place; no ModeHome hero. **Product pick:** Search-Led Workspace (direction B) from comps in `public/mockups/mode-page-redesign-2026-07/favourites-hybrid/`. User rejected ModeHome for Favourites. **Next:** implement B; retire command-library marketing H1 and redundant dual search. **Stop:** do not reintroduce ModeHome or a separate Favourites home route. | session 2026-07-31 mode-page design audit; user Favourites hybrid decision | 2026-07-31 |
+| #150 | P2 | issue | CodeRabbit reviewed none of a full day's PRs; spending cap reached | IN FLIGHT annotation retired 2026-08-14: PR #1836 has merged, so the do-not-start note is stale and was blocking rather than protecting. The row itself is NOT code-verifiable from a container — CodeRabbit's spending cap is an account/billing state, so confirming whether the cap still suppresses reviews needs the operator's CodeRabbit dashboard. Next: check the subscription's review quota and either raise it or record the accepted coverage gap. Keeping open pending that operator read. | PRs #1404/#1430/#1444/#1445/#1479; `.coderabbit.yaml` | 2026-07-30 |
+| #162 | P2 | task | Redesign Tools search results state (Compact Results Instrument) | IN FLIGHT confirmed still accurate 2026-08-14: PR #1839 is the one PR in this cluster that has NOT merged (no merge commit on origin/main; refs/pull/1839/merge still exists, which GitHub keeps only for open PRs). Every sibling in the same sweep — #1835 #1836 #1837 #1840 #1841 #1842 — has landed and their rows are archived or re-scoped. Do not start this row; it is genuinely in flight. | session 2026-07-31 mode-page design audit | 2026-07-31 |
 | #165 | P2 | task | Adopt a consolidated answer-home notice block — the studies exist, nothing adopts them | **Outcome:** the answer hero states its safety obligation, its scope, and its verification requirement as one block in one voice. **Detail:** `/mockups/warning-consolidation` (PR #1437) diagnoses today's three stacked notices — the APP-5 privacy warning at 11px muted, a bare `/privacy` link, and an accent-blue `ShieldCheck` capability claim at 14px semibold — and shows the hierarchy is inverted: the least important line is the loudest, and two shields with opposite meanings sit ~40px apart. Three consolidations are drawn at 1440px and 390px. Recommended: **02 Safety card** on the hero (obligation on a warning-tinted top row, everything descriptive in one grey voice below) and **01 Assurance bar** on the docked composer — the same content model at two densities, so one component with a `density` prop covers both. **This is a governance change, not just a design one:** `PrivacyInputNotice` is the single site-wide APP-5 line and renders on the answer, documents and calculators composers, so all three move together; `tests/privacy-ui.test.ts`, `tests/ui-accessibility.spec.ts` and the phone-chrome reserve coverage all assert against the current markup and must change in the same commit; and the PR will need a full `## Clinical Governance Preflight` (the mockup PR correctly did not). **Third study (before/after):** `/mockups/answer-home-proposal` draws the concrete D-direction proposal as a full hero before/after rather than an isolated notice. **Second study (words only):** `/mockups/warning-line` answers a narrower brief — no icon, border, tint or background, one line where width allows. Six variants A-F; line counts measured from the rendered DOM, not asserted. Only B (middot clauses), D (obligation + verify) and F (compressed obligation) hold one line at desktop width, and **none fit one line on a 390px phone while the pinned APP-5 sentence stays verbatim** — 46 characters of obligation plus the 27-character link exceeds the ~60 available at 11px. Recommended there: **D**, the only compliant variant that is both one line and keeps weight-only hierarchy, reached by dropping the scope claim (a capability statement already visible on the answer itself). F fits best but rewrites the pinned obligation to \|No patient-identifiable information.\| and so needs the same privacy sign-off as `#166` plus a matching `tests/privacy-ui.test.ts` update. **Status:** PR #1437 was closed unmerged on 2026-07-30 as a deliberate pause during an owner-authorized ordered merge sweep, to be reopened at its queued place; branch `claude/warning-consolidation-mockups-09jyj7` is preserved and merged onto current `main`; these follow-up rows have been renumbered on each sync because `main` kept claiming the next ids while the PR was paused; the superseded numbers are deliberately not listed, since they now belong to unrelated rows. **Next:** decide block (02 + 01) versus line (D) direction, get wording sign-off for `#166`, then implement behind one component and run `verify:phone-chrome` before `verify:ui`. | session 2026-07-30; PR #1437; `/mockups/warning-consolidation`; `/mockups/warning-line` | 2026-07-30 |
-| #168 | P2 | rec | Sequential issue ids force every concurrent append to conflict | **Outcome:** two sessions can append to this ledger at the same time without conflicting. **Detail:** ids are allocated read-modify-write against the `issues:next-id` marker inside the file being edited, so two branches both read N and both write N. Because duplicate ids are unacceptable, a union merge driver is unsafe — .gitattributes says so explicitly — which is why this file deliberately has no driver and every overlapping append conflicts by hand. Manual resolution is where rows get dropped: PR #1490 was closed during one and took the only record of four snapshots with it (#152), and ids were renumbered under in-flight work three times in one session (#154, #155). The new writer (`scripts/outstanding-issues.mjs`) removes the mechanical errors but explicitly not this one. **Next:** replace the counter with a collision-free id (ULID, timestamp+suffix, or a content hash), keeping a short display number derived at render time if `#151` reads better than 01JQ…; then a union driver becomes safe to reinstate and concurrent appends stop conflicting at all. A larger variant is one row per file under `docs/issues` with the table generated, which the repo already does for `site-map.md`. **Stop:** do not reinstate `merge=union` while ids are sequential — that combination was tried in PR #1416 and removed for duplicating rows and the marker. Renumbered from this PR's original `#159` because `main` already used `#159` for the duplicated test-file-list finding. | session 2026-07-31; .gitattributes; #154/#155; PR #1524 sync | 2026-07-31 |
+| #168 | P2 | rec | Sequential issue ids force every concurrent append to conflict | DESIGNED 2026-08-14 in PR #1944 — docs/ledger-id-scheme-proposal.md. Design only, nothing implemented, so this row stays open. Recommends a ULID as the durable id with a short derived display form, the property that matters being that the display form is derived rather than stored: a clash there is a rendering fix (take one more character) rather than a renumber. UUIDv7 noted as an equally good fit. Records why timestamp-plus-slug and content hashes were rejected — the slug wants to change when a row is re-scoped, which is renumbering under another name, and a content hash is neither sortable nor stable. Migration is additive because the 314 existing sequential ids keep their numbers permanently: they are cited across the ledger, docs/branch-review-records/, AGENTS.md, the skills and the commit history, so renumbering would invalidate every citation while producing exactly the churn this row exists to end. Four steps, widening validators before allocation changes, with every current #NNN assumption enumerated by file and symbol (ledger-inbox.mjs validateRequest twice; check-outstanding-issues.mjs ID_CELL, the MARKER parse, the nextId-above-highest assertion and its padStart formatting; outstanding-issues.mjs allocator; issues-report.mjs and the issues-surface hook). Stop unchanged and now load-bearing on step ordering: do not reinstate merge=union while ids are sequential — it only becomes safe after the marker is gone. | session 2026-07-31; .gitattributes; #154/#155; PR #1524 sync | 2026-07-31 |
 | #169 | P2 | issue | Machine-local branches, snapshots, worktrees, and dev servers remain at risk | **CONSOLIDATED 2026-08-13 from #152, #236, and #260 before those source rows are archived by PR #1920. Outcome:** every branch, snapshot, worktree, or process that exists on only one machine remains recoverable and receives an explicit owner disposition before machine or worktree cleanup. **Original unpushed branches:** `claude/clinical-kb-design-system-333a69` was verified to contain 57 files / +4069 at tip `feat(design-system): v2 token layer, 26 components, browser-crash fix`, including `.design-sync/previews/*.tsx` absent from main. Also inspect `design-sync-db0a54`, `fable-implementation-fc937c`, `frosty-mayer-2c6167`, and `issues-133-evidence`. **Preserved WIP snapshots from #152, all unpushed, unreviewed, and unverified:** `codex/reconcile-immediate-20260730` at `748ef018f` (21 files, +395/-200 across 19 tracked, including `.github/workflows/ci.yml`, `package.json`, and `docs/scripts-index.md`); `codex/document-results-mockup-20260730` at `5dbd9f965` (8 tracked files, +13/-3, plus an untracked `document-search-results/page.tsx` mockup); `codex/chat-ledger-triage-d344` at `b7eae51a4` (`docs/outstanding-issues.md` +59/-61); and `claude/section-spy-browser-coverage` at `d949859c3` (`tests/ui-smoke.spec.ts` +51). **Wave-5 inventory from #236:** content-compare `claude/ds-v2-builder-a` and `claude/ds-v2-builder-b` with current `origin/main` because squash merges make ancestry checks unreliable; retain the associated process evidence for ports 3258 (`Database-wt-ds-v2-capture`), 3135 (`Database-wt-ds-v2-correctness`), and 3672 (`Database-wt-ds-v2-empty-state-heading`) until the owner confirms each process is no longer needed. **Stranded Sentry work from #260:** on the originating Windows machine, inspect branch `claude/cloud-pr-loop-prevention-bc052b` commits `c3c9d6a31` and `abbcdc8e9` (~389 lines across `src/sentry.*.config.ts`, `src/lib/env.ts`, `src/lib/supabase/client.tsx`, and `src/components/ui-primitives.tsx`) plus the same four uncommitted files in `.claude/worktrees/pensive-borg-6be2f0`; content-compare them with remote branches `claude/sentry-nextjs-sdk-setup-2v24q5` and `cursor/sentry-nextjs-sdk-7cee`, then record whether the work is unique, remotely preserved, or proven superseded. **Verification rule:** do not use `git rev-list` counts, three-dot diff, or ancestry alone to declare squash-merged work represented; verify the branch-added files or content against current main. **Cloud-session stop:** fresh cloud containers cannot observe the originating machine's local branches, worktrees, or processes, so never close this row from a cloud inventory that reports them absent. **Next:** complete and record each disposition from the originating machine. **Stop:** retain every listed branch, snapshot, worktree, and process record until content proof and owner disposition exist. | sessions 2026-07-30/31 and 2026-08-04/07; #152/#169/#236/#260; PR #1920 review | 2026-07-31 |
 | #175 | P2 | task | Therapy modality is now null on all 205 records and needs curation or removal | VERIFIED CORRECT 2026-08-12 — re-checked against merged main during the full ledger sweep and left unchanged: src/data/therapies-source.json holds 205 records and 0 carry a modality value, exactly as described. This stamp exists so a later reader can tell "checked and still true" from "never looked at"; the two were indistinguishable before. **Outcome:** the Therapy detail and recommend screens either show a curated modality or stop carrying the field at all. **Detail:** the source catalogue derived `modality` from each record's own tag list — all 205 records had one, every value was also present in that record's `tags`, and the whole catalogue collapsed to CBT/ACT/DBT. It mislabelled the treatments it could not describe: ECT and rTMS as "ACT", Psychoanalysis and Psychodynamic Psychotherapy as "CBT", MBT and TFP as "DBT". Pre-existing on main, surfaced by the PR #1489 review. The generator emits it only when the source curates a value that is not already a tag, which today means null for 205/205 on the index projections *and* the full catalogue the detail/recommend screens load (`catalogue: "full"`), so the two chips (`detail-screen.tsx:49`, `recommend-screen.tsx:115`) never render and `select.ts:117` contributes no same-modality point. Removal was provably search-neutral: `src/lib/therapies.ts` scores with boolean `haystack.includes(token)`, not term frequency, and every modality value was already contributed by `tags.join(" ")` in the same haystack. **Next:** one of two — curate real modality values in `src/data/therapies-source.json` (clinical work, needs the psychiatrist), or drop the field from `types.ts`, `src/lib/therapies.ts`, the two chips and `select.ts`. **Stop:** do not reinstate the tag-derived value to make the chips reappear; a guess rendered as curated fact is the defect. `tests/therapy-compass-pathways.test.ts` pins the echo invariant on both the index and the full catalogue asset. Renumbered from this PR's original `#169` because `main` claimed `#169`–`#174` while the branch was open. | PR #1489 review remediation; PR #1532; session 2026-07-31 | 2026-07-31 |
-| #178 | P2 | rec | pr-policy does not flag operational risk bundled with clinical or UI risk | IN FLIGHT 2026-08-12 in PR #1837 (harden verification & PR policy guards). Checked against the open-PR list during the full ledger sweep. Do NOT start this row while that PR is open — duplicating a queued conversion is the exact failure #292 records, and it has happened twice. Re-verify this row against main after that PR merges, and close it there rather than here. **Outcome:** a PR that mixes operational-risk paths with clinical or UI risk is called out before it merges, because squash-merging that mix destroys per-item revert. **Detail:** `classifyPullRequestFiles` already computes `operationalRisk`, `clinicalRisk`, `ragRanking` and `ui` independently, but nothing reacts to the combination. AGENTS.md's "PR bundling" section forbids bundling anything once `operationalRisk` is true; the classifier is where that could be enforced. PR #1489 is the worked example: 33 files spanning `.github/workflows/ci.yml`, both Dockerfiles, a rewrite of the bundle-budget gate, a phone-chrome scroll change and a therapy data restructure, merged as one squash (945148251). Reverting any single item now means hand-reverting hunks out of the squash commit, because the branch commits are unreachable. The remediation PR for that review repeats the pattern on a smaller scale (clinical data plus a one-line ci.yml timeout), which is why this is a recommendation rather than a hard gate — the right severity is probably a warning that names the mixed classes, not a merge block. **Next:** emit an advisory line from `evaluatePullRequestPolicy` when `operationalRisk` coincides with `clinicalRisk` or `ui`, listing which paths drove each; decide separately whether it ever blocks. Cover it in the `--self-test` block. **Stop:** do not make it a hard failure in the same change that introduces it — land the signal first and see how often it fires. Renumbered from this PR's original `#172`. | PR #1489 review remediation; PR #1532; session 2026-07-31 | 2026-07-31 |
 | #183 | P3 | task | Create Sentry metric alert for production DB span p95 > 500ms | **DEPRIORITISED 2026-08-12 (yield review against current main).** A production DB p95 latency alert for a system with one user; the alert has nobody to wake. Revisit alongside #027 when real usage exists. Still blocked 2026-08-01 closeout: SUPABASE_ACCESS_TOKEN and SENTRY_AUTH_TOKEN missing from session env; Sentry MCP OAuth can list/get alerts but has no create tool; browser hits login wall; no metric rules exist yet on clinibase-xz. Create Metric Alert: p95(span.duration), filter span.op:db, environment production, threshold >500ms, notify Active Members. Provide SENTRY_AUTH_TOKEN in session to finish via sentry alert metrics create. | session 2026-07-31 db-query-perf follow-up | 2026-07-31 |
-| #189 | P2 | task | Pin /api/search route-level round trips and disposition the x3 text RPC probes | **Outcome:** a counting-proxy budget drives `POST` `/api/search` (auth/ratelimit/scope/enrichment/telemetry), and the retrieval-core finding that `match_document_chunks_text_v2` and `match_document_table_facts_text_v2` each issue three times per search is either documented as intentional or collapsed under the RAG canary gate. **Source:** residual next actions on `#098` after answer-path and retrieval-core budgets landed. **Next:** (a) route-level budget following `tests/answer-route-preamble.test.ts`; (b) decide probe vs collapse — behaviour change needs RAG flag + canary. **Stop:** do not change retrieval assembly without approval. | session 2026-07-31; #098 residual; tests/search-round-trip-budget.test.ts | 2026-07-31 |
 | #190 | P3 | task | X3: Finish rag.ts monolith decomposition | **DEPRIORITISED 2026-08-12 (yield review against current main).** Structural churn on the most safety-critical and most protected file in the repo, with no user-facing benefit and real behaviour-drift risk on a live-validated clinical answer path. Do the extractions opportunistically when a feature change already requires being inside a region, not as a standalone project. VERIFIED CORRECT 2026-08-12 — re-checked against merged main during the full ledger sweep and left unchanged: src/lib/rag/rag.ts measures 4,362 lines — still the monolith this row describes; the decomposition has not started. This stamp exists so a later reader can tell "checked and still true" from "never looked at"; the two were indistinguishable before. **Outcome:** `src/lib/rag/rag.ts` is decomposed into focused modules per `docs/maturity-backlog-workorders.md` X3, with existing offline RAG contracts green. **Status:** IN PROGRESS (DocumentViewer/Dashboard extractions done; rag.ts remains). **Next:** continue safe extractions only with the RAG flag before editing protected surfaces; one verified draft PR per unit. **Stop:** no behaviour change without canary when retrieval/answer paths move. | docs/maturity-backlog-workorders.md X3; #086 | 2026-07-31 |
 | #191 | P3 | task | X5: ACL-migration consolidation (provider-gated) | **Outcome:** ACL-related migrations are consolidated per maturity work-order X5 without weakening owner-scope/RLS. **Next:** DB-owner approved window only; live-DB provider confirmation required before apply. **Stop:** no hosted apply from an agent session without explicit approval. | docs/maturity-backlog-workorders.md X5; #086 | 2026-07-31 |
 | #192 | P3 | task | X6: Raise clinical/retrieval/answer coverage floors | **Outcome:** coverage floors for clinical, retrieval, and answer domains meet the maturity X6 targets with CI enforcing them. **Next:** set floors from current honest baselines; expand tests only where gaps are real. **Stop:** do not lower floors to pass. | docs/maturity-backlog-workorders.md X6; #086 | 2026-07-31 |
 | #193 | P3 | task | X7: Complete the remaining src/lib domain-directory reorg | **DEPRIORITISED 2026-08-12 (yield review against current main).** Mechanical directory moves with import-graph risk and no user-facing benefit. Same reasoning as #190: fold into work already touching the files. VERIFIED CORRECT 2026-08-12 — re-checked against merged main during the full ledger sweep and left unchanged: Six domain directories exist under src/lib (extractors, observability, rag, supabase, validation, webhooks); the reorg is genuinely partial, as the row says. This stamp exists so a later reader can tell "checked and still true" from "never looked at"; the two were indistinguishable before. **Outcome:** remaining `src/lib` clusters sit in their domain directories per X7 follow-on to X2. **Next:** move non-protected clusters first; answer/retrieval clusters need the RAG flag. **Stop:** no drive-by behaviour edits inside moves. | docs/maturity-backlog-workorders.md X7; #086 | 2026-07-31 |
-| #194 | P3 | task | L1: Archive retired backfill one-shots and dead ci-change-scope token | VERIFIED CORRECT 2026-08-12 — re-checked against merged main and left open: Still open: five backfill one-shots remain under scripts/ (backfill-document-covers.mjs, backfill-document-tags.ts, backfill-enrichment.ts, backfill-gold-document-labels.ts, backfill-smart-index.ts). No dead ci-change-scope token was found, so that half may already be gone — confirm before archiving the row. **Outcome:** retired `backfill:*` one-shots and the dead `ci-change-scope` token are archived/removed with docs/script index updated. **Status:** IN PROGRESS (#1033 archived m13/july8; backfills still open). **Next:** finish backfill archive + token cleanup in a docs/scripts PR. **Stop:** do not break CI classifiers. | docs/maturity-backlog-workorders.md L1; #086 | 2026-07-31 |
 | #195 | P3 | task | M1: Repo-host hardening (branch protection and required checks) | **Outcome:** GitHub branch-protection rulesets and required checks match audit §8 / maturity M1. **Next:** maintainer GitHub UI work; not a repo-file change. Record evidence in the ledger when done. **Stop:** agents must not weaken required checks. | docs/maturity-backlog-workorders.md M1; #086 | 2026-07-31 |
 | #206 | P2 | task | AnswerState partial_retrieval has no app-facing producer | VERIFIED CORRECT 2026-08-12 — re-checked against merged main during the full ledger sweep and left unchanged: `partial_retrieval` is declared in src/lib/answer-state-types.ts:63 and handled in answer-clipboard.ts:75, but nothing in src/app or the retrieval path produces it — still no app-facing producer, as the row says. Do not synthesise it from candidate counts. This stamp exists so a later reader can tell "checked and still true" from "never looked at"; the two were indistinguishable before. PR-E step 0 found nothing in the client payload names which expected sources were unavailable (retrievalDiagnostics = candidate counts; conflictsOrGaps = prose). RetrievalStateBanner supports the state but PR-J adoption can only emit ready/stale_evidence/source_only. Next action: decide whether a separate RAG contract PR should add a named missing-source signal (governance preflight + RAG impact line + offline eval); until then do not synthesise the state from counts. Pinned by tests/answer-state-contract.test.ts and SPEC 13 / COMPONENTS 2. | PR-E step 0, session 2026-08-02 | 2026-08-02 |
-| #209 | P3 | task | DS V2 Gate 1: add contrast pair for --warning used as body text | IN FLIGHT 2026-08-12 in PR #1841 (adds an explicit --warning body-text contrast assertion in tests/design-token-contract.test.ts). Checked against the open-PR list during the full ledger sweep. Do NOT start this row while that PR is open — duplicating a queued conversion is the exact failure #292 records, and it has happened twice. Re-verify this row against main after that PR merges, and close it there rather than here. VerificationNotice's caution variant and DoseLine's overdue label use --warning at text tier — the only place a status hue is used as body-text colour rather than a --text-* token. Gate 1's contrast checking must add that pair explicitly rather than assuming the text tiers cover it. Also note: the logged-once Sets in missing-value, date-display, verification-notice, answer-state and retrieval-state-banner are module-level, so on the server they are per-process and unbounded; a persistent data defect logs once at boot then is swallowed. Acceptable while unregistered. | clinical-governance-reviewer P3 findings on PR 6; recorded in docs/design-system/SPEC.md PR 6 clinical review note | 2026-08-02 |
-| #210 | P2 | task | npm run ensure generates .next/dev types that break typecheck and every Playwright build | RE-SCOPED AGAIN 2026-08-13 (re-filed: the 2026-08-12 correction was lost when PR #1880 landed under the inbox architecture without a request being written for it). Half of this row is already fixed and its prescribed fix is REFUTED — do not apply the first suggestion. (1) FIXED: `npm run typecheck` runs `tsconfig.typecheck.json` (added in 450690f citing this row), which sets its own include and excludes `.next/**`; verified green with `.next/dev/types/validator.ts` present. (2) REFUTED: dropping `.next/dev/types/**/*.ts` from tsconfig.json does NOT hold. Next 16 emits that glob itself — `getTypeDefinitionGlobPatterns` (node_modules/next/dist/lib/typescript/type-paths.js) adds both `.next/types` and `.next/dev/types` deliberately 'to avoid tsconfig churn when switching between dev/build modes', and `writeConfigurationDefaults` adds a missing glob back when Next reads the root config directly. Deleting the line only re-creates an uncommitted change. (3) STILL OPEN, narrower than originally written: `scripts/run-playwright.mjs` writes an isolated tsconfig with `extends: '../../tsconfig.json'` and no include of its own, so it inherits the repo-root globs. The recorded `tsc --showConfig` probe resolved `../../.next/dev/types/**/*.ts`, and `--listFilesOnly` pulled in the root dev types including validator.ts. Next's API checker filters dev types with `getDevTypesPath`, but the default `experimental.useTypeScriptCli: true` path uses `runTypeCheckCli` to invoke `tsc --project` against the child config, so it honours the inherited include verbatim. Next: give the isolated tsconfig its own include/exclude (its run root is `.next-playwright/<runId>`, not under `.next/`, so excluding the repo-root `.next` keeps the run's own dist types). NOT PROVEN end-to-end: the failing Playwright build was not reproduced. Correcting the previous explanation, `next build` does not mutate this child config: Next 16.3 `writeConfigurationDefaults` returns immediately when the parsed config contains `extends` or `references`, and this config always contains `extends`. Confirm the remaining inherited-include hypothesis with one focused `verify:ui` build before and after the child include/exclude change, and hash the child tsconfig immediately before and after the build to prove it remains byte-identical. Stop: do not remove typecheck from the gate, and do not retry the include deletion. | session 2026-08-02 /ledger sweep; docs/review-findings-2026-08-02.md | 2026-08-02 |
-| #211 | P3 | task | Plan and start the noUncheckedIndexedAccess migration | **DEPRIORITISED 2026-08-12 (yield review against current main).** 1,266 sites, each a local judgment, and no open ledger row traces a defect to unchecked indexed access. Real hardening, but speculative against this repo's measured failure history, and the diff conflicts with every open PR. Do it in scoped batches after the clinical and CI-trust work. VERIFIED CORRECT 2026-08-12 — re-checked against merged main during the full ledger sweep and left unchanged: `noUncheckedIndexedAccess` is absent from tsconfig.json — the migration has not begun. This stamp exists so a later reader can tell "checked and still true" from "never looked at"; the two were indistinguishable before. Enable noUncheckedIndexedAccess in a branch and remediate the 1,266 errors, starting with the 15-20 highest-risk source files. Hot spots include worker/main.ts:901-942, src/lib/rag/rag-extractive-answer.ts, and src/lib/answer-verification.ts. Prefer ?. or ?? guards, or non-null assertions only where invariants are provable. Re-run npm run test and npm run typecheck before merge. See docs/review-findings-2026-08-02.md section 6. | session 2026-08-02 /ledger sweep — docs/review-findings-2026-08-02.md | 2026-08-02 |
-| #212 | P3 | task | Replace as unknown as casts and unvalidated JSON.parse with Zod or runtime guards | **DEPRIORITISED 2026-08-12 (yield review against current main).** 40 casts at trust boundaries. Same reasoning as #211: worth doing, no measured defect traces to it, and it competes with clinical work for review attention. VERIFIED CORRECT 2026-08-12 — re-checked against merged main during the full ledger sweep and left unchanged: 40 `as unknown as` casts remain under src/ — the row's population is intact. This stamp exists so a later reader can tell "checked and still true" from "never looked at"; the two were indistinguishable before. 48 as unknown as casts and ~24 unvalidated JSON.parse calls across src/ trust Supabase, OpenAI, localStorage, file metadata and extraction boundaries. Start with src/lib/rag/rag.ts and src/app/api/* routes, mirroring existing Zod use in src/lib/validation/body.ts and src/lib/extractors/document.ts. See docs/review-findings-2026-08-02.md sections 2.2, 2.3 and 8. | session 2026-08-02 /ledger sweep — docs/review-findings-2026-08-02.md | 2026-08-02 |
-| #213 | P2 | task | Stop swallowing fetch and stream errors with empty catch handlers | SCOPE RE-MEASURED 2026-08-12 on merged main: only **3** empty catch handlers remain under src/ (`catch {}` / `catch (e) {}`), down from the audit population this row was opened against. The principle is unchanged and the remaining three still need dispositioning — each should either handle, log through the observability path, or carry a comment saying why swallowing is correct — but this is now a small, closeable job rather than a sweep. Companion rows measured in the same pass for sequencing: #212 has 40 `as unknown as` casts left, #211's `noUncheckedIndexedAccess` is still absent from tsconfig.json. Do the three catches first; it is the cheapest of the three and no longer blocked behind the other two. | session 2026-08-02 /ledger sweep — docs/review-findings-2026-08-02.md | 2026-08-02 |
-| #215 | P3 | task | Add image-optimization basics for lightbox, PWA lifecycle and demo PNGs | **Outcome:** two of the four image-only findings from the 2026-08-02 audit are shipped; two remain open for an explicit implementation-or-drop decision. **RESTATED 2026-08-13 after inspection against main 2d270392 — two of the four items already shipped and the row no longer describes them as open.** DONE: src/components/clinical-dashboard/image-lightbox.tsx carries decoding="async" (Phase 0, PR #1660), asserted by tests/signed-image.dom.test.tsx. DONE: SignedImage has the priority prop for above-fold evidence — it also skips the IntersectionObserver deferral entirely — and document viewer Phase 3 (PR #1772) added the other half of that pair: an explicit fetchPriority of high when priority is set and low otherwise, so a deferred rail figure does not contend with the page's own above-the-fold work. The document rail additionally passes a 240px observer root margin against the shared 640px default. REMAINING, both confirmed by inspection rather than inferred: (a) src/components/pwa-lifecycle.tsx still has no decoding attribute; (b) public/demo-documents/ still contains no .webp — the PNGs are ~80 KB each and served as-is, so the conversion with a PNG fallback has not been done. **Next:** apply decoding=async in pwa-lifecycle.tsx, and either convert the demo PNGs to WebP with a PNG fallback or record that an ~80 KB synthetic demo asset is not worth the build step. **Stop:** do not treat this row as covering the broader performance findings — those live under #016, #013, #117 and #147. | session 2026-08-02 /ledger sweep — docs/audit/performance-image-cwv-audit-2026-08-02.md | 2026-08-02 |
-| #221 | P3 | task | Local EmptyState, LoadingState and Chip duplicates still unconverged after PR-J | IN FLIGHT 2026-08-12 in PR #1841 and #1842 (cn()/LinkAction contracts and the EmptyState/Chip convergence). Checked against the open-PR list during the full ledger sweep. Do NOT start this row while that PR is open — duplicating a queued conversion is the exact failure #292 records, and it has happened twice. Re-verify this row against main after that PR merges, and close it there rather than here. PR-J converged what it could inside its allowlists and left four known duplicates, each blocked for a stated reason rather than missed. therapy-compass/ui.tsx defines its own LoadingState AND its own EmptyState used across nine screens (whole-module job, not a one-call-site conversion). mode-home-template.tsx ModeHomeStatusNotice is an EmptyState duplicate that four catalogue homes delegate to, which is why those four files show no diff. differentials-home.tsx has a local two-density Chip blocked by the cn() tailwind-merge gap. favourites-command-library-page.tsx SmallChip is driven by an eight-entry type-token map that Chip's five-tone vocabulary cannot express. Next action: take these as one convergence PR after the cn() decision lands, not piecemeal. Found during PR-J adoption, 2026-08-03. | session 2026-08-03 (PR-J Wave 5, Builder B) | 2026-08-02 |
+| #211 | P3 | task | Plan and start the noUncheckedIndexedAccess migration | **DEPRIORITISED 2026-08-12 (yield review against current main), and that judgment still holds** — each site is a local judgment, no open ledger row traces a defect to unchecked indexed access, and the diff conflicts with every open PR. Do it in scoped batches after the clinical and CI-trust work. This update carries that conclusion forward rather than replacing it; what has changed is that the batches now exist on paper and the count was wrong. **RE-MEASURED AND PLANNED 2026-08-14 in PR #1944.** The staged plan is docs/no-unchecked-indexed-access-migration-plan.md; the migration has NOT started and tsconfig.json is unchanged, so this row stays open and stays deprioritised. Measured against main at d47aa6d rather than reusing the 2026-08-02 figure: **1,445 errors across 269 files, up from 1,266**. The drift is itself a finding — the flag is off, so nothing stops new unchecked indexing landing, and any plan built on the stale count under-scopes. The measurement also reshapes the job in a way that supports doing it in batches: tests/ (713) plus design-scratch mockups (237) are two-thirds of the population and carry no production consequence, so the genuinely risky remainder is about 500 errors, not 1,445. Shape is 71 percent TS2532/TS18048, which a guard fixes; the 368 TS2345/TS2322 need a real decision about what the absent case means. Hot spots unchanged and confirmed: answer-verification.ts (41), rag-extractive-answer.ts (23), worker/main.ts (23), evidence.ts (19). Six stages, cheapest first, each flagged mechanical or manual with its own gate. Key constraint the plan records: noUncheckedIndexedAccess is a whole-project option and narrowing include does not isolate a directory, because TypeScript still reports errors in every transitively imported file — so the flag flips exactly once in the final PR and intermediate stages are verified by a baseline ratchet in the shape of scripts/design-system-contract-baseline.json. Stage 6 touches src/lib/rag/**, so the plan writes out the flag-before-editing, RAG impact line, and live-canary obligations. Stop unchanged: do not flip the flag on main ahead of the final stage. | session 2026-08-02 /ledger sweep — docs/review-findings-2026-08-02.md | 2026-08-02 |
+| #212 | P3 | task | Replace as unknown as casts and unvalidated JSON.parse with Zod or runtime guards | RAG-surface tranche implemented via PR #1946: new src/lib/rag/rag-row-contracts.ts (assertRetrievalRows, Zod-backed, RetrievalRowShapeError) replaces 4 'as SearchResult[]' casts in rag.ts (hybrid telemetry/merge, vector-fallback, document-summary context) with runtime shape assertion -- strict on id/document_id/content (not-null in schema) and the 4 score fields (nullish), loose via z.looseObject on everything else so RPC-version column differences don't break. Assertion-only (no transform), so object identity/key order is unchanged on success; errors carry only Zod issue paths, never row content. tests/rag-retrieval-row-contract.test.ts (8 cases) plus tests/rag-imputation-contract.test.ts kept green as evidence no ranking/comparator logic moved. Deliberately untouched: query_embedding casts (a deliberate repo-wide convention satisfying Supabase-generated RPC types) and outbound Json serialization casts. Remaining #212 population (~11 as-unknown-as casts) confirmed via grep to live OUTSIDE rag.ts's import graph: src/app/api/documents/route.ts (4), src/app/api/ingestion/{batches,jobs,quality}/route.ts (6), src/app/api/jobs/route.ts (1) -- legitimate non-RAG-flagged tranche-2 candidates, not yet started. | PR #1946, session 2026-08-14 | 2026-08-02 |
 | #222 | P3 | task | Headers surface only partially converged in PR-J: mode-home-template and search-results-header-band untouched | VERIFIED CORRECT 2026-08-12 — re-checked against merged main and left open: Still unconverged: src/components/mode-home-template.tsx defines ModeHomeStatusNotice locally (:232) and imports neither PageHeader nor the DS EmptyState; search-results-header-band.tsx is likewise untouched. Note the adjacency — in-flight PR #1842 delegates ModeHomeStatusNotice to the DS EmptyState under #221, which is a different conversion from the PageHeader question this row asks. Re-check after #1842 merges. Builder A converged DsmPageHeader, InformationPageHeader and InformationPageBreadcrumbs onto PageHeader plus Breadcrumb, and declined two files with reasons. mode-home-template.tsx ModeHomeHero is a centred display hero on the fluid text-hero token and is the slot the in-flow phone composer sits in, so converging it onto a left-aligned PageHeader is a redesign of 13 mode homes that collides with the one-composer-per-page contract. search-results-header-band.tsx is a results spine carrying status, counts and filters, not a page-title stack, so its pin tests/search-results-header-band.dom.test.tsx remains unflipped. Both are defensible; both leave the headers surface partially adopted. Next action: decide whether either is in scope at all, or record them as permanently out of the PageHeader vocabulary. Found during PR-J adoption, 2026-08-03. | session 2026-08-03 (PR-J Wave 5, Builder A) | 2026-08-02 |
-| #231 | P1 | issue | Generation fallbacks no longer stick in answer cache; lithium generation quality still falls back safely | PARTIAL 2026-08-12: This PR fixes the clinically consequential stale-fallback path: every answer whose routing or degraded reason contains generation_fallback is excluded from rag_response_cache. Offline evidence: 96 focused answer-route tests and 574 RAG fixture/contract tests passed. Approved live baseline/final canaries preserved 36/36 document and content recall at 1.0 with zero per-case reciprocal-rank regressions; the final 44-case answer gate had zero citation or numeric-grounding failures. A budget extension was tested and rejected: four cache-bypassed 'Lithium dosing?' probes remained grounded, cited safe extractive fallbacks at 35-40 second candidate budgets; the decisive 40-second probe completed generation in 25.272 seconds and 27.237 seconds total with route_deadline_exceeded=false, but failed generation quality. Therefore OPENAI_ANSWER_TIMEOUT_MS and the route budget are not the current residual binding cause. Next: instrument and reproduce the structured generation-quality failure using provider-safe metadata, then make a separate bounded output-quality fix with an offline fixture and live canary. Stop: do not increase route/provider timeouts or cache any generation fallback. | session 2026-08-04 (production triage, live /api/search + /api/answer) | 2026-08-04 |
-| #233 | P3 | task | COMPONENTS.md section 0 describes the pre-adoption world, and the optionality-marker contract change is undocumented | IN FLIGHT 2026-08-12 in PR #1842 (records DS adoption evidence and convergence state). Checked against the open-PR list during the full ledger sweep. Do NOT start this row while that PR is open — duplicating a queued conversion is the exact failure #292 records, and it has happened twice. Re-verify this row against main after that PR merges, and close it there rather than here. Two documentation debts left by PR-J, both in docs/design-system/COMPONENTS.md, naturally one PR. First: section 0's maturity matrix is stale. FormField, TextField, SearchField, Select, Checkbox, RadioGroup, PageHeader and Breadcrumb now have real product mounts, so 0.1 and 0.2 misdescribe what is registered versus built-but-unregistered, and 0.4's field-shell defects are closed by the five-control fold. A reader deciding whether a component is safe to adopt is reading the wrong answer. Second: FormField now marks only the requirement and leaves optional fields unmarked - (optional) was removed app-wide by design decision and is pinned by tests/ui-v2-form-field.dom.test.tsx - which is a design-system contract change that appears in no document. It belongs in COMPONENTS.md section 4 and probably DECISIONS.md. Next action: one docs PR updating section 0 from the actual mount list and recording the optionality rule with its rationale. Stop: do not re-add (optional) markers to satisfy a generic form-accessibility rule - the removal was deliberate and is test-pinned. | session 2026-08-04 (DS V2 Wave 5 close-out capture) | 2026-08-04 |
-| #234 | P3 | task | answer-copy-payload.ts is the single clipboard payload builder for three surfaces and has no documentation | IN FLIGHT 2026-08-12 in PR #1842 (publishes the answer-copy clipboard contract). Checked against the open-PR list during the full ledger sweep. Do NOT start this row while that PR is open — duplicating a queued conversion is the exact failure #292 records, and it has happened twice. Re-verify this row against main after that PR merges, and close it there rather than here. src/lib/answer-copy-payload.ts arrived in PR-J exporting answerStateForAnswer, buildAnswerClipboardText, resolveAnswerSources, citedSourcesOnly and singleDocumentClipboardMetadata. It is now the one place three product surfaces build a clipboard payload, which makes it a contract rather than a helper: a future caller that bypasses it can reintroduce the false-attribution defect the module exists to prevent (see #228). Nothing in docs/design-system mentions it. Next action: document the module and its five exports where the answer surface's copy contract is described, and state that new copy paths route through it rather than composing their own text. Found during PR-J close-out, 2026-08-04. | session 2026-08-04 (DS V2 Wave 5 close-out capture) | 2026-08-04 |
-| #235 | P3 | task | ADOPTION.md section 7 proof shots exist for only four of the adopted surfaces | IN FLIGHT 2026-08-12 in PR #1842 (records adoption evidence). Checked against the open-PR list during the full ledger sweep. Do NOT start this row while that PR is open — duplicating a queued conversion is the exact failure #292 records, and it has happened twice. Re-verify this row against main after that PR merges, and close it there rather than here. The adoption contract asks for a proof shot per adopted surface. The Wave 5 adoption captured four - DSM header, settings rows, patient panel, answer surface - and none for the forms fold, the catalogue and docs surfaces, the headers convergence, or the empty states adopted since. Section 7 therefore reads as complete while most of the adoption is unevidenced, which matters because the proof shot is what a later reader uses to tell an intended restyle from a regression (the #229 DSM eyebrow was almost rediscovered as a defect for exactly this reason). Next action: capture the missing shots against a warmed local server and attach them to section 7. Cheap and mechanical - no gate, no provider access. Stop: this is not the visual-baseline harness (#118) - do not commit Playwright snapshot PNGs or flip that job to blocking. | session 2026-08-04 (DS V2 Wave 5 close-out capture) | 2026-08-04 |
-| #237 | P2 | rec | Eyeball low-confidence AccessibleTable densities at 320px before freezing Linux visual baselines | IN FLIGHT 2026-08-12 in PR #1841 (renders empty dense cells wrapping rather than truncated, with a 320px jsdom assertion). Checked against the open-PR list during the full ledger sweep. Do NOT start this row while that PR is open — duplicating a queued conversion is the exact failure #292 records, and it has happened twice. Re-verify this row against main after that PR merges, and close it there rather than here. PR #1616 clinical MissingValue phrases increase text volume in sparse OCR grids. Contract forbids abbreviating to a dash. Next: open one real lowConfidence extraction at 320px phone width and accept or adjust dense preview column widths before committing Linux screenshots (#118). | PR #1616 review findings; session 2026-08-05 | 2026-08-05 |
-| #238 | P2 | rec | Visual pass for Sheet portal default on settings, sidebar, and answer overlays | IN FLIGHT 2026-08-12 in PR #1842 (exercises the Sheet portal default and adds tests/sheet.dom.test.tsx). Checked against the open-PR list during the full ledger sweep. Do NOT start this row while that PR is open — duplicating a queued conversion is the exact failure #292 records, and it has happened twice. Re-verify this row against main after that PR merges, and close it there rather than here. PR #1616 flips Sheet portal default to true, moving ~10 product overlays into OverlayRoot. Token inheritance is safe; residual risk is ancestor-scoped CSS / contain / transform. Next: one visual pass of settings-dialog, ClinicalSidebar, answer-result sheets, launcher sheet, section-nav. | PR #1616 review findings; session 2026-08-05 | 2026-08-05 |
+| #231 | P1 | issue | Generation fallbacks no longer stick in answer cache; lithium generation quality still falls back safely | PARTIAL 2026-08-12: This PR fixes the clinically consequential stale-fallback path: every answer whose routing or degraded reason contains generation_fallback is excluded from rag_response_cache. Offline evidence: 96 focused answer-route tests and 574 RAG fixture/contract tests passed. Approved live baseline/final canaries preserved 36/36 document and content recall at 1.0 with zero per-case reciprocal-rank regressions; the final 44-case answer gate had zero citation or numeric-grounding failures. A budget extension was tested and rejected: four cache-bypassed 'Lithium dosing?' probes remained grounded, cited safe extractive fallbacks at 35-40 second candidate budgets; the decisive 40-second probe completed generation in 25.272 seconds and 27.237 seconds total with route_deadline_exceeded=false, but failed generation quality. Therefore OPENAI_ANSWER_TIMEOUT_MS and the route budget are not the current residual binding cause. INSTRUMENT NOW EXISTS 2026-08-14: the "Next: instrument" half of this row is done. Commit a3bc4da adds scripts/probe-generation-quality.ts — one cache-bypassed live answer reporting the structured generation_quality_gate_reasons, provider-backed, refusing demo mode, never caching or logging the probe. The same commit adjudicates PR #1861: superseded for phase 1, close recommended, with the numeric-retry half deferred to phase 2 pending probe evidence. So do not review #1861 as though it were the live fix, and do not re-implement the probe. Next: run scripts/probe-generation-quality.ts in an environment that has OPENAI and Supabase credentials — it is blocked in offline containers, which is why it has not been run yet — then make a separate bounded output-quality fix with an offline fixture and live canary. Stop: do not increase route/provider timeouts or cache any generation fallback. INCIDENT ADDENDUM 2026-08-14 (later the same day): rung-2 evidence was then measured live - supabase_rpc_latency_ms 31610 on a semantic query (route budget 25000 starved generation), caused by the #316 dropped trigram indexes; after their owner-approved restore, 1535 (text fast path) / 8519 (hybrid). Pre-generation latency was the binding residual cause of semantic-query source-only fallbacks in that window; evidence in docs/audit/live-drift-forensics-2026-08.md. S1 (A1 phase 2) must re-verify generation_quality_gate:* dominance on healthy latency (run the probe with node --env-file=.env.local, which the probe does not load itself) before choosing a code mitigation rung. The route-budget stop condition stands unchanged. | sessions 2026-08-14: instrument adjudication + live incident probes (owner-authorized Supabase connector) | 2026-08-04 |
+| #235 | P3 | task | ADOPTION.md section 7 proof shots exist for only four of the adopted surfaces | CLOSURE ATTEMPTED AND REJECTED 2026-08-14 — read this before closing again. PR #1940 queued a `done` for this row citing ADOPTION.md section 7.1's per-surface executable-evidence table; the closure was cancelled on review with the reason "executable evidence does not replace the requested desktop and phone proof shots". The cancellation is correct, and the trap is worth naming: section 7.1 opens with "This PR records executable evidence RATHER THAN committing image baselines", so the very section that looks like the evidence says in its first line that it is not. A test that proves a component is mounted is not a picture of the surface, and this row asks for the picture. IN FLIGHT note retired: PR #1842 merged, so the do-not-start warning no longer applies. The requirement is unchanged. The adoption contract asks for a proof shot per adopted surface. Wave 5 captured four - DSM header, settings rows, patient panel, answer surface - and none for the forms fold, the catalogue and docs surfaces, the headers convergence, or the empty states adopted since. Section 7 therefore reads as complete while most of the adoption is unevidenced, which matters because the proof shot is what a later reader uses to tell an intended restyle from a regression (the #229 DSM eyebrow was almost rediscovered as a defect for exactly this reason). Next action: capture the missing shots against a warmed local server (npm run ensure) and attach them to section 7. Cheap and mechanical - no gate, no provider access. Stop: this is not the visual-baseline harness (#118) - do not commit Playwright snapshot PNGs or flip that job to blocking. Stop: do not close this row on unit, DOM or contract evidence of any kind. | session 2026-08-04 (DS V2 Wave 5 close-out capture) | 2026-08-04 |
+| #237 | P2 | rec | Eyeball low-confidence AccessibleTable densities at 320px before freezing Linux visual baselines | CLOSURE ATTEMPTED AND REJECTED 2026-08-14 — read this before closing again. PR #1940 queued a `done` for this row citing tests/accessible-table.dom.test.tsx:110 ("keeps the full missing-value phrase readable in the dense 320px preview"); the closure was cancelled on review with the reason "the jsdom assertion does not verify the requested real 320px browser visual pass". The cancellation is correct. jsdom does not lay out text, so a 320px assertion there proves the string is present, not that it fits, wraps or stays legible at that width — which is the whole question for a low-confidence extraction in a sparse grid. IN FLIGHT note retired: PR #1841 merged, so the do-not-start warning no longer applies. The requirement is unchanged. PR #1616 clinical MissingValue phrases increase text volume in sparse OCR grids; the contract forbids abbreviating to a dash. Next: open one real lowConfidence extraction at 320px phone width in an actual browser (npm run ensure, then a phone viewport) and accept or adjust dense preview column widths before committing Linux screenshots (#118). Stop: do not close this row on a jsdom, DOM-testing-library or snapshot-string assertion — only a real browser at 320px settles it. | PR #1616 review findings; session 2026-08-05 | 2026-08-05 |
+| #238 | P2 | rec | Visual pass for Sheet portal default on settings, sidebar, and answer overlays | CLOSURE ATTEMPTED AND REJECTED 2026-08-14 — read this before closing again. PR #1940 queued a `done` for this row citing tests/sheet.dom.test.tsx and the `portal = true` default; the closure was cancelled on review with the reason "generic Sheet coverage does not verify the requested product-overlay browser journeys". The cancellation is correct. The residual risk this row exists for is ancestor-scoped CSS, `contain` and `transform` on the specific product overlays — a property of where each overlay sits in the real page, which a component-level unit test cannot see no matter how thorough it is. IN FLIGHT note retired: PR #1842 merged, so the do-not-start warning no longer applies. The requirement is unchanged. PR #1616 flips the Sheet portal default to true, moving ~10 product overlays into OverlayRoot; token inheritance is safe. Next: one visual pass in a real browser over settings-dialog, ClinicalSidebar, answer-result sheets, launcher sheet and section-nav. Stop: do not close this row on Sheet component coverage — the question is about the five host surfaces, not about Sheet. | PR #1616 review findings; session 2026-08-05 | 2026-08-05 |
 | #239 | P3 | rec | Manual phone rotation check for ResizeObserver-only phone chrome reserve | PR #1616 phone overlay reserve publishes only from ResizeObserver quiet-window deliveries. Desktop↔phone and late-mount recovery are covered; orientation that does not change stack height is a narrower trigger. Next: rotate a physical phone on a chrome-overlay route and confirm --phone-overlay-chrome-h updates. | PR #1616 review findings; session 2026-08-05 | 2026-08-05 |
 | #240 | P3 | rec | Confirm tooltip visual hard-clip asymmetry with design owner | Tooltip keeps overflow-hidden visual clamp while sr-only/aria-label retain full text. Design contract says supplementary-only. Next: design-owner confirmation that sighted users losing the clipped tail is acceptable, or allow overflow-y-auto for long clinical strings. | PR #1616 review findings; session 2026-08-05 | 2026-08-05 |
 | #242 | P2 | task | Commit approved Linux visual baselines and promote adoption not-committed → committed | VERIFIED CORRECT 2026-08-12 — re-checked against merged main during the full ledger sweep and left unchanged: Six linux/ PNGs are committed, but the adoption manifest still carries 68 `not-committed` entries — the surfaces flip is the remaining work, as stated. This stamp exists so a later reader can tell "checked and still true" from "never looked at"; the two were indistinguishable before. Baselines and provenance are DONE as of PR #1729 (branch claude/ds-adopt-visual-baselines): all six linux/ PNGs committed from ubuntu artifact visual-baseline-31251091603 (main @ bc33d414e), AWAITING_BASELINE emptied, and tests/__screenshots__/linux/provenance.json written with per-candidate SHA-256 + dimensions and an approved human review. Proven by that PR's own run: visual-junit tests=9 failures=0 skipped=0, and no visual-candidates/ directory, i.e. all six compared rather than skipped. REMAINING: only the surfaces flip to baseline.status committed. Blocked on ordering, measured 2026-08-08: validateLinuxVisualBaselineSet short-circuits on declaredPaths.length===0, so declaring files activates its rule that no non-allowlisted path may change since candidateSourceHead — and PR #1729 necessarily changed tests/design-system-adoption.test.ts, whose initialiseCandidateRepository seeded fixtures from the LIVE spec and so failed the moment AWAITING_BASELINE emptied. The two cannot land together. Next: after #1729 merges, re-capture candidates from a main run that already contains that fixture fix, then flip the surfaces against that head. Note this does not affect whether pixels compare — Playwright compares because the goldens exist on disk. | PR #1616 review findings; session 2026-08-05 | 2026-08-05 |
-| #245 | P3 | rec | responsive-compact CrossModeLinks keeps duplicate rails in the DOM | IN FLIGHT 2026-08-12 in PR #1842 (CrossModeLinks rail behaviour). Checked against the open-PR list during the full ledger sweep. Do NOT start this row while that PR is open — duplicating a queued conversion is the exact failure #292 records, and it has happened twice. Re-verify this row against main after that PR merges, and close it there rather than here. Phone chip rail and md+ card rail both mount; display:none removes the inactive from the a11y tree. Tests/analytics counting role=link see doubles; cross-mode-links-rail is phone-only. Next: prefer the variant test ids; do not collapse to one rail with JS breakpoints (hydration risk). | PR #1616 review findings; session 2026-08-05 | 2026-08-05 |
 | #248 | P2 | issue | Investigate why 20260705180000 search-health indexes were missing on live despite applied history | APPEND 2026-08-13: the prior closure is withdrawn. Repository and live-drift evidence establishes that 20260705180000_reconcile_search_health_indexes.sql is recorded as applied while documents_title_trgm_idx and document_chunks_content_trgm_idx are missing on live. Supabase transaction semantics exclude a persisted partial migration, but the present record does not distinguish skipped DDL/history repair from indexes created and later dropped. In an approved read-only window, query supabase_migrations.schema_migrations for the 20260705180000 statements fingerprint and inspect the relevant audit/history evidence; retain both hypotheses until that evidence establishes the cause. Separately, scheduled check:drift did detect the missing indexes, but red runs were not routed. | PR #1614 review / session 2026-08-05 (renumbered on main merge) | 2026-08-05 |
-| #258 | P2 | rec | The PR-handoff stop rule is enforced for Claude Code only; Codex and Cursor get prose with no gate | **Outcome:** a session that opens a PR stops following it in every agent this repo supports, not just Claude Code. **Detail:** PR #1649 added `.claude/hooks/pr-handoff-stop.sh` plus the AGENTS.md "Stop when the pull request is open" section. The hook is registered in `.claude/settings.json`, which only Claude Code reads, so the PostToolUse marker and the PreToolUse denials (shell `gh pr checks/status/view/run watch`, GitHub MCP tools named pull_request/workflow_run/workflow_job/check_run/check_suite/job_log/update_branch, and Monitor/ScheduleWakeup/CronCreate) simply do not exist for Codex or Cursor sessions. Those agents get the AGENTS.md prose and nothing else — and prose alone is exactly what was already in force, and already insufficient, before #1649. Cost is the same long tail of post-handoff CI polling the hook was built to cut, just relocated to whichever agent lacks the gate; a cloud Codex session is the worst case because nothing naturally ends it. **Next:** cheapest first — check whether Codex and Cursor expose any pre-tool interception this repo can register (Codex plugin hooks under `plugins/clinical-kb/`, Cursor rules under `.cursor/`); if neither offers a deny path, the fallback is a shared marker file plus a wrapper the agent is told to route `gh` through, which is weaker but still detectable. If no mechanism exists at all, record that explicitly here so the gap is a known limit rather than an open task. **Stop:** do not weaken the Claude Code hook to make the tools symmetric, and do not add a second copy of the deny list — one script, multiple registrations. | PR #1649; .claude/hooks/pr-handoff-stop.sh; .claude/settings.json; AGENTS.md "Stop when the pull request is open"; session 2026-08-07 | 2026-08-07 |
-| #262 | P2 | task | DS Track A3: finish the design-token debt | Three parts. (1) DONE 2026-08-10 - --shadow-tight is retired outright: 90 gated production sites across 48 files (plus 60 mockup occurrences, migrated in the same pass so no file names a dead token) now reach for var(--e1), and all three declarations - both themes and the forced-colors flattening - are deleted. The alias resolved to exactly var(--e1) in every scope and the forced-colors block already flattened --e1 alongside the roles, so the substitution was value-preserving in light, dark and forced-colors and needed no visual review. Do NOT take that from the declarations alone for the remaining tranches: ckb-v2-tokens.css redeclares --e1 (light 13 40 71 / 5% vs globals 11 42 56 / 7%) and never redeclares the roles, and a custom property containing var() substitutes on the element it is DECLARED on - an alias declared in an outer scope and overridden in a narrower one freezes at the outer value. This migration is safe only because .ckb-v2 is on <html> (layout.tsx) and .ckb-v2.ckb-v2 outspecifies :root, so the alias substitutes against the winning v2 tier; measured in Chromium, both spellings compute to rgba(13, 40, 71, 0.05) 0px 1px 2px 0px. Re-run that check per alias, it is about where a declaration sits. legacyShadowAliases 220 -> 127 with per-path counts pinned to measured, which also closed 3 aliases of re-accumulated stale slack across the other six roles (measured 217 against a 220 ceiling - the same drift #264 found on 9 Aug). design-token-contract.test.ts now asserts the token is absent from the whole stylesheet, mutation-verified. Remaining 127: soft 71, elevated 17, hover 17, card 12, lux 8, lift 2 - and count a token by reading the var() call, not the declaration it sits in, because two of the soft hits are the VALUE of the --shadow-focus declarations. Parts (2) and (3) below are untouched; (3) landed separately in PR #1780 per #301. ORIGINAL SCOPE NOTE, kept for the remaining tranches:  SCOPE RE-MEASURED 2026-08-08 against origin/main 2675e6e1d, running analyzeClassContractsInSource + analyzeCssContractsInSource over the same walk check-design-system-contract.mjs uses (src/**, .ts/.tsx/.css, mockups excluded). The inherited figures were wrong in three ways. First, the legacyShadowAliases metric counts SEVEN tokens, not one: measured total 228 = tight 100, soft 72, elevated 17, hover 17, card 12, lux 8, lift 2. So the '229 --shadow-tight aliases' in HANDOVER-2026-08-07 is the all-token total mislabelled, and this row's earlier '155 consumers' was closer to a raw repo-wide grep (160 occurrences including mockups) than to the gated number. Second, the real scope is 100 production --shadow-tight sites across 55 files, so the inherited figure overstates the work by roughly 1.55x, and clearing all 100 will NOT zero the ratchet: 128 aliases across the six other tokens remain, so do not treat legacyShadowAliases=0 as the success criterion. Third, --shadow-focus is NOT in this metric at all: LEGACY_SHADOW_ALIAS has matched exactly tight\|card\|soft\|hover\|elevated\|lux\|lift since PR #1616 and has never included focus, so an earlier note claiming 'eight tokens, focus 2' and an overlap with #261 was wrong. #261 is a separate token with one consumer (src/app/globals.css:1476) and two theme declarations (lines 423, 664); the two tasks do not share this metric. Baseline pins legacyShadowAliases at 231 and the baseline is a ceiling, so today's 228 already passes. Re-measure before starting rather than trusting any of these numbers. (2) Add a step-SELECTION lint for the eight non-standard type steps (1318 sites) — check:type-scale already blocks arbitrary text-[12px], so do NOT write a lint duplicating the half that ships. (3) Extend the contract ratchet to raw padding / radius / line-height literals; it covers colour, shadow, tap and tracking today. Gate: npm run check:design-system-contract. | session 2026-08-07 — design-system HANDOVER-2026-08-07 Track A1 handoff (PR #1678) | 2026-08-07 |
-| #265 | P2 | task | DS Track A6: move design-system gates 2, 4, 7 and 8 from partial to blocking | VERIFIED CORRECT 2026-08-12 — re-checked against merged main during the full ledger sweep and left unchanged: docs/design-system/GATES.md still carries 10 `implemented-partial` rows; gates 2, 7 and 8 remain unclosed. Gate 2 is blocked behind #293, whose finding 1 is refuted — see that row before attempting the enumeration. This stamp exists so a later reader can tell "checked and still true" from "never looked at"; the two were indistinguishable before. RE-MEASURED AND PART-CLOSED 2026-08-09 against origin/main 8db1e53937. GATE 4 CLOSED: colourOnlyStatusIndicators in check:design-system-contract is the repository-wide enumeration this row asked for - a status hue on a box with no children, no aria-label/aria-labelledby/title on it or any ancestor, no sibling text, and not a StatusMark. It also flags shared swatch recipes, because the analyzer is per-file and cannot follow an imported statusDotReady to its call sites. Ratcheted at 4 with per-path pins (the two bare statusDot recipes GATES.md named, a calculator risk band, a therapy meter fill); a new colour-only indicator anywhere in src now fails. Mutation-verified. GATE 2 NOT CLOSED, and this row's description of it was wrong in a way that cost a session. It is NOT true that test:e2e:style-contract needs wiring into verify:cheap: the npm script is only an alias for running that one spec, the spec matches productionSpecPattern in playwright.config.ts and is listed in scripts/playwright-pr-shards.mjs, so it ALREADY runs in the required Production UI job. It must NOT be added to verify:cheap:internal, because check:gate-manifest then demands a matching step in static-pr, which has no browser and no server. The real gap is the h-10 blind spot inside the audit itself, and an enumeration for it was written, shown to find genuine defects, and then reverted rather than landed because it is not deterministic on a live-search route - see #293 for the six-run evidence and the follow-up. REMAINING: gate 2's enumeration (needs a deterministic surface first, #293), gate 7 (elevation child/parent, needs a render-tree check, untouched), and gate 8's recorded debt only - its two checks already ship and ratchet per path, so that work is retiring 27 edge conflicts across 15 files and 2 globals.css spreads, then pinning both at zero. | session 2026-08-07 — design-system HANDOVER-2026-08-07 Track A1 handoff (PR #1678) | 2026-08-07 |
+| #258 | P2 | rec | The PR-handoff stop rule is enforced for Claude Code only; Codex and Cursor get prose with no gate | GAP RECORDED 2026-08-14 in PR #1944 — docs/pr-handoff-stop-cross-agent-gap.md. This is the row's own stated fallback ("If no mechanism exists at all, record that explicitly here so the gap is a known limit rather than an open task"), so the row stays open but is no longer unexamined. Checked, not assumed: .claude/settings.json is read only by Claude Code; plugins/clinical-kb/.codex-plugin/plugin.json declares name/version/description/author/repository/keywords/skills and an interface block with NO hook, event, or pre-tool-interception field, shipping exactly one skill; .cursor/ holds settings.json (plugin enablement only), mcp.json, agents/ and skills/ with no deny path. So the cheapest-first option the row proposed is currently unavailable in both tools. Worth noting because it sharpens the cost: .cursor/agents/pr-babysit.md exists, meaning Cursor ships a documented agent for exactly the PR-following behaviour this rule restricts, with nothing bounding it. The doc records the Claude Code mechanism in enough detail to reimplement (session-scoped marker under the absolute git dir, fail-open on an unidentifiable session id, never pruning a sibling's marker, post-mode scanning only the request half so a command that merely prints a PR URL cannot arm it, and the CLAUDE_ALLOW_PR_FOLLOW=1 prefix unlock that a mention alone cannot trigger), plus the three questions any parity mechanism must answer. It is explicit that the wrapper fallback is advisory only — it cannot touch the MCP-connector or loop-machinery classes, so it makes a violation detectable after the fact rather than prevented. Next: re-check the Codex and Cursor manifests when either ships hook support; close only when a mechanism exists or the limit is accepted deliberately. Stop unchanged: do not weaken the Claude Code hook for symmetry, and do not keep a second copy of the deny list. | PR #1649; .claude/hooks/pr-handoff-stop.sh; .claude/settings.json; AGENTS.md "Stop when the pull request is open"; session 2026-08-07 | 2026-08-07 |
+| #265 | P2 | task | DS Track A6: move design-system gates 2, 4, 7 and 8 from partial to blocking | GATE 2 CLOSED 2026-08-15 by PR #1984; gates 7 and 8 remain, and gate 8 is materially larger than this row said. Corrections first, because two figures here were stale: the debt for gate 8 is 25 conflicts across 12 files, not 27 across 15 — PR #1942 paid three files down without updating the prose, and both GATES.md section 3 and scripts/design-system-contract-baseline.json already said 25, which outranks the prose per docs/design-system/README.md. GATES.md carries 9 implemented-partial rows, not 10; the tenth grep hit is the legend. And #293 is resolved: commit 885c613 (PR #1962) IS on main — PR #1977 is already open to close that row, so do not queue another. GATE 2, what closed it: the row named two gaps, the rendered enumeration and the fixed-height h-10 case. The first landed in #1962. The second is closed by a new interactiveTapFloorDeclarations metric in check:design-system-contract — an interactive element (a, button, input, select, summary, textarea) declaring its OWN unprefixed min-h-* below the 48px token, ratcheted at 43 across 17 files with per-path pins; comparable arbitrary lengths and mutually exclusive/composed branches are evaluated independently, so a new sub-floor control anywhere in src/** fails today. Mutation-verified: lowering one shortlist button to min-h-9 produced both the total and matching per-path regression. Scoped to min-h-* and NOT h-*/size-* on purpose: a short h-4 on an interactive element is routinely the visible box of a control whose hit area belongs to a tap-sized wrapper (SelectionCheckbox in differentials-home.tsx, whose label ui-smoke asserts still meets the floor), and flagging those would pad the baseline with non-defects — the exact section 5 failure mode. One remaining limit recorded rather than hidden: the walker sees intrinsic lowercase tags only, so a floor on <Link> or another component wrapper is invisible to it (the pre-existing legacyTapClasses check shares that blind spot). The 43 recorded sites are real debt still owed. Also tightened legacyShadowAliases 119 to its measured 118 — one unit of stale slack found while working #163. GATE 8 — STOPPED DELIBERATELY, and the reason matters for whoever picks it up. The 25 conflicts are not 25 mechanical one-line edits. Inspected every site: the large majority are focus:ring-4 focus indicators co-existing with a border on inputs, selects and textareas (master-search-header 5, formulation-builder 3, and singles across formulation-compare, dashboard-nav, favourites, specifiers, DocumentTagCloud, ui-primitives), and only pwa-lifecycle's shared cardClassName is the decorative persistent double edge the rule was written for — one recipe counted 5 times. Retiring the focus-ring class means restyling focus indicators from ring to outline across roughly 17 controls, which is an accessibility-visible change needing focus-state proof in a browser. Three further constraints: this container cannot run Chromium (ships chromium-1194 against a pinned 1234, #255/#312) so that proof was unavailable; 8 of the 25 sit in files that open PRs #1976, #1982 and #1983 are editing; and pinning at zero without first widening the onePixelShadowSpreads property filter (design-system-contract-utils.mjs:1320 matches --e[0-4] and --shadow-* but not --glow-primary, --glow-soft or --ring-hairline, all of which carry 0 0 0 1px) would be a partly false close. Next for gate 8: decide the focus-indicator question first as a design-system ruling (ring vs outline for focus), then widen the spread filter, then retire and pin — with browser focus proof. GATE 7 untouched, unchanged from this row's description: no child/parent elevation check exists and no shared render-tree traversal helper exists to build one on; every spec inlines its own page.evaluate walk. The template is #1962's determinism scaffolding plus a computed-box-shadow to --e0..--e4 tier lookup built with the probe technique at ui-style-contract.spec.ts:265-289. | session 2026-08-15; PR #1984; GATES.md; scripts/design-system-contract-baseline.json | 2026-08-07 |
 | #266 | P3 | task | DS Track B1: adopt the 23 unadopted components demand-driven, never as a race to 53/53 | **DEPRIORITISED 2026-08-12 (yield review against current main).** Adoption counting toward 53/53 while a clinical P1 is open. The row's own title says never as a race to 53/53; the queue has been running the race anyway. Demand-driven means it activates when a surface needs a component, not on a schedule. COUNTS RE-MEASURED 2026-08-12 from docs/design-system/adoption-manifest.json on merged main: **54 registered, 31 adopted, 23 UNADOPTED**. (This supersedes the 2026-08-08 figures of 53/30/23, which a main-merge briefly restored over this correction.) The total held at 23 but the membership moved — DisclosureGroup joined the adopted set, and the newly built ErrorState joined the unadopted set; ErrorState's enforcement is closed (archived #298) but its adoption is still open under #299. Today's 23: AnswerFooter, Checkbox, Citation, CitationList, ConfirmDialog, Disclosure, DoseLine, DownloadLink, ErrorState, ErrorSummary, ExternalTextLink, FieldError, FieldHint, LinkAction, Pagination, Progress, RadioGroup, SearchField, StageList, Tabs, TextLink, ToastRegion, Tooltip. Approach unchanged and still correct: demand-driven adoption — pick a surface and let it pull, the way AccessibleTable pulled Button and the answer surface pulled AnswerCard (#216) — never a race to 54/54. Forms remain the largest single tranche: FieldError, FieldHint, ErrorSummary, SearchField, Checkbox and RadioGroup land together on one form conversion. Do not stub a component to move the count. Regenerate with npm run design-system:adoption:update AND npm run design-system:design-sync:update; both manifests are generated, never hand-edited. | session 2026-08-07 — design-system HANDOVER-2026-08-07 Track A1 handoff (PR #1678) | 2026-08-07 |
 | #267 | P3 | task | DS Track B2: AnswerFooter and DoseLine need a provenance/dose payload the answer surface does not produce | **DEPRIORITISED 2026-08-12 (yield review against current main).** Blocked on a provenance/dose payload the answer surface does not emit, which is backend work nobody has scoped. Cannot start. VERIFIED CORRECT 2026-08-12 — re-checked against merged main during the full ledger sweep and left unchanged: Neither AnswerFooter nor DoseLine has a product importer; the provenance/dose payload the answer surface would need still does not exist. This stamp exists so a later reader can tell "checked and still true" from "never looked at"; the two were indistinguishable before. Backend-shaped work, not a component swap: the two components cannot be adopted until the answer surface emits the provenance and dose data they render. Do not stub one to make the adoption count look better. Sequence after the payload exists, then adopt via the Track B1 demand-driven route. | session 2026-08-07 — design-system HANDOVER-2026-08-07 Track A1 handoff (PR #1678) | 2026-08-07 |
 | #268 | P3 | task | DS Track B3: move the 19 genuine bare-dash sites onto MissingValue | **DEPRIORITISED 2026-08-12 (yield review against current main).** 19 bare-dash sites with no reported clinical misreading. Cosmetic consistency on a prototype with an open P1. VERIFIED CORRECT 2026-08-12 — re-checked against merged main during the full ledger sweep and left unchanged: MissingValue is imported in 5 component files; the bare-dash conversion is partial. The ~5 calculator 'not started' sites stay permanently, per this row's own stop rule. This stamp exists so a later reader can tell "checked and still true" from "never looked at"; the two were indistinguishable before. Therapy-compass getters, specifier sourceFamily, favourites counts when untrusted. Leave the roughly 5 calculator 'derived.started ? score : dash' sites PERMANENTLY — 'not started' is not a missing clinical value, MissingValueReason has no member for it, and converting them would render 'Not recorded' for a score the clinician simply has not entered. | session 2026-08-07 — design-system HANDOVER-2026-08-07 Track A1 handoff (PR #1678) | 2026-08-07 |
 | #269 | P3 | task | DS Track B4: prove the per-component visual state matrix (blocked on the baseline hold) | **DEPRIORITISED 2026-08-12 (yield review against current main).** Blocked on #118 baselines, and proves a per-component state matrix for a design system on a single-user prototype. High cost, low yield at this stage. hover / active / disabled / busy / invalid / 320px / dark / forced-colours / print, per component. Currently proven for none. Blocked on #118: zero visual baselines are committed and the harness is continue-on-error, so nothing in Track B is safe at scale until baselines exist. CORRECTION 2026-08-08: the claim that baselines cannot be generated on Windows is half true and led to the wrong conclusion. It is true that snapshotPathTemplate carries {platform}, so win32 PNGs are invisible to the ubuntu CI job — but the CI job already produces the ubuntu ones. .github/workflows/ci.yml job visual-baseline runs on ubuntu-24.04 whenever ui_changed, runs npm run test:e2e:visual, and uploads tests/__screenshots__/ as artifact visual-baseline-<run_id>; playwright.visual.config.ts records that on a missing baseline Playwright writes the golden and fails the first attempt, which is why retries are pinned at 0. So the mechanism exists and adoption is mechanical — see #118. Stop rule unchanged: do not commit baselines until the owner declares the design final, and do not adopt them from a developer machine. | session 2026-08-07 — design-system HANDOVER-2026-08-07 Track A1 handoff (PR #1678) | 2026-08-07 |
 | #271 | P3 | task | Decide whether to delete the now-consumer-less action kind in SecondaryNavigation | VERIFIED CORRECT 2026-08-12 — re-checked against merged main and left open: No production constructor of SecondaryNavigation exists — `<SecondaryNavigation` appears nowhere under src/. The keep-or-delete decision this row describes is still the open question, and it is a decision, not a defect. PR #1679 removed the last live consumer of SecondaryNavigationActionItem. UPDATE 2026-08-09 (in-page-nav PR 2): the question is now the whole component, not one kind. That PR removed the section kind — SecondaryNavigationSectionItem, useActiveSection, sectionFragmentId, nearestScrollOwner, sectionActivationClearance and the internal secondary-navigation:section-select event — because the six information routes that fed it now mount InPageNavHeader. That was the last PRODUCTION constructor of any kind: RegistryModeNav renders ModeNav, not SecondaryNavigation, so the surviving route and action kinds have no caller in src/ at all and the only file that builds either is tests/secondary-navigation.dom.test.tsx. Kept rather than deleted in that PR deliberately: deleting a component plus its test file alongside a seven-route conversion is a second unrelated change, and this row already tracks the same keep-or-delete call. Next: decide keep-or-delete for src/components/secondary-navigation.tsx as its own change. If delete, also remove tests/secondary-navigation.dom.test.tsx and the therapy-compass action entries in the registry, and check tests/mode-nav-contract.test.ts, which string-matches source lines in page-secondary-navigation.tsx. Stop: do not do half of each — a deleted branch with its tests left behind, or vice versa, is worse than either. | session 2026-08-07; PR #1679; in-page-nav PR 2 2026-08-09 | 2026-08-07 |
-| #275 | P2 | task | The shared filter trigger carries arbitrary spacing values inherited from DocumentFilterTrigger | SCOPE RE-MEASURED 2026-08-12 on merged main, and this row's central premise is now FALSE. It said 'there is now only one implementation, so it is a single edit'. There are five files. The correct path is src/components/clinical-dashboard/result-filter-control.tsx (NOT src/components/ui/ — a grep there returns nothing and reads as 'already tokenised', which is how this row nearly got closed by mistake). Measured today: `1.0625rem` (the badge box) appears in 6 places across FIVE files — result-filter-control.tsx:148, document-search-results.tsx, mode-nav/mode-nav.tsx:64,211, mode-nav/nav-slot-ink.tsx:44 and therapy-compass/filter-sheet.tsx:166; `pr-[0.6875rem]` in TWO (result-filter-control.tsx:125, document-search-results.tsx); `min-[414px]:max-[429px]` in the same TWO (result-filter-control.tsx:143, document-search-results.tsx). So the value has leaked well past the trigger pair this row was written about — the mode-nav and therapy-compass copies are new. Next unchanged in intent but bigger in scope: tokenise in @theme once (a badge-box size token and the label breakpoint window), then update all five files in the same change. Stop unchanged: do not tokenise one call site and leave the others, which reintroduces exactly the drift the extraction removed, and do not change the measurements themselves — each carries a measured justification in its own comment. | CodeRabbit review on PR #1706; DocumentFilterTrigger on main | 2026-08-07 |
 | #280 | P2 | task | Physical iPhone acceptance is owed for the viewer pinch gesture and the canvas pixel budget | **Outcome:** the two phone-only viewer fixes are confirmed on the device class they were written for. **Detail:** the viewer-optimisation branch revives pinch-to-zoom in fit mode (it was gated off in the default state, so a pinch reached neither the viewer nor the browser) and adds a canvas pixel budget so WebKit stops blanking the page above roughly 2.3x zoom on a dpr-3 display. Neither is verifiable in this container (see the Chromium/pdf.js row) and neither is a Chromium behaviour anyway — the canvas ceiling is a WebKit limit and the touch-action contention is a Safari gesture question. **Next:** on a real iPhone, in Safari and in the installed PWA: pinch a freshly opened document and confirm it zooms without first tapping a control; zoom to maximum and confirm the page stays painted rather than going blank; confirm a pinch that drifts vertically is not cancelled mid-gesture by the holder's 'touch-action: pan-y' (the mitigation if it is, is switching touch-action to none while two pointers are down — the gesture hook already tracks pointer count and exposes 'pinching'). Record the result against docs/phone-chrome-physical-acceptance.md. **Stop:** do not re-gate pinch on '!fitWidth' to resolve a gesture-contention finding — that restores the original defect. **THIRD ACCEPTANCE ITEM ADDED 2026-08-13 (document viewer Phase 3, PR #1772).** Multi-page documents now read as one continuous column inside a bounded reading pane: pdf-canvas-viewer.tsx gives the holder max-h-[72vh] sm:max-h-[80vh] when totalPages > 1 and not fullscreen, so the holder becomes the scroller, and its overscroll changes from overscroll-contain to overscroll-x-contain precisely so vertical scroll chains OUT of the pane at its ends rather than trapping the reader. Single-page documents keep their previous geometry exactly and need no re-check. A nested vertical scroller inside a page is a known iOS hazard and no Chromium gate says anything about it, so it belongs on this same device pass. **On a real iPhone, in Safari and the installed PWA:** open a multi-page document (the 2-page synthetic clozapine demo doc, or any real guideline), confirm pages scroll inside the pane, and confirm that reaching its top or bottom continues scrolling the page rather than dead-ending. **Stop:** if it does trap, do not fix it by removing the pane — the pane is what makes a long guideline readable; adjust the overscroll behaviour or the pane height instead. | session 2026-08-08 document-viewer optimisation; docs/design-system/COMPONENTS.md phone clause | 2026-08-08 |
 | #281 | P2 | rec | The phone document route renders two clinical-summary surfaces and neither is canonical | **Outcome:** one clinical summary on the document route, chosen deliberately. **Detail:** a phone reader gets the gradient 'High-yield clinical summary' card (DocumentClinicalSummary, built by buildDocumentClinicalSummaryModel) and, further down, the rail's '#source-summary' / 'high-yield-summary' disclosure (DocumentSectionSummary + FormattedHighYieldSummary + BadgeCluster). They render the same document.summary row two different ways. The rail is not hidden on phones — only its DocumentSectionIndexCard is lg:block — so both appear. Only the rail panel carries the section anchor, so the more prominent card is the unnavigable one. Note the two disagree about emptiness as well: the card now renders nothing when the model yields no usable text, while the rail panel still renders for its label badges, which is why 'hasStoredSummary' was deliberately left keyed to the stored row rather than to card content. **Next:** decide which rendering is canonical — this is a clinical-content judgement about how a summary should read, not a layout fix — then delete the other and give the survivor the 'source-summary' anchor. If the rail's badges are the part worth keeping, they can move without the second summary body. **Stop:** do not merge the two renderings mechanically; they format clinical text differently and the difference is the decision. | session 2026-08-08 document-viewer optimisation; document-rail-panels.tsx; document-clinical-summary.tsx | 2026-08-08 |
 | #282 | P3 | task | Probe the corpus for JBIG2/JPX before deciding whether pdf.js needs its decoder assets shipped | **DEPRIORITISED 2026-08-12 (yield review against current main).** A probe to decide whether pdf.js decoder assets are needed. Worth doing eventually, but no reported rendering failure traces to JBIG2/JPX today, so it is speculative. **Outcome:** a measured decision about pdf.js's cMap/standard-font/WASM assets rather than an assumption either way. **Detail:** getDocument is configured with url plus the on-demand fetch flags and nothing else, so 'wasmUrl', 'standardFontDataUrl', 'cMapUrl' and 'iccUrl' are all unset. pdfjs-dist ships those assets (wasm 1.5 MB, standard_fonts 804 KB, cmaps 1.7 MB) and nothing copies them into public/. With wasmUrl null, 'useWorkerFetch' resolves false and the WASM image decoders cannot load, so JBIG2 and JPEG2000 images fall back to the JS decoders or fail; those are exactly the encodings a scanned guideline uses, and this repo runs an OCR pipeline, which implies scanned sources exist. Non-embedded standard-14 fonts fall back to system fonts, which is a fidelity risk on a clinical document rather than a failure. **Next:** sample the real corpus for JBIG2/JPX-encoded images and for PDFs relying on the standard 14 before shipping ~2 MB of static assets; if the corpus does use them, copy into public/pdfjs, set the URLs, and add immutable cache headers in next.config.ts (public/ is not counted by check:bundle-budget, so there is no budget risk — the cost is bytes over the wire on first use). **Stop:** do not ship the assets on the assumption alone. | session 2026-08-08 document-viewer optimisation; node_modules/pdfjs-dist/types/src/display/api.d.ts | 2026-08-08 |
 | #283 | P3 | rec | The 100-id batch signed-URL route still has no caller | VERIFIED CORRECT 2026-08-12 — re-checked against merged main during the full ledger sweep and left unchanged: No caller for src/app/api/images/signed-urls/route.ts anywhere outside app/api — the batch route is still unused. This stamp exists so a later reader can tell "checked and still true" from "never looked at"; the two were indistinguishable before. **Outcome:** either the batch minter is used or it is retired, rather than sitting as an untested, unreachable privileged surface. **Detail:** src/app/api/images/signed-urls/route.ts POSTs up to 100 image ids and returns their signed URLs, with its own rate limit, owner scoping and committed-generation filter. Nothing in src/ calls it — only tests/private-access-routes.test.ts imports it. **DEFERRED AGAIN, DELIBERATELY, 2026-08-09 (document viewer Phase 3, Task 3).** The user chose deferral over wiring when asked. Two reasons beyond cost: (a) wiring it puts a privileged owner-scoped API route into a diff that is otherwise confined to src/components/document-viewer/**, and it matches clinicalRiskPatterns (/^src\/app\/api\//) so pr-policy hard-blocks the merge without a complete Clinical Governance Preflight; (b) Phase 3 Task 2 windowed the rail to six rows and tightened its IntersectionObserver root margin from 640px to 240px, so the many-distinct-images case the batch route was meant to serve is now materially smaller — a page of N figures no longer mounts N rows at once. The batching win should be re-measured against the windowed rail before it is wired at all, rather than assumed from the pre-window numbers. **Next:** decide deliberately — measure concurrent distinct-image requests on a figure-heavy document with the windowed rail, then either wire the batch route in its own PR or delete it and its tests. **Stop:** if wiring it, keep the per-image endpoint for the lightbox's retry path; do not make the batch the only way to mint a URL. | session 2026-08-08 document-viewer optimisation; src/app/api/images/signed-urls/route.ts | 2026-08-08 |
-| #292 | P2 | rec | Two assistants built the same queued conversion twice because neither workflow checks the open-PR list before starting | **Outcome:** picking up a queued ledger item cannot silently duplicate work another session already has in flight. **Detail:** on 2026-08-09 two assistants took the same queued `/issues` item roughly four hours apart and independently built the same in-page-nav conversion — PR #1766 (merged) and PR #1767 (closed as duplicate). Neither had any way to see the other: the ledger row was the only shared state. Correcting an earlier version of this row after CodeRabbit's review on PR #1773: it is not true that the ledger "has no in-progress state" — some rows do carry a progress marker in their prose (`IN PROGRESS` appears on two, and `IMPLEMENTED in PR #1766` on another). The accurate gap is narrower and worse: there is no structured status field and no atomic claim, so a marker is written by whoever did the work, usually after the fact, and nothing requires or checks one — which means the ABSENCE of a marker carries no information at all. Both sessions read it, both correctly concluded it was open, both built it. The wasted effort is the smaller cost; the larger one is that the two implementations diverged in shape, which is what forced the separate `PageSection` ownership decision recorded in `docs/search-chrome-behaviour.md`. Distinct from `#156`/`#168`, which are about two branches colliding on an **id** while appending; this is two sessions colliding on the **work** a row describes, and a collision-free id scheme would leave it untouched. **Mitigation landed 2026-08-09 (same PR as this row):** the check is now written into the three places an assistant actually reads before starting queued work — `.claude/skills/newtask/SKILL.md` "Before you start" (which already performed an open-PR read for PR bundling, so this asks that same list a second question and costs no extra call), `.claude/skills/issues/SKILL.md` after the read-only flow, and the `/issues` section of `AGENTS.md` so Codex and Cursor get it too rather than Claude Code only. All three say to scan for the **route, component or surface**, not the ledger id, because a duplicate PR rarely quotes the id; all three degrade to a warning when GitHub is unreachable so an offline session can still start work. **Next:** leave open for one or two queued-item cycles to see whether prose is enough. If a second duplicate lands anyway, this becomes the same class as `#258` — a rule enforced for one tool by prose with no gate — and the answer is a check, not more wording. **Stop:** do not implement a claim marker written back into the row when a session starts an item; that reintroduces exactly the read-modify-write contention `#168` exists to remove. Do not make the open-PR read a hard blocker. | session 2026-08-09; PR #1766 (merged); PR #1767 (closed duplicate) | 2026-08-09 |
-| #293 | P2 | issue | Gate 2 needs a phone-viewport deterministic surface; the `min-h-tap` 0px finding is REFUTED | **CORRECTS this row's original text, which was wrong on its central claim.** FINDING 1 IS REFUTED (2026-08-12). As first written it asserted that controls carrying `min-h-tap` have their declaration "overridden to 0", blamed "likely an unlayered component class in globals.css", and treated the six shapes as a live 48px-floor defect. All of that is wrong, and acting on it would have caused a regression. **What actually zeroes the min-height is the source itself, deliberately:** the sites carry an explicit `sm:` step-down beside `min-h-tap`. The two 36px shapes are exact matches — `services-navigator-page.tsx:217` is `grid min-h-tap min-w-tap … sm:h-9 sm:min-h-0 sm:w-9 sm:min-w-0` and `:286` is `inline-flex min-h-tap min-w-[94px] … sm:h-9 sm:min-h-0`. `sm:min-h-0` IS the computed `min-height: 0px`, and `sm:h-9` IS the rendered 36px. Seven `min-h-tap` sites carry `sm:min-h-0`; the wider pattern is larger still — `inline-flex min-h-tap items-center` alone appears with `sm:min-h-0` (4), `sm:min-h-7` (2), `sm:min-h-8` (2), `sm:min-h-9` (4), `sm:min-h-10` (8) and `sm:min-h-12` (1). **`min-h-tap` is a PHONE floor that desktop deliberately releases**, which is why the audit only sees it below the floor: `tests/ui-style-contract.spec.ts:97` navigates at the project's desktop viewport, so every `sm:`-and-up override is in force at measurement time. The audit was measuring intended design and reporting it as an overridden floor. **Do NOT "fix" these** — removing the step-downs would pin every desktop control to 48px and is a visual regression across the app, not a WCAG improvement (the phone contract already exceeds both AA 2.5.8 and AAA 2.5.5). The `declared < tapFloor - 0.5 continue` skip at `:116` is therefore correct at desktop width and is NOT the same structural blind spot as the `h-10` case in `#265`. FINDING 2 STANDS UNCHANGED and is the whole of the remaining work: a rendered-interactive enumeration on `/services?q=CMHT&run=1` is NOT DETERMINISTIC — six runs against one production build returned 6, 5, 4, 3, 3 and 9 distinct control shapes, largely disjoint; `waitForLoadState('networkidle')` plus deduplication to distinct shapes did not fix it, and two consecutive agreeing runs were coincidence. The enumeration was written, shown to find genuine defects, and REVERTED rather than landed, because that spec runs in the required Production UI job via `productionSpecPattern` and `scripts/playwright-pr-shards.mjs`, so an intermittent version would block every merge. **Next, revised:** (1) build the deterministic surface — a static route with no async search, or a fixed seeded state; (2) run the tap enumeration **at a phone viewport**, where `min-h-tap` is unreleased and the measurement is meaningful, rather than at desktop where the floor is intentionally lifted; a phone layout is also the simpler, more deterministic surface, so (1) and (2) push the same way. Step (2) of the original row — "find what zeroes min-height on the min-h-tap carriers" — is CLOSED by this correction: the answer is `sm:min-h-0`, and it is intended. **Stop:** do not re-land the enumeration on a live-search route; do not quarantine a brand-new test to get it merged (quarantine is for flaky tests already trusted, and policy needs three reproductions on one SHA via `tests/flake-ledger.json`); do not lower any production tap target, and never to `min-h-11` (known `ui-smoke` sub-pixel flake; production uses the 48px token). | session 2026-08-09 — M2 gate 2 enumeration (#265); finding 1 refuted session 2026-08-12 against `origin/main` 4587f78 (`services-navigator-page.tsx:217,286`; `tests/ui-style-contract.spec.ts:97,116`) | 2026-08-09 |
+| #292 | P2 | rec | Two assistants built the same queued conversion twice because neither workflow checks the open-PR list before starting | Recurred 2026-08-14 on the database remediation plan, this time with two assistants building Phase 0: PR #1938 and PR #1939 both implemented live-drift failure routing and the post-migration trigger, merged four hours apart. Both landed and no harm resulted — #1939 built on #1938's commit and improved it, moving the findings capture after the migration-history step so a migration-history failure is visible instead of a clean drift result being published as its explanation. The cost was still two full authoring sessions and two CI cycles for one deliverable. This matters more for the phases still ahead than it did here: Phase 1 consumes an approved read-only production window, and Phases 3 and 4 consume approved mutation windows and live eval-canary budget, so a duplicate there wastes an operator-gated resource rather than just tokens. Concrete ask for the remediation work specifically: check the open-PR list for the surface before starting any of Phases 1-5, per docs/database-remediation-playbook.md. | session 2026-08-09; PR #1766 (merged); PR #1767 (closed duplicate) | 2026-08-09 |
 | #299 | P3 | task | Adopt ErrorState at the three surfaces that genuinely hand-roll the failed-request guard | **DEPRIORITISED 2026-08-12 (yield review against current main).** Three surfaces hand-roll a guard that works. Converting them is consistency, not a fix. VERIFIED CORRECT 2026-08-12 — re-checked against merged main during the full ledger sweep and left unchanged: ErrorState has no product importer beyond src/components/ui/error-state.tsx, so the three hand-rolled surfaces are still unconverted. (Its ENFORCEMENT is closed — see archived #298.) This stamp exists so a later reader can tell "checked and still true" from "never looked at"; the two were indistinguishable before. Three surfaces hand-roll the guard and their comments state the rule outright: src/components/clinical-dashboard/search-results-header-band.tsx:210 ('no number may reach the DOM'), src/components/services/services-navigator-page.tsx:634 ('a blocked registry must not reach the band as 0 matches'), src/components/clinical-dashboard/favourites-command-library-page.tsx:1182. They are CORRECT today, just not shared, so this is convergence rather than a bug fix. The band's fault panel is the richest existing implementation (role=alert, warning tokens, AsyncButton retry with busy state, faultAction slot) and ErrorState was modelled on it, so the shapes already line up. Live-look change: own PR, Chromium pass. Per the M4 brief it sits DOWNSTREAM of design decisions the owner has not made, so doing it before the site-wide redesign risks redoing it. Do NOT bundle with the enforcement check. Stop: only these three - see the sibling row for three sites that were miscarried as guards. | session 2026-08-09 M4 - ErrorState build | 2026-08-09 |
-| #302 | P3 | rec | Design-system contract ratchets re-accumulate slack because paying debt down does not re-pin the ceiling | RE-MEASURED 2026-08-12 and the gap has WIDENED, which strengthens this row rather than dating it. `scripts/design-system-contract-baseline.json` still pins legacyShadowAliases at **220** while `node scripts/check-design-system-contract.mjs` measures **193** today — 27 units of slack, up from the 3 units (220 vs 217) this row recorded on 2026-08-10. The cause is exactly what the row names: paying debt down does not re-pin the ceiling, so #262's --shadow-tight retirement bought 24 more units of unguarded headroom instead of tightening the gate. Twenty-seven files could each gain an alias without failing. Next unchanged: re-pin ratchet ceilings to the measured value whenever debt is paid, the way ledger #264 corrected edgeOwnershipConflicts on 2026-08-09 — ideally as part of the same PR that pays the debt, so the two cannot drift. Companion measurements from the same run, for whoever re-pins: edge conflicts 27, 1px shadow spreads 2, layout transitions 11, hardcoded CSS durations 42, raw CSS z-index 9. | session 2026-08-10 shadow-tight retirement (PR #1803) | 2026-08-10 |
 | #305 | P3 | rec | Canary has no latency-mode coverage and its cost readout is a known lower bound | Two informational gaps from the 2026-08-12 canary review, deferred by scope decision. (1) eval:retrieval:latency (p90 20s gate) is never wired into eval-canary.yml, so live retrieval latency regressions are invisible to the weekly canary while the answer step relaxes its own gates via EVAL_LATENCY_CONTEXT=cross-region-runner. (2) estimated_cost_usd applies one rate set (gpt-5.6-terra) to all usage including 2x-priced strong-model retries, so any cost trend understates strong-retry runs — the workflow comments say so, but eval:trend consumers may not read them. Also noted: the workflow-wide concurrency group (eval-canary, cancel-in-progress false) can queue a dispatched pair run behind a scheduled run, interleaving pair evidence; and fixture coverage gaps tracked in #018 remain uncatchable by the canary. Next: decide whether a monthly latency-mode dispatch is worth the spend; add a strong-usage split to the estimator if cost trends start driving decisions. | session 2026-08-12 RAG canary review | 2026-08-12 |
-| #308 | P3 | issue | Desktop /documents/search CLS is 0.119, above threshold and stable across runs and baselines | Measured 2026-08-12 during the #147 close-out, twice, on the offline Lighthouse harness (Chromium 141): desktop /documents/search CLS **0.119**, against a committed baseline that also reads **0.119**. So this is long-standing and deterministic, not a regression — and it is above the 0.1 threshold. It sits outside #147's scope, which was mobile only, and it contradicts that row's claim that 'desktop passes everywhere: 0.016-0.097' — that range is stale. Companion desktop values from the same runs, all passing: /dsm 0.014, /forms 0.059-0.064, / 0.006, /therapy-compass 0.000. Next: attribute it the way #147 was attributed — drive Chromium against the offline production build with a PerformanceObserver on layout-shift reading entry.sources[].node, at DESKTOP emulation this time. Do not assume it is the same phone-overlay reserve cause as #147; that reserve publishes 0px above the phone breakpoint by construction, so this is a different shifter. Stop: do not raise the budget to accommodate it, and do not read local LCP or TBT from that harness (loopback has no network latency). | Local offline verify:lighthouse runs 2026-08-12 (two runs, identical CLS); #147 close-out; lighthouse-budget.json | 2026-08-12 |
-| #309 | P2 | task | Facet groups of 6-20 options render as chips, not the dense list docs/filter-contract.md section 5 requires | Raised by the Codex reviewer on PR #1858 and correct. docs/filter-contract.md section 5 sets density by option count: <=5 chips, 6-20 dense full-width list with a right-aligned count column and group headings, >20 or >3 groups adds find-a-filter and collapse-by-default. **PARTIALLY DELIVERED 2026-08-13, and the part this row was opened for is NOT done.** PR F (#1910) ported documents' implementation up into the shared ResultFilterSheet, so the >20-or->3-groups tier now exists there: find-a-filter, per-group collapse-by-default, a group opening itself when it holds a selection, and a live needle owning openness. That is the tier documents needed. **The 6-20 band is still unimplemented.** result-filter-control.tsx computes `const dense = facetGroups.length > 3 \|\| totalFacetOptions > 20`, so a mode with one facet group of nine options — formulation, the exact case that opened this row — evaluates dense=false and still renders ResultFilterFacetChips as a wrapping chip row. Verified 2026-08-13 on main 2d27039: formulation passes one group with formulationDomainsInUse.length === 9, so neither condition fires. An earlier attempt to close this row as delivered was wrong and was caught in review on PR #1925; the mistake was conflating "the dense tier landed" with "this row's band landed" — section 5 has two thresholds and only the upper one shipped. **Next:** either implement the 6-20 full-width renderer with the right-aligned count column and add the nine-option DOM assertion this row already asked for, or amend section 5 to drop the middle band deliberately and record that the contract was reversed rather than satisfied. **Stop:** do not close this row on the strength of the >20 tier, and do not add a per-mode dense list — a second hand-rolled facet layout is the drift the shared renderer was extracted to remove. | Codex review on PR #1858; docs/filter-contract.md section 5 | 2026-08-12 |
-| #310 | P2 | issue | Fuzzy catalogue search can match a DIFFERENT drug: fluoxetine to duloxetine at edit distance 2 | NOT REACHABLE ON MAIN AS OF 2026-08-13, AND NOT BECAUSE IT WAS FIXED. The whole matcher is gone: git show origin/main:src/lib/catalog-search.ts \| grep -c typoDistanceLimit returns 0, and eight of the 11 files PR #1800 touched are byte-identical to their pre-#1800 state after merge acf78bf. Three files (`src/components/therapy-compass/data/select.ts`, `src/lib/formulation.ts`, and `tests/formulation.test.ts`) contain later unrelated changes, but the fuzzy-search hunks are absent from them too; preserve those newer changes during the re-land. So this row is not currently a live clinical hazard, but it must NOT be closed: the fix belongs in the re-land of #1800, not as a patch to main. See the two rows filed 2026-08-13 for the re-land and for the merge-loss detector. Re-run 2026-08-13 against the algorithm re-confirmed every measurement below, including that citalopram and escitalopram correctly do not match because the substring guard fires first. Original 2026-08-12 measurement retained: MEASURED 2026-08-12 by running the matcher itself, not by reading it. PR #1851 adds Damerau-Levenshtein typo recovery to src/lib/catalog-search.ts (fuzzySearchTokenCount, boundedTypoDistance, typoDistanceLimit) and folds it into the score. The tier term.length >= 8 -> 2 edits is the problem: Damerau counts an adjacent transposition as ONE edit, so fluoxetine -> duloxetine is distance 2 (substitute f->d, transpose lu->ul) and both are 10 characters. Confirmed hits against the PR's own algorithm: **fluoxetine -> duloxetine** (SSRI vs SNRI, different drugs), **prednisone -> prednisolone** (different drugs). Intended cases also confirmed working: sertraline -> setraline, olanzapine -> olanzepine. The existing guards DO hold — SSRI/SNRI, ADHD/ODD, citalopram/escitalopram, clozapine/clonazepam and quetiapine/olanzapine all correctly return no match. ONE MITIGATION, stated so this is not over-read: terms under 5 characters are excluded entirely. The fuzzy trigger is evaluated independently for each candidate record, so the hazard persists when both the exact drug and a two-edit near-match are present: the exact record receives a literal score while the wrong drug can independently receive a fuzzy score and appear as an additional result. Blast radius is wide because catalog-search.ts feeds ELEVEN modules — medications.ts (prescribing), dsm.ts, differentials.ts, differential-stream.ts, universal-search.ts, specifiers-search-index.ts, tools-catalog.ts, form-ranker.ts, service-ranker.ts. TESTED FIX: capping the >=8 tier at 1 edit removes both cross-drug hits and preserves every legitimate typo recovery in the sample — a one-line change to typoDistanceLimit. Next: do not patch main -- there is nothing there to patch. Apply the >= 8 tier cap of 1 edit inside the #1800 re-land, in the same commit, with a test over real catalogue drug names carrying both the exact and the near-match record and asserting the wrong drug is excluded while the exact drug remains. Stop: do not remove fuzzy search outright -- the typo recovery is genuinely useful and the guards are otherwise well judged, and do not close this row on the grounds that the code is currently absent. Note classifyPullRequestFiles returns clinicalRisk true for this path so the governance preflight fires, but ragRanking false, which is correct: this is catalogue ranking, not the pgvector retrieval path. | session 2026-08-12; PR #1851 (codex/investigate-recent-regression-issues); algorithm re-run locally against real drug-name pairs; src/lib/catalog-search.ts | 2026-08-12 |
+| #308 | P3 | issue | Desktop /documents/search CLS is 0.119, above threshold and stable across runs and baselines | Measured 2026-08-12 during the #147 close-out, twice, on the offline Lighthouse harness (Chromium 141): desktop /documents/search CLS **0.119**, against a committed baseline that also reads **0.119**. So this is long-standing and deterministic, not a regression — and it is above the 0.1 threshold. It sits outside #147's scope, which was mobile only, and it contradicts that row's claim that 'desktop passes everywhere: 0.016-0.097' — that range is stale. Companion desktop values from the same runs, all passing: /dsm 0.014, /forms 0.059-0.064, / 0.006, /therapy-compass 0.000. Desktop attribution completed 2026-08-14: a Playwright + PerformanceObserver(layout-shift) harness against an offline production build at 1350x940 DPR 1 recorded **0.118** CLS. This is a separate attribution measurement, not a replacement for the canonical 0.119 Lighthouse value. One first-paint+~0.3-0.5s event contributed ~99.98% of that harness total: MasterSearchHeader's composer-adoption effect portals the search composer into GlobalSearchShell's desktop slot, while the header shrinks 184px and the slot grows 0 -> 184px. This is shared desktop search-chrome timing, not page-local. Next: reserve the settled height at the adoption boundary under the one-composer/hidden-means-zero-reserve contracts, then re-measure with the same harness. Stop: do not raise the CLS budget; do not read local LCP or TBT from the loopback harness; and do not use a blanket min-height that hides the shift without matching the header reserve. | Local offline verify:lighthouse runs 2026-08-12 (two runs, identical CLS); #147 close-out; lighthouse-budget.json. Attribution: session 2026-08-14, PR branch codex/visual-layout-polish; desktop CLS script adapted from scripts/measure-cls-attribution.mjs (offline, not committed). | 2026-08-12 |
+| #309 | P2 | task | Facet groups of 6-20 options render as chips, not the dense list docs/filter-contract.md section 5 requires | Attempted 2026-08-14: an implementation task for chips-for-6-20 was stopped before any code was written, because it directly contradicts this row's own current, still-open text, which requires a full-width DENSE LIST (right-aligned count column, group headings) for the 6-20 band, and explicitly says chips-for-6-20 does not satisfy this row. Confirmed chips-for-6-20 is ALREADY the live behaviour (dense = facetGroups.length > 3 \|\| totalFacetOptions > 20 in result-filter-control.tsx), and that closing this row on that basis was already tried once and explicitly reverted (PR #1925, 'correct #309 to partially delivered'). No code changed, no PR opened. Needs a product/design decision between: (1) build the genuine full-width dense-list renderer plus the nine-option DOM assertion this row asks for, or (2) formally amend docs/filter-contract.md section 5 to deliberately drop the middle band with reviewer sign-off -- different from what already happened (a silent merge-conflict resolution the row says didn't count). | session 2026-08-14, agent stop per contract contradiction | 2026-08-12 |
 | #311 | P3 | task | Promote the derived ledger loss-detector into scripts/ — it has now earned its place twice | During the 2026-08-12 sweep, two main-merges silently reverted edits to `docs/outstanding-issues.md`, including the ENTIRE #293 refutation (a `grep sm:min-h-0` returned 0; the text survived only in commit a6bfc6f). It went unnoticed because the recovery script was HAND-ENUMERATED — it listed 15 archives and 8 updates from one commit and could therefore only restore what the author remembered. The replacement is derived rather than listed: read every row id this branch has ever stamped out of `git rev-list <merge-base>..HEAD` plus `git show <commit>:docs/outstanding-issues.md`, then assert each of those ids that is still OPEN carries its stamp text, and exit non-zero listing any that lost it. It has now proved itself twice — it caught the intentional #262 divergence (main's version was newer than the branch's, correctly left alone) and would have caught the #293 loss the hand-written list missed. The plan that created it said it should stay a scratch script 'unless it proves useful more than once'; that condition is met. Next: port it to scripts/ (suggested `check-ledger-stamp-retention.mjs`), generalise the stamp token from the hard-coded 2026-08-12 date to a `--since` or marker argument, add a self-test in the style of the other ledger scripts, and document it beside `ledger:dedupe` for use after any main sync that touches the ledger. Stop: do NOT wire it into verify:cheap or CI — it is a branch-local safety net for a human or agent mid-sweep, and it has no meaning on a branch that has not stamped rows. Related: #156 and #168, which track the id-allocation race that produces these merges in the first place. | session 2026-08-12 ledger sweep; scratch loss-check.mjs; #293 restoration from a6bfc6f | 2026-08-12 |
-| #312 | P3 | issue | check:playwright-browser-revision reporting OK does NOT mean browsers are installed — and installing the matching revision is a cheap first option | Two corrections learned the expensive way on 2026-08-12, both about browser proof in a cloud container. (1) **The check is easy to misread.** `npm run check:playwright-browser-revision` returned 'Playwright browser revision check OK (managed-or-unconstrained): No designated container browser root is forced; use the Playwright-managed cache or install matching browsers.' That reports that no browser root is FORCED — it does not assert any browser exists. It was read as a green light for `verify:ui`, and two subsequent Playwright runs died at preflight instead: the container carried chromium-1194 while Playwright 1.62.1 requires chromium_headless_shell-1234, with firefox-1538 and webkit-2336 absent entirely. Suggested fix: have the check say plainly which browsers are present and which the locked Playwright version requires, so 'OK' cannot be mistaken for 'ready'. (2) **Installing the matching revision works and is fast**, which archived #255's 'delegate browser proof to CI Production UI' guidance does not mention. `npx playwright install chromium` fetched 114.7 MiB in about a minute and made local Chromium proof possible — three full ui-smoke runs then completed at 2.8-3.0m each (this is how #290 was settled). It is a cheaper first option than deferring to CI. Two things that matter alongside it: `PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD` was EMPTY in this container, so the download was never blocked despite the environment note implying otherwise; and only Chromium is needed, because `scripts/playwright-browser-preflight.mjs:127-152` honours `--project`, so `--project=chromium` skips the firefox/webkit requirement rather than forcing two unused ~100MB downloads. Stop: do NOT set PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH at the stale 1194 binary to get past the preflight — archived #255 warns against forcing a mismatched path, and the preflight's own message warns that a later 'N failed' summary must not then be read as a product regression. | session 2026-08-12; scripts/playwright-browser-preflight.mjs:127-152; scripts/run-playwright.mjs:50-53; #290 close-out; archived #255 | 2026-08-12 |
-| #313 | P2 | issue | check:ledger-write-discipline reports a pass when run against an uncommitted working tree | Found 2026-08-13 while closing #170/#309. The gate compares a committed range (it reported `Ledger write discipline passed for 2d270392f9cf..HEAD`), so when the ledger edit is still unstaged or uncommitted the range is empty and it prints a pass having evaluated nothing. I edited docs/outstanding-issues.md directly, ran the gate, saw green, and only discovered the violation after committing to a branch and re-running — at which point it correctly failed with "does not exactly match the audited application of 0 moved inbox request(s) from the base". The green was real but meaningless, which is the worst kind: it actively told me a forbidden edit was fine. **Outcome:** the gate either refuses to report a verdict when the working tree is dirty for the files it governs, or evaluates the working tree as well as the committed range. **Next:** make check-ledger-write-discipline.mjs detect uncommitted changes to docs/outstanding-issues.md (and the inbox directory) and either fail with an explicit "commit before checking" message or include them in the audited diff. Add a self-test covering the dirty-tree case, since the existing self-test passes today. **Related contributing factor worth fixing in the same pass:** `node scripts/outstanding-issues.mjs done ...` and `npm run issues:done` are different tools — the first edits the canonical ledger in place (reconcile-side), the second queues a merge-safe inbox request via scripts/ledger-inbox.mjs (branch-side). Nothing at the call site says so, and the raw script is what AGENTS.md's usage header documents. Consider making scripts/outstanding-issues.mjs refuse to run outside a reconcile context, or print a pointer to issues:done. **Stop:** do not "fix" this by relaxing the discipline check — the check itself was right, it just was not asked the right question. | session 2026-08-13 closing #170/#309; scripts/check-ledger-write-discipline.mjs; scripts/ledger-inbox.mjs vs scripts/outstanding-issues.mjs | 2026-08-13 |
+| #312 | P3 | issue | check:playwright-browser-revision reporting OK does NOT mean browsers are installed — and installing the matching revision is a cheap first option | Progress 2026-08-15: PR #1965 landed on main (commit 3ec6116) and closes the false-OK gap for the pinned Chromium revision by resolving the effective cache and requiring a launchable binary. Keep this issue open: the unscoped test:e2e and release matrix also require Firefox and WebKit, and the check does not yet report whether their locked revisions are installed. Next: enumerate required and installed revisions for all browser families, with a Chromium-only-cache regression; project-scoped --project=chromium runs may continue to require Chromium alone. | session 2026-08-12; scripts/playwright-browser-preflight.mjs:127-152; scripts/run-playwright.mjs:50-53; #290 close-out; archived #255 | 2026-08-12 |
 | #314 | P2 | issue | Ship compact compressed registry projections and verify live transfer | Next: land the existing view=summary/search and gzip implementation, deploy it, then verify /api/registry/records on the exact deployment SHA returns counts-only home responses and compressed compact search responses. Why: the live full payloads measured on 2026-08-13 were 482786 bytes for Forms and 1096689 bytes for Services and were downloaded by count/search-only consumers without Content-Encoding. The local projections reduce raw search data by about 91.3% and 82.0%, with gzip responses about 4.9 KB and 27.3 KB. Context: latency and Sentry review. Owner: assistant. Confidence: high. Depends on: #013 and #016. Gate: focused registry/consumer tests, production build and bundle budget, then post-deploy headers/bytes and live LCP rerun. Stop: do not close from local-only payload measurements or deploy without explicit authorization. | session 2026-08-13 latency review; src/app/api/registry/records/route.ts | 2026-08-13 |
 | #315 | P3 | rec | If the ui-smoke scroll-hide flake (archived #290) recurs, start from the reporter-stranding mechanism — and treat the old regression window as unconfirmed | Independent verification on 2026-08-13 (second session, fresh cloud container, pinned Chromium 1234 installed per #312) measured the archived #290 flake at BOTH ends of its recorded window and corrects the archive's causal story: the bad SHA 9ab3b73ad itself passed 16 recorded executions — reproducer isolated --repeat-each=5 (5 passed, ~1.0s each), one full tests/ui-smoke.spec.ts --project=chromium run (98 tests passed, 2.5m, 0 flaky), and reproducer x10 under deliberate CPU contention (6 busy-loop processes on 4 cores, run times 1.2-1.5s: 10 passed). Current main a76f280 also 5/5. So the recovery was NOT drift — the exact commit that measured 2/5-3/5 failures passes cleanly here — and the e8adde1b9..9ab3b73a window is unconfirmed; the failure was specific to the original machine's environment/load profile. Recorded as a comment on PR #1884 (issuecomment-5272932999). On recurrence, do not re-bisect first: test the stranding mechanism. computeScrollHideUpdate (src/components/clinical-dashboard/use-hide-on-scroll.ts) re-evaluates only on scroll/resize events, and its viewportHeightChanged / maxOffset-range-change guards deliberately zero accumulated down-travel (contract-asserted in tests/use-hide-on-scroll.test.ts) — so geometry churn consuming the final steps of a gesture strands the not-hidden state permanently until the next event, matching the recorded ~11.5s toHaveAttribute timeout signature (the assertion DOES auto-retry for 10s; the attribute genuinely never flips). Fastest confirmation: a diagnostic page.on('console') trace logging which guard fires per evaluation. The window itself was one PR (#1744 mode-routing, true merge a503c22) whose net diff touched no scroll-hide code — content-bisect axes, if ever needed: tests/ vs src/ split, use-home-mode-seed/use-last-app-mode neutralized, prefetchModeDestination reverted, positional heading click restored to a settle wait. Stop: any guard change is a behaviour change to protected phone chrome — needs a failing trace first, never speculatively; do not weaken the assertion or tap targets. | session 2026-08-13; PR #1884 comment; archived #290; #312 | 2026-08-13 |
-| #316 | P1 | issue | Live DB is missing 21 repo-defined indexes and 10 retrieval RPC bodies diverge; weekly live-drift has been red since 2026-07-26 with no routing | APPEND 2026-08-13: full remediation + future-proofing plan is at docs/database-remediation-plan.md (phases 0-7: routing + post-migration drift trigger, read-only forensics, staging rehearsal #056, RPC reconciliation before index restoration, batched CREATE INDEX CONCURRENTLY + 20260804110240-pattern guard migrations, EXPLAIN/#231 re-measure, history-integrity probe, guard-migration contract, DR codification #196-#200, deferred #022/#025/#036/#191). This row is the tracking anchor and follows the plan approval map. The 2026-08-09 scheduled live-drift run (Actions run 31330856982) reports 21 missing_live indexes across multiple migrations, 2 unexpected_live indexes, and def_hash mismatches on 10 match_* retrieval RPCs (protected RAG surface — diff before touching). The migration-history cause remains unresolved: distinguish skipped DDL/history repair from later index drops with the approved read-only fingerprint and audit check before attributing the drift. No hosted mutation without approval. | session 2026-08-13 / Actions runs 30763871562 + 31330856982 / open #248 | 2026-08-13 |
+| #316 | P1 | issue | Live DB has 20 currently missing repo-defined indexes and 10 retrieval RPC bodies diverge; weekly live-drift has been red since 2026-07-26 with no routing | Combined 2026-08-14 update, superseding the two partial requests cancelled in this same batch. PHASE 0 CLOSED including the forced-dispatch proof its definition of done required: live-drift dispatched on main (Actions run 31813064485) failed at the drift step, the always() capture step still ran, the migration-history step correctly skipped, and the separate drift-routing job then created issue #1963 "Live drift check failing" carrying the label, run URL, job result, trigger and the full findings block. Routing is now also covered offline by tests/live-drift-workflow.test.ts, mutation-verified. INCIDENT REPAIR, owner-approved in-session: the two retrieval-critical indexes documents_title_trgm_idx and document_chunks_content_trgm_idx were restored with CREATE INDEX CONCURRENTLY plus ANALYZE, both indisvalid and indisready at 648 kB and 68 MB, re-verified afterwards by an independent read-only query. Before and after supabase_rpc_latency_ms 31610 to 1535 on the text fast path and 8519 hybrid, with match_document_chunks_text_v2 at 14 ms. No repo schema change was needed because the definitions were already codified. CORRECTED FIGURES measured 2026-08-14, superseding the 2026-08-09 numbers this row was opened with: 10 match_* def_hash mismatches (unchanged), 20 missing_live indexes rather than 21, and the same 2 unexpected_live. ATTRIBUTION STILL OPEN: migration 20260705180000 recorded 14 executed statements so it was not mark-applied, and the 20260804110240 guard validates four other indexes and never checks this pair, so it gives no existence bound for 2026-08-04. The drop window is therefore 2026-07-05 to 2026-08-02 and the dashboard audit-history pairing remains owner action; #248 stays open. NEXT: Phase 3 RPC reconciliation before Phase 4, per the plan's ordering that the change which can alter clinical answers precedes the ones that only speed them up. Evidence: docs/audit/live-drift-forensics-2026-08.md. | PR #1968 review against docs/audit/live-drift-forensics-2026-08.md, 2026-08-15 | 2026-08-13 |
 | #317 | P2 | task | Verify registry-backed service records preserve facet metadata | #1878 introduced the services filter-contract tree and #1882 later merged the identical tree, so no merge-conflict audit is required. Current main uses ServiceRecord.catalogPayload.tags and fixture coverage verifies 219 records. Add focused offline tests that recordToRow and rowToServiceRecord preserve all six tag dimensions and degrade safely when payloads are malformed or absent. Do not add a second facets carrier unless a failing test proves the current contract inadequate. | PR #1921 review; #1878/#1882 tree comparison; service-facets.ts; registry-records.ts | 2026-08-13 |
 | #318 | P1 | task | The medication interaction lexicon has never been clinically reviewed and its sign-off block is empty | docs/medication-interaction-lexicon-review.md is generated by npm run medications:lexicon-report and expands every lexicon term to the catalogue drugs it resolves to, with how many CRITICAL/HIGH rows depend on it, sorted by severe usage. It is marked UNREVIEWED and its sign-off table is unfilled, so every red and amber drug-drug interaction alert is currently an unvalidated mapping over source-backed text. The wording shown to a clinician is always verbatim catalogue prose; what is unreviewed is which drugs a phrase like 'NSAIDs' or 'CNS depressants' was taken to mean. The sheet has already produced three defects on generation alone (ARB matching Carbapenem across 16 CRITICAL/HIGH rows; two divergent Warfarin records; lithium unreachable from eight HIGH rows), which is a fair indication of what reading it would still find. Next: a clinician reads the term table top-down (it is sorted so the top ten terms carry most of the severe usage) and fills in the sign-off block. Stop: do not treat check:medication-lexicon-report passing as review - that check only proves the sheet describes the current lexicon, not that the mappings are correct. | PR #1923; docs/medication-interaction-lexicon-review.md; docs/samd-classification-medication-considerations.md | 2026-08-13 |
-| #319 | P2 | task | Re-land PR #1803 (--shadow-tight retirement onto --e1); 67 files on main still use the retired alias | PR #1803 squash-merged as 9d8370a on 2026-08-10, retiring the --shadow-tight role alias onto the --e1 elevation tier across 49 files. All 49 are byte-identical to their pre-#1803 state on main. Independent confirmation that does not rely on blob identity: git grep -l shadow-tight over src/ on main returns 67 files. Cause is the same merge, acf78bf; see the merge-loss detector row filed alongside this one. Commit 6f8c70d 'fix(pr-1815) resolve main merge conflict and keep shadow-tight switch migration' shows the migration was consciously preserved once and reverted again by a later merge in the same chain. Interaction with existing rows: #302 records scripts/design-system-contract-baseline.json pinning legacyShadowAliases at 220 while the checker measures 193 -- that gap is partly this loss, so re-landing #1803 should move the measurement sharply and #302 should be re-measured afterwards rather than actioned on its current numbers. #262 (DS Track A3, design-token debt) is also downstream of this. Next: cherry-pick 9d8370a onto current main and resolve against the token work that has landed since; this is mechanical but wide. Gate: npm run test on the design-token contract tests plus tests/tailwind-merge-config.test.ts, then check:design-system-contract. Stop: do not refresh the design-system contract baseline to absorb the change -- the point is that the measurement moves. Do not bundle with the #1800 re-land; that one carries a clinical governance preflight and this one does not. | session 2026-08-13; 9d8370a; acf78bf; 6f8c70d; git grep shadow-tight on origin/main at 63526ee; rows #302 and #262 | 2026-08-13 |
 | #320 | P3 | task | Crop-to-page overlay remains unbuilt; bbox already reaches viewer state at runtime but is untyped, unvalidated, and unused | **Outcome:** selecting an indexed table or diagram can highlight its region on the PDF page, or the capability is deliberately retired — either way it stops living only in a plan document. **Detail:** this is the one Phase 3 capability never built (docs/plans/document-viewer-redesign-plan.md, Phase 3 table, 'Out of scope'). It had no ledger row until now, which is how work disappears between sessions: the plan doc marks it out of scope and nothing in durable memory says it remains owed. **The data path is partially live, not dropped.** src/lib/document-detail.ts SELECTs bbox alongside the other image columns, and withImageTableMetadata spreads every selected field except metadata. bbox therefore survives the runtime response and reaches DocumentViewer's image state. The gap is static and behavioural: DocumentDetailImage in src/lib/document-detail-contract.ts does not declare bbox, ImageRow in src/components/document-viewer/types.ts aliases that contract, no normalisation validates the stored value, and no viewer code renders it. Verified against exact PR head 2ac0f48a820be62947112efbb5d0845a702dad8e on 2026-08-13. **Shape of the work, in order:** (1) establish the ingestion coordinate space and stored shape, add a normalised bbox field to DocumentDetailImage, and add a focused loader or route-serialization test proving bbox survives with the promised shape. Do not change the selected-field mapping unless that test demonstrates an actual loss. (2) Only then draw the highlight over the rendered page when a figure is selected, accounting for the virtualized page column, the per-page raster scale from resolveViewportScale, and rotation. **Why it was scoped out rather than overlooked:** the contract and normalisation work has a wider blast radius than the component-only Phase 3 diff, and crop geometry quality from ingestion is separate debt — the redesign plan's residual-risk section says not to block viewer UX on perfect crops. **Stop:** do not land the typed-contract and normalisation half inside a viewer-only PR; it changes what the document-detail API promises and needs its own review and governance preflight. Do not render raw, unvalidated bbox values — a highlight over the wrong region of a clinical source is worse than no highlight. | session 2026-08-13 document-viewer remaining-work inventory; docs/plans/document-viewer-redesign-plan.md Phase 3 table; src/lib/document-detail.ts bbox projection | 2026-08-13 |
 | #321 | P3 | task | Four follow-up groups cover nine controls after #291 | Six controls in the differential comparison page stay coupled to its planned rewrite and pinned density test. The filmstrip Page unknown control is a later mechanical change. DocumentViewer needs its persistent access reason split from transient loading before classification. The pin-limit control remains a capacity-state judgement. These are four source groups and nine controls, not four controls. | PR #1778 body; verified against main 2d27039 | 2026-08-14 |
 | #322 | P2 | issue | Two catalogue records are both named Warfarin and share no interaction rows, so which one a clinician opens changes the warnings | data/medications-snapshot.json holds warfarin-vka and warfarin-anticoagulant, both displayed as 'Warfarin', both class Anticoagulant / subclass Vitamin K Antagonist. They carry three interaction rows each with ZERO in common, so the alerts a clinician sees depend on which record they happened to open, and nothing on screen distinguishes them. A lexicon class term resolves to both. This is a catalogue DATA defect, not a lexicon fault - merging, deleting one, or relabelling them is a clinical content decision, which is why it is reported rather than patched. Surfaced automatically by duplicateCatalogueNames in scripts/build-medication-lexicon-report.ts, which compares the row sets and states the divergence rather than asking about it, and pinned by a test in tests/medication-interaction-lexicon-coverage.test.ts that goes red when the records are reconciled so the flag can be retired with it. Next: a named clinical owner decides the disposition. Stop: do not de-duplicate by display name in the report or the UI - that hides the divergence rather than resolving it. | PR #1923; docs/medication-interaction-lexicon-review.md flag section; tests/medication-interaction-lexicon-coverage.test.ts | 2026-08-13 |
 | #323 | P2 | task | 35 of 328 catalogue medications sit outside the resolved interaction graph, so the tool can never warn about them | Measured 2026-08-13 from data/medication-interaction-index.json using both endpoints of every row with a resolved counterparty: 35 of the catalogue's 328 medications sit outside the resolved interaction graph. They are concentrated in aperients (8), antibiotics (5), antidiabetics (4) and vitamins (3); psychiatry-relevant examples include topiramate and zolpidem. The former 127 count considered only inbound counterparty references and wrongly labelled source-only drugs such as celecoxib unreachable even though their own rows emit alerts. This is primarily CORPUS coverage: widening it requires authoring an interaction row or making existing source content machine-resolvable with clinical review, not indiscriminately widening lexicon selectors. PR #1923 closed the safety half - evaluateMedicationInteractions now reports unreachableCounterparties, composeMedicationVerdict treats it as incomplete so green is unreachable, and MedicationInteractionBlock names the uncovered drugs and says the absence of a warning is not evidence of safety. The generated list by class is the 'What this tool can never warn about' section of docs/medication-interaction-lexicon-review.md and refreshes with the report. Next: prioritise clinically relevant gaps on the prescribing surface. Stop: do not close this by loosening the matcher; that reintroduces the false-positive class (Sodium content, Vitamin K, hyperkalaemia prose) that was deliberately rejected. | PR #1923; docs/medication-interaction-lexicon-review.md coverage section; src/lib/medication-interactions.ts UNREACHABLE_SLUGS | 2026-08-13 |
-| #324 | P1 | rec | No gate detects a merged PR whose content is silently reverted by a later merge resolution | MEASURED 2026-08-13 by blob comparison against origin/main, not by reading merge messages. Method: for every PR merge into main since 2026-08-06, for each file the PR changed, compare origin/main's blob against the file's PRE-merge parent blob. Equality means the PR's change to that file is gone. Seven merged PRs came back positive: #1800 (fuzzy catalogue search plus its tests, 8 files), #1803 (the --shadow-tight to --e1 token retirement, 49 files), #1809 (2 specifier pages), #1811 (2 secondary-navigation test files), #1804 (4 test files), #1796 (worker/validate-runtime.ts), #1815 (1 command-surface file). Six of the seven first show the wiped state at ONE commit, acf78bf 2026-08-11 'Merge remote-tracking branch origin/main into probe2-1815', part of the PR #1815 babysit and unblock chain whose manual conflict resolutions took the stale branch side and reverted whatever had landed on main meanwhile. Confirmation that does not rely on blob identity: --shadow-tight is still referenced in 67 files on main after the PR that retired it merged, and open row #302 independently records legacyShadowAliases pinned at 220 while measuring 193, which is what a lost retirement looks like. WHY NOTHING WENT RED: the reverts took each PR's tests in the same stroke, so no gate had an assertion left to fail. Commit 6f8c70d 'fix(pr-1815) resolve main merge conflict and keep shadow-tight switch migration' shows a human trying to preserve #1803 and a later merge in the same chain undoing it anyway, so care at the keyboard is not the control. Note 55f51ab 'docs(issues) repair three merge losses' repaired the DOCS casualties of this same event; the source-code casualties were never noticed. This is #311's ledger loss-detector generalised from docs to source, which is where it actually bit. Next: add the blob-comparison sweep as a script plus a test, run it against origin/main post-merge or on a schedule, and fail on any file that reverts to its pre-PR blob. Keep the window bounded (for example 14 days) so the check stays cheap. Stop: do not treat a positive as automatically a defect, because a deliberate later revert looks identical at blob level. The check should name the PR and the file and require a human to confirm, exactly as the branch-review ledger does. | session 2026-08-13; local blob sweep over origin/main at 63526ee; acf78bf; 6f8c70d; 55f51ab; row #302; row #311 | 2026-08-13 |
+| #324 | P1 | rec | No gate detects a merged PR whose content is silently reverted by a later merge resolution | **Outcome:** the file-level merge-loss detector is delivered; one authoritative row now tracks its remaining operational decision. **Delivered:** PR #1944 added scripts/audit-merge-loss.mjs through npm run audit:merge-loss and focused tests. It compares every changed file in a bounded main-history window with the landing commit's first parent, then reports possible reverts for human review. The implementation independently rediscovered the acf78bf casualties, including the #1803 token-retirement loss, and deliberately remains advisory because blob equality cannot distinguish a deliberate revert from an accidental merge-resolution loss. **Remaining:** decide whether it runs after merges or on a schedule, who triages positive findings, and whether the separate branch-versus-squash inbox-request-loss case should be a second detector or a mode of the same tool. A scheduled or required check without a named human disposition path would become ignorable noise. **Stop:** do not reimplement the delivered script, and do not make either detector blocking or auto-close findings until that ownership decision exists. | session 2026-08-13 blob sweep; PR #1944 audit implementation and tests; PR #1937 inbox-loss case; consolidated by PR #1956 review follow-up | 2026-08-13 |
 | #325 | P3 | rec | A queued update request can silently clobber a row that changed after the request was written | **Outcome:** the inbox cannot apply a stale rewrite over someone else's newer content without anyone noticing. **Detail:** the inbox intake fixed ID allocation — ids are assigned at reconciliation, so two branches can no longer collide on a number, which was the sharper of the two hazards. It does not address content staleness. An 'update' request carries a full replacement '--detail' string written against whatever the author read at queue time; reconciliation applies it verbatim. If the target row changed on main between queueing and reconciling, the newer content is overwritten with no signal. The multiple-pending-mutations guard does not catch this: it fires only when two requests target the same id, not when one request is simply old. **Live near-miss, 2026-08-13:** a document-viewer ledger pass was drafted against a base four days stale, and its '#215' restatement was composed from that stale reading. It was caught only because the author re-read every row against current main before queueing — a discipline, not a gate. The same pass had already had to discard a directly-allocated '#295' because main had since claimed it; that half is now structurally impossible, this half is not. **Next:** consider fingerprinting the target row at queue time — the request schema is versioned ('version: 1'), so a 'baseRow' hash could be added to add/update/done payloads and compared at reconcile, refusing (or requiring an explicit override) when the row moved underneath. Weigh against just documenting the re-read discipline: this costs a schema bump plus writer, reconcile and self-test changes, and the failure needs a multi-day-stale base to bite. **Stop:** do not make reconciliation merge or three-way-diff detail text — a replacement that silently becomes a merge is harder to reason about than one that refuses. | session 2026-08-13 document-viewer ledger truth pass, PR #1930; scripts/ledger-inbox.mjs request schema | 2026-08-13 |
 | #326 | P3 | task | Keep post-restore environment recovery controls visible in the universal ledger | **Consolidated survivor for #188 and #196–#200 before their source rows are archived by PR #1920.** A schema restore is not operationally complete until all five environment-owned controls have been re-created and verified: (1) restore the ingestion, retention, and related `pg_cron` schedules and confirm they are active; (2) re-add required Supabase Vault secrets, including `cron_ingestion_jwt`, and verify names only without printing values; (3) re-set the required custom `app.*` database GUCs and verify them with read-only settings checks; (4) redeploy the required Supabase edge functions with the Deno v2.x toolchain and confirm the function list and health, only in an explicitly approved hosted-change window; and (5) re-enter dashboard-owned configuration, including auth providers and SSO redirect URLs, connection-pool caps, per-project keys, and `E2E_USER_*`, without committing secret values. **Next:** after every schema-restore drill or real restore, follow the disaster-recovery checklist in `docs/operator-backlog.md` and `docs/disaster-recovery-runbook.md`, record the verification outcome here, and keep the row open until all five controls are green. **Stop:** the runbooks are the execution procedure, not a substitute for this universal-ledger status row; do not treat a restored schema alone as recovered, expose secret values, or perform hosted writes without the required approval. | docs/operator-backlog.md disaster-recovery checklist; docs/disaster-recovery-runbook.md; #188/#196–#200; PR #1920 review | 2026-08-13 |
 | #327 | P3 | task | The recommended queue's Outcome cells are now unrendered dead text | **Residual of the queue-misdirection fix (PR #1902).** Both consumers — .claude/hooks/issues-surface.sh and scripts/issues-report.mjs — now derive each queue row's prose from the cited row's Detail cell, so the Outcome column reaches no reader through tooling. The stale prose still sits in the file, where a human opening it can read and act on it; for #231 that prose pointed at an approach the row had already recorded as refuted. **Implementation, established by building it 2026-08-13 — three findings that are not obvious:** (1) It cannot be a direct edit. check-ledger-write-discipline compares the canonical ledger against exactly applyRequestBatch(base, movedRequests), and no request type reaches the queue, so a hand edit is unlandable by construction. The rewrite has to live INSIDE applyRequestBatch — the function the checker itself imports — so checker and reconciler compute the same result; make it run for an empty batch and be idempotent so ordinary PRs are byte-identical. (2) It must land in the SAME commit as a reconcile. Code alone makes the checker compute normalise(base) while canonical stays un-normalised, failing every PR until a reconcile normalises it. (3) Do NOT drop the column, and do NOT blank composite rows. issues-report skips any queue row whose cells.length !== 7, so removing the column makes the queue vanish from /issues; and derivation deliberately skips composite ID(s) rows, so those still fall back to the Outcome cell and blanking it leaves them with no prose at all — filter to rows citing exactly one id. **Stop:** do not delete the queue table; order, acuity, capability, when and estimate exist nowhere else. | PR #1902; implementation attempt 2026-08-13 | 2026-08-13 |
 | #328 | P2 | issue | A row can outlive its own completion — nothing closes a ledger row when its work merges | **Found during the 2026-08-12 yield review; re-confirmed on main 2026-08-13.** The then-#304 row described a ranking-snapshot freshness fuse due to trip around 2026-08-19 and sat in the recommended queue as time-critical, but its work had already landed as commit d182844 (PR #1876) — the snapshot's generatedAt and sourceRunId no longer matched anything the row said. Nothing closes a row when its work merges: `issues:done` is a manual call, and the session that ships the work is often not the session that owns the row. This is the mirror of #292, which covers duplication BEFORE work starts; this is staleness AFTER it finishes, and it is more dangerous because the row keeps advertising urgency to every session that reads the queue. **Next:** the cheapest useful guard is a periodic re-verification pass that re-measures each open row against current main and flags rows whose stated evidence no longer reproduces — several rows already carry a hand-written VERIFIED CORRECT stamp, which shows the need but does it manually and unevenly. A stronger version has the handoff skill close the row in the same commit that lands the work. **Stop:** do not auto-close on keyword match; a row can be partially delivered (#215, #231) and auto-closing those would lose real remaining work. | session 2026-08-12 ledger yield review; re-verified 2026-08-13 | 2026-08-13 |
 | #329 | P2 | issue | All live mobile routes breach LCP; shared CSS delivery and JavaScript are the current bottleneck | PR #1927 is merged and deployed to Railway production at exact SHA f2abf5baf3f449a1803bedef9dc107f30b70db93. Three-sample live medians on that SHA are Documents 3374 ms, DSM 3961 ms, Forms 3507 ms, root 3819 ms, Therapy 3422 ms, and Services 3793 ms; desktop LCP is 580-679 ms and mobile CLS remains within the rule. The production CSS split is retained and reduced four canonical medians modestly, but every mobile route still breaches 2500 ms. Root trace attribution is now concrete: TTFB 283 ms, LCP render delay 3449 ms, the 46,724-byte transferred shared stylesheet completes at 3644 ms under the throttled critical-request contention, total main-thread work is 1785 ms, script evaluation is 1030 ms, and shared chunk 8322 alone consumes 870 ms CPU. This is separate from canonical #117, which continues to track the unresolved Therapy catalogue payload and per-field safety decision. Next: split the 4,251-line global stylesheet by route ownership and reduce the shared search-shell/root client boundary before repeating the same bounded live matrix. Therapy field safety review remains required for search/pathways. INP remains unverified because Lighthouse does not measure it and no usable CrUX result exists. Stop: do not strip clinical fields, weaken the Lighthouse budget, refresh a passing baseline to hide latency, or claim an INP pass. | PR #1927; Railway deployments 1224ed55-210d-443b-94e5-20f87475468c and 810cc8b3-e39a-493f-b18f-8c63d150d53f; live Web Vitals runs 31719448766 and 31719451951; PR #1933 review | 2026-08-13 |
 | #330 | P2 | task | Re-land PR #1800 (fuzzy catalogue search), applying the #310 one-edit cap in the same commit | PR #1800 squash-merged as 022c83b on 2026-08-10 and its entire content is absent from main: git show origin/main:src/lib/catalog-search.ts \| grep -c typoDistanceLimit returns 0, eight of its 11 source and test files are byte-identical to their pre-#1800 state. The remaining three (`src/components/therapy-compass/data/select.ts`, `src/lib/formulation.ts`, and `tests/formulation.test.ts`) contain later unrelated changes, but the fuzzy-search hunks are absent from them too; preserve those newer changes during the re-land. Cause and evidence in the merge-loss detector row filed alongside this one. Consequence today is a MISSING FEATURE, not a live hazard: because the matcher is gone, the #310 cross-drug defect is not reachable on main. Do not close #310 on that basis, and do not re-land #1800 unchanged. RE-LAND WITH THE FIX: #310 measured that the tier term.length >= 8 -> 2 edits is the problem, because Damerau scores an adjacent transposition as one edit, so fluoxetine to duloxetine is distance 2 and both are ten characters. Re-run 2026-08-13 against the algorithm confirms it, and confirms prednisone to prednisolone as the second real cross-drug hit. Capping that tier at 1 edit removes both while preserving sertraline to sertralin style recovery. The row's other claims also held on re-run: citalopram and escitalopram do not fuzzy-match, because the substring guard fires first, and clozapine/clonazepam and quetiapine/olanzapine are correctly out of range. Next: cherry-pick 022c83b onto current main, change typoDistanceLimit's >= 8 tier from 2 to 1, and add a test over real catalogue drug names with both the exact and the near-match record present, asserting the wrong drug is excluded while the exact drug remains. Gate: focused Vitest on `tests/catalog-search.test.ts` plus the other four test files #1800 touched. Stop: this path is clinicalRisk true under classifyPullRequestFiles because catalog-search.ts feeds medications.ts and prescribing, so the PR needs a complete Clinical Governance Preflight and must not be bundled with unrelated chores. ragRanking is correctly false; this is catalogue ranking, not pgvector retrieval. | session 2026-08-13; 022c83b; origin/main at 63526ee; row #310; algorithm re-run locally against real drug-name pairs | 2026-08-13 |
+| #331 | P2 | issue | check:medication-lexicon-report fails on 3 independent branches despite zero diff on the flagged file or its inputs | **Outcome:** one authoritative owner for the medication-report staleness problem, including its missing CI coverage. **Evidence:** on 2026-08-14, check:medication-lexicon-report reported the review document stale on three independently authored branches (#1947, #1949, #1950) although the document, lexicon sources, medication snapshot, and interaction index were untouched. The symptom must therefore be investigated against a clean current main rather than fixed opportunistically in unrelated work. **Scope:** this row also carries the CI evidence formerly duplicated in #333: the check is reached only at the end of verify:pr-local and no workflow invokes it, so CI can stay green while a local PR preflight fails. **Next:** inspect the generator and its staleness comparison against current main; if the report is genuinely stale, regenerate it in a dedicated clinical-document change, otherwise fix the comparison. In the same decision, either make the validated check part of the appropriate CI contract or move it out of the local preflight so its enforcement matches its ownership. **Stop:** do not delete or weaken the check merely to green an unrelated preflight, and do not regenerate a clinical-facing artifact without checking whether the diff changes clinical content. | PR #1947, PR #1949 and PR #1950 clean-branch reproductions; PR #1942 preflight; session 2026-08-14; consolidated by PR #1956 review follow-up | 2026-08-14 |
+| #332 | P3 | task | Three mode-nav icon glyphs sit at 17px, off the --spacing-icon-* scale, and no gate flags them | Split out of #275 rather than folded into its badge-box token. mode-nav/mode-nav.tsx:64 and :214 and mode-nav/nav-slot-ink.tsx:44 size their <Icon> with h-[1.0625rem] w-[1.0625rem] — 17px against an icon scale of 12/14/16/20/24 (--spacing-icon-xs..xl in the globals.css @theme block). #275 counted these among its five files because they share the badge's number, but they are a different role: the badge is a text-bearing box sized around its own --text-2xs numeral, these are glyphs. They are now the only consumers of that value, since the badge moved to --spacing-search-band-badge. Nothing gates this: check-icon-scale.mjs enforces only the retired 4.5 (18px) half-step and its header states it deliberately does NOT flag arbitrary h-[Nrem], because non-icon boxes legitimately use that form. So this is unguarded and will not self-report. Why it was not just fixed: snapping to size-icon-md (16px) or size-icon-lg (20px) visibly changes nav chrome at every breakpoint, and 17px is close enough to 16 that the choice looks arbitrary without seeing it rendered — a design call, not a token swap. Next: get a Chromium look at mode-nav at phone and desktop widths with the icon at 16 and at 20, pick one, then migrate all three together. If 17px turns out to be deliberate, say so in a comment at the call site and consider whether check:icon-scale should flag off-scale arbitrary icon sizes on <Icon>-typed elements specifically, which would have surfaced this. Stop: do not add a 17px step to --spacing-icon-* to make the problem go away — that token block's own comment argues against widening the scale off the 4px grid, and it would sanction the drift rather than resolve it. | session 2026-08-14; split from #275; check-icon-scale.mjs header | 2026-08-14 |
+| #334 | P3 | issue | Claude Code web containers can ship Node 22 with no node_modules, so npm ci fails engine-strict before any work starts | Hit 2026-08-14 at the start of a Claude Code on the web session, and it blocks a session completely until worked around, so it is worth recording even though the cause is the container image rather than this repo. The container provided /opt/node20, /opt/node21 and /opt/node22 with node22 on PATH, no nvm, and no node_modules in either the primary checkout or a fresh worktree. package.json requires node >=24.15.0 <25 with engine-strict, so 'npm ci --include=dev' aborts immediately with 'notsup Required: {node: >=24.15.0 <25, npm: 11.x} Actual: {npm: 10.9.7, node: v22.22.2}'. Nothing in the repo can fix this from inside, because the failure happens before any repo script can run — .nvmrc correctly says 24 and is simply not consulted, and there is no nvm for it to drive. Workaround used, which took about a minute and is safe: fetch the current 24.x from the nodejs.org dist index, untar to /opt/node24, and prefix subsequent commands with 'export PATH=/opt/node24/bin:/opt/node24/bin:/root/.local/bin:/root/.cargo/bin:/usr/local/go/bin:/opt/node22/bin:/opt/maven/bin:/opt/gradle/bin:/opt/rbenv/bin:/root/.bun/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'. Everything downstream then behaved normally — npm ci, the full unit suite, build, and the Playwright-free gates all passed. Worth knowing that this is a DIFFERENT surface from the Codex Cloud provisioning path: scripts/setup-codex-cloud.sh and scripts/setup-codex-worktree.mjs cover Codex, and docs/codex-cloud.md is explicit that Cloud mirrors the tracked toolchain, but neither runs for a Claude Code web session, so that hardening does not carry over. Next: decide whether this deserves repo-side help at all. Options are a short note in the AGENTS.md or CLAUDE.md orientation telling an agent to install Node 24 to /opt/node24 and re-export PATH rather than concluding the environment is broken, or a small bootstrap script equivalent to the Codex ones that a web session can run first. Prefer the note: a bootstrap script that downloads a runtime is a bigger surface than the problem. Stop: do not relax the engines range, drop engine-strict, or pass --force to get npm ci through — the Node 24 floor is enforced deliberately in several places (preinstall, check:runtime, scripts/dev-free-port.mjs) and loosening it to accommodate a bad container would disable a real guard. | session 2026-08-14; Claude Code web container for PR #1942 | 2026-08-14 |
+| #336 | P3 | rec | Decide whether responsive breakpoint windows get named tokens, or stay raw min-[]/max-[] everywhere | Split out of #275 rather than guessed at. The repo defines ZERO --breakpoint-* tokens, and at least nine sites hand-write the arbitrary form: min-[414px]:max-[429px] at clinical-dashboard/result-filter-control.tsx:231, plus max-[359px] (search-heading-mockups, differentials/diagnosis-map-panel.tsx:1036, clinical-dashboard/account-setup-dialog.tsx:98) and max-[389px] (factsheets/factsheets-search-page.tsx:176, clinical-dashboard/search-results-header-band.tsx:532, factsheets-compact-view-mockups). #275 asked for the 414-429 window to be tokenised alongside the badge box; that was deliberately NOT done, because naming one window while eight peers stay raw reintroduces exactly the one-call-site drift #275 exists to stop, just on a different axis. This is a real decision with two defensible answers and it should be made once, for all of them. (a) Stay raw and say so in docs/design-system/GATES.md: the values are per-device band edges carrying measured justifications in their own comments, they are not a scale, and a Tailwind 4 --breakpoint-* entry adds BOTH the min and max variant to every utility in the build for a single consumer. (b) Name them: Tailwind 4 --breakpoint-<name> generates <name>: and max-<name>:, so the 414-429 window needs two entries (414px and 430px, since max-[429px] is inclusive and max-<bp> is exclusive), and 359/389 would want their own. Note the mockup hits are design scratch and out of scope for any gate. Next: pick (a) or (b), record it in GATES.md section 3 so the next session does not re-derive it, and only then migrate. Stop: do not migrate one window ahead of the decision. | session 2026-08-14; split from #275 during the design-token relands PR | 2026-08-14 |
+| #337 | P3 | rec | npm run format in an uninstalled worktree runs a different Prettier than the lockfile pins and manufactures false drift | MEASURED 2026-08-14 in a Claude-on-web container during PR #1943, by running the commands rather than reasoning about them. The repo pins prettier ^3.9.6 in package.json with 3.9.6 in package-lock.json, but the container had no node_modules, so 'npm run format' (prettier --write .) resolved Prettier through npx and got 3.8.1. The older Prettier disagreed with files that are correctly formatted under the pinned version and REWROTE 31 files nobody had touched, including src/lib/rag/rag-cache.ts, src/lib/rag/rag-provider.ts, src/lib/openai.ts, src/lib/types.ts, tests/route-reachability.test.ts and several docs. Committing that output would have turned a docs-only PR into one classifyPullRequestFiles scores as ragRanking and clinicalRisk, pulling in a Clinical Governance Preflight and a RAG impact line for changes that were pure formatting noise, and would have collided with four sibling sessions working the same tree. Proof it was an artifact and not real drift: 'npx prettier@3.9.6 --check' on the same files returns 'All matched files use Prettier code style!' -- main is clean. This is the same failure class as archived row #087 (never act on a knip finding from a worktree that has not been installed) but strictly worse, because knip only reports while format WRITES, and the false result arrives already applied to the working tree. Next: make the version explicit rather than incidental -- either pin the binary in the format and format:changed scripts, or fail closed when the resolved Prettier version does not match the lockfile, so the command cannot silently run the wrong one. A pre-push guard already reconstructs an exact-lock environment for this reason (scripts/guard-push.mjs), so the precedent for refusing to trust an unpinned local Prettier exists. Stop: do not commit the output of npm run format from a worktree that has not been installed, and do not conclude formatting drift exists on main without re-checking under the pinned version. | session 2026-08-14 PR #1943; package.json ^3.9.6; package-lock.json 3.9.6; npx prettier --version 3.8.1 vs npx prettier@3.9.6 | 2026-08-14 |
+| #338 | P3 | issue | The visual ISSUES-LIST.html register cannot be refreshed from any non-Windows session, so it drifts silently as work moves to cloud sessions | **Outcome:** either the rendered register is refreshable from any session that can reconcile, or it is retired and the Markdown ledger is the only artifact. **Detail, observed 2026-08-14 during the reconciliation in PR #1956.** `.claude/skills/issues/SKILL.md` refreshes the register by invoking `refresh-issues-list.ps1` under the operator's Windows `.codex\scripts` directory and writing `ISSUES-LIST.html` into their OneDrive folder — both absolute Windows paths. A Linux, container, or Codex/Claude Cloud session can run `npm run issues:reconcile` perfectly well (it did: 35 requests, write-discipline verified) but cannot run the refresh and cannot even check how stale the artifact is. The skill already handles this correctly for a single run — it says a stale visual artifact must not invalidate a valid canonical transaction, which is the right call — so this is not a correctness bug. The problem is cumulative: every cloud reconciliation widens the gap, and nothing measures it, so a reader opening the HTML has no way to tell whether it is an hour or a month behind. **Why it is P3 and not higher:** `docs/outstanding-issues.md` is the canonical rendered source and is always current; only the convenience artifact drifts. **Next, cheapest first:** decide whether the register is still wanted. If yes, the smallest fix is a stamp rather than a port — have the refresh write the reconciliation commit SHA into the HTML so staleness is visible at a glance, and have reconcile print a reminder naming the commit that needs it. A full cross-platform port (a Node renderer under `scripts/`) is the larger option and probably only worth it if the register is load-bearing for someone. If nobody reads it, retiring it and deleting that skill section is cheaper than either. **Stop:** do not improvise a substitute renderer or hand-write the HTML from a cloud session — an artifact that looks refreshed but was produced by a different generator is worse than one that is visibly stale. | PR #1956 reconciliation; .claude/skills/issues/SKILL.md refresh section; session 2026-08-14 | 2026-08-14 |
+| #339 | P2 | task | Favourites Continue and Recent are driven by hard-coded demo timestamps; real saved items have no last-opened data | Surfaced while shipping #164 (PR #1983), which made both surfaces prominent. src/components/clinical-dashboard/favourites-command-library-page.tsx derives 'most recently used' from lastUsedScore(item.lastUsed), and item.lastUsed comes from lastUsedByItemId — a hard-coded five-entry literal keyed to demo slugs ('Today 08:44', 'Yesterday 16:12', ...). Anything else, including every real registry favourite, falls back to the literal string 'Saved', which lastUsedScore buckets at 1000. pinnedItemIds is likewise a hard-coded two-item Set. The consequence after #164: for a signed-in user with real favourites, the Continue card and the Recent panel are effectively arbitrary — every item ties at the same score and the order is whatever the source array happened to be. Note that recentQueries in the shell is search-query history, not viewed-item history, so it cannot back this. Next: add a per-favourite last-opened timestamp. Cheapest is a client-side recents store keyed by favourite id written on open; the durable version is a column on the account favourites record so it survives a device change, which is a schema plus /api/account/favourites change and needs the usual migration review. Either way, pinning should stop being a hard-coded id set. Stop: do not fabricate a timestamp at render time from anything other than a recorded open event — an invented 'last used' on a clinical reference list is worse than an honest absence. | session 2026-08-15; PR #1983; favourites-command-library-page.tsx lastUsedByItemId/pinnedItemIds | 2026-08-15 |
+| #340 | P3 | rec | The mode-page comps and the results-band weighting contract disagree about query vs count emphasis | Found while shipping #163 (PR #1982). The perfected-combined comps draw the search query large and bold with the match count small and muted beside it, on both /tools and /services. Production does the reverse: SearchResultsHeaderBand renders the count first at font-weight 600 with the query at 450 and muted, and that is not an accident — docs/search-chrome-behaviour.md 'Results band' rules 1 and 2 argue for it explicitly (the query is the sole heading and the count is never one; nothing in the band is bold; the two weights are deliberately near-adjacent steps of one scale separated by tabular numerals and a hairline rather than by shouting). The band is shared by twelve modes and is a visual-baseline target captured from /services?q=CMHT&run=1 (tests/ui-visual-baseline.spec.ts), so changing it is a repo-wide change with a baseline refresh, not a per-mode tweak. #163 was closed without touching it because the outcome that row asked for — query-as-H1 rather than a match-count heading — is already true either way. Next: decide deliberately which artefact is authoritative. If the comps win, the change is a shared-band edit plus a rewrite of Results band rules 1-2 plus refreshed search-results-band and search-results-band-phone baselines, and it should be one PR covering all twelve modes. If the contract wins, the comps should carry a note so the next implementer does not re-open this. Stop: do not add a per-mode variant prop to make services alone read query-dominant — that makes shared chrome mode-conditional to settle a question that has one answer. | session 2026-08-15; PR #1982; docs/search-chrome-behaviour.md Results band rules 1-2 | 2026-08-15 |
+| #341 | P2 | task | Route the remaining ~22 unguarded source-slice test windows through the guarded helper | PARTIALLY DONE 2026-08-15 by PR #1985, which added tests/helpers/source-contract.ts and migrated the three worst files. The hazard this closes is a silent pass, not fragility: the idiom source.slice(source.indexOf(start), source.indexOf(end)) returns -1 for a missing end marker, and slice(n, -1) does not throw — it returns the rest of the file bar one character. A renamed end marker therefore converts a scoped assertion into a whole-file assertion and every positive toContain in it keeps passing for the wrong reason. The mirror case, a missing start, yields slice(-1, n) so every negative assertion passes vacuously. Neither shows up as a failure. The helper throws on a missing start, a missing end, and an AMBIGUOUS start (a window anchored on a string that appears twice silently covers only the first hit). MIGRATED: search-route-ownership.test.ts (three windows, including one whose end marker is an indentation depth and one anchored on a comment string), document-detail-performance.test.ts (end marker was the next literal 'useEffect' token, of which DocumentViewer has several), therapy-compass-responsive-contract.test.ts. REMAINING, roughly 22 windows across ~11 files, none migrated: audit-navigation-auth-regressions.test.ts is the densest and was deliberately skipped because PR #1983 edits the same file and the anti-churn rule prefers one late sync to a merge fight — do it once #1983 lands. Also tools-search-directions-mockups.test.ts, in-page-nav-playwright-contract.test.ts and document-section-nav-contract.test.ts (the last two slice ui-smoke.spec.ts between Playwright test titles, so renaming OR reordering an unrelated spec silently rescopes them), and rag-retrieval-parallelism.test.ts, which is left for a session that flags the RAG surface first per AGENTS.md. A REAL COVERAGE HOLE was found while surveying and is NOT yet fixed: audit-navigation-auth-regressions.test.ts around line 285 anchors on '{showUniversalAlsoMatches &&', which occurs TWICE in ClinicalDashboard.tsx (the second around line 3832 sits outside the window), so its not.toContain check does not enforce the named contract across the file. The new helper would reject that anchor outright, which is how it was found. Fix it in the same pass as that file's migration. STOP: do not loosen the demo-data boundary pins in favourites-demo-boundary.test.ts. The exact conditional-spread form '...(demoMode ? prototypeFavouriteItems : [])' with its paired negative is the live-vs-demo privacy contract, and its strictness is the point. Likewise leave the SQL windows ending on '$$;' and header-scroll-hide-contract.test.ts anchoring on the matching '</PhoneHeaderCollapsePortal>' closing tag — those are true structural terminators and are the model the rest should move toward. | session 2026-08-15; PR #1985; tests/helpers/source-contract.ts | 2026-08-15 |
+| #342 | P2 | issue | Recurring 'Unhandled server request error' on /api/search and /api/search/universal is untriaged | Three Sentry issue groups in clinibase-xz over 24h (JAVASCRIPT-NEXTJS-Y, -Z, -10), 17 events, 0 users impacted, all titled 'Error: Unhandled server request error' with culprit chunk 1261.js:2:4801. Top frames are /api/search/route.js and /api/search/universal/route.js. First seen 2026-08-14T08:44:37Z on release c9b089c92c975297c10649b005401d5ae337cf48, roughly six hours BEFORE PR #1946 merged, so it is not caused by the retrieval row contract; the post-merge group is the same error refingerprinted by the release change. The error string does not appear anywhere in repo source, so it likely originates in a dependency or an instrumentation wrapper — origin unidentified. Nobody owns this. Next step: identify what throws it, then decide whether it is a bot/scanner artefact or a real request-handling gap. | Sentry clinibase-xz, reviewed 2026-08-15 | 2026-08-15 |
+| #343 | P3 | task | Make the retrieval row contract's source_metadata pin structural, not data-guaranteed | rag-row-contracts.ts pins source_metadata to a JSON object via z.record(...), but documents.metadata is bare jsonb and permits arrays and scalars. Measured against the live project (sjrfecxgysukkwxsowpy) on 2026-08-15: all 2851 documents are object-typed, so nothing breaks today and no live errors exist. The guarantee is data, not schema — a future ingest path could violate it and take retrieval down for that document's chunks. Fix is either a check (jsonb_typeof(metadata) = 'object') constraint on public.documents, or loosening the pin. Every other required field in that contract is backed by a not-null constraint. | PR #1946 review + live Supabase verification 2026-08-15 | 2026-08-15 |
 
 ## Resolved / archive
 
@@ -478,3 +457,25 @@ Move resolved rows here with the resolution date and a one-line outcome. Keep th
 | #188 | task | Document and track disaster-recovery re-creation checklist as ledger work | Umbrella index only, and its children are retired to the runbook in the same batch. The disaster-recovery checklist is canonical in docs/operator-backlog.md and fires only after a schema restore, which is a runbook trigger rather than queued work. Note main separately opened a single consolidated DR row to keep the work visible; that supersedes both this umbrella and its five children. | 2026-08-13 |
 | #301 | issue | Two sessions built #262 part 3 in parallel because the GATES.md row understated what had shipped | Merged into #292 — the same failure mode (two sessions build the same queued item because the ledger has no claim mechanism), recorded twice from two incidents. #292 carries both the in-page-nav duplication (PR #1766 merged, #1767 closed) and the #262 part-3 ratchet collision, plus the understated-GATES.md-row contribution this row identified. | 2026-08-13 |
 | #200 | task | DR: Re-enter dashboard config after schema restore | Retired to the runbook (docs/operator-backlog.md disaster-recovery checklist). See #196 for the rationale. | 2026-08-13 |
+| #310 | issue | Fuzzy catalogue search can match a DIFFERENT drug: fluoxetine to duloxetine at edit distance 2 | Fixed on main by 247a359 ("Add tappable phone suggestion ticker and conservative fuzzy catalog search (#1851)", 2026-08-14 02:03 +0800; confirmed via git merge-base --is-ancestor 247a359 origin/main). The hazard is closed at its source: src/lib/catalog-search.ts typoDistanceLimit now returns 1 for term.length >= 5 and 0 below that, with no >= 8 two-edit tier at all, so the two-edit cross-drug window that produced fluoxetine -> duloxetine and prednisone -> prednisolone no longer exists. Coverage landed with it: tests/catalog-search.test.ts carries "never cross-matches a distinct drug two edits away, even with both records present" (cites this row by number, asserts Duloxetine and Prednisolone are absent while Fluoxetine and Prednisone rank first, and that setraline still recovers Sertraline), plus a dedicated tests/catalog-search-drug-name-regression.test.ts. Verified 2026-08-14 by running both files: Test Files 2 passed (2), Tests 19 passed (19). Also re-measured against the algorithm itself rather than read off the source, matching the method that originally opened this row -- hazards fluoxetine->Duloxetine, prednisone->Prednisolone and both reverses all return 0; intended recovery setraline, olanzepine, clozpaine, monitroing, fluoxetne, prednisne, schizophrnia and lithum all return 1; all five guards (SSRI/SNRI, ADHD/ODD, citalopram/escitalopram, clozapine/clonazepam, quetiapine/olanzapine) return 0; and with the exact and near-match records both present, fluoxetine ranks [Fluoxetine] and prednisone ranks [Prednisone]. Fuzzy search was not removed, per this row's stop rule. The earlier instruction not to close on the ground that the code was absent from main is discharged: the code is present, capped and tested. | 2026-08-14 |
+| #262 | task | DS Track A3: finish the design-token debt | CLOSED 2026-08-14 — all three parts settled, verified against code rather than rows. (1) The --shadow-tight retirement is re-landed: 130 call sites across 67 files onto var(--e1) and both declarations deleted. It had closed 2026-08-10 via PR #1803 and was silently reverted by the acf78bf merge on 2026-08-11; two stranded comments (globals.css 'the resting-hairline role is gone', and the token test's 'unlike the --shadow-tight assertion above') survived that merge while the code they describe did not, which is how the loss stayed invisible. The alias was a pure pass-through in both themes, and the forced-colors block scopes ':root, .dark' — the same html element the alias is declared on — so it already resolved through the flattened '--e1: none'; value-preserving in light, dark and forced-colors. tests/design-token-contract.test.ts now sweeps the tracked src tree for BOTH spellings (declaration and var() consumer) rather than asserting the declaration alone, so the gate no longer depends on which half of a bad merge lands. Mutation-verified in both directions. (2) NOT ACTIONABLE BY DESIGN, and this was already adjudicated — docs/design-system/GATES.md section 3 records that the decidable half of step selection shipped 9 Aug inside check:design-system-contract (a declared @theme step that no production surface selects fails the build; it caught --text-2xl-compact, retired 10 Aug, closing #297, and the exemption list is empty by design and gated from both sides). The remaining half — which existing step a component picks — is explicitly documented there as something 'nothing mechanical can' gate, being a judgement about the rendered design rather than a property of the source, with a standing instruction not to write an ESLint rule duplicating the arbitrary-value check that already ships via check:type-scale. So this part needs no work and should not be re-attempted. (3) SHIPPED in PR #1780 per #301 — rawPaddingLiterals, rawRadiusLiterals and rawLineHeightLiterals are all live baseline keys enforced at check-design-system-contract.mjs:215-232 over both the class and CSS-declaration spellings, plus rawGapLiterals beyond the original ask. Note for anyone re-measuring part 2: a raw grep for text-<step> overcounts, because it matches the --text-*: declarations and doc comments too — that is the 733-vs-705 discrepancy GATES.md line 66 already warns about, and it reproduces today (a naive sweep returns 773). Use the AST class-root pass. | 2026-08-14 |
+| #233 | task | COMPONENTS.md section 0 describes the pre-adoption world, and the optionality-marker contract change is undocumented | DELIVERED — verified on main 2026-08-14. Both halves are answered: COMPONENTS.md:16 section 0 is now the generated maturity matrix ('the generated maturity snapshot below is the claim'), not the pre-adoption world; the optionality-marker contract is documented at COMPONENTS.md:387-390 including the deliberate removal of the (optional) suffix. PR #1842 merged. | 2026-08-14 |
+| #221 | task | Local EmptyState, LoadingState and Chip duplicates still unconverged after PR-J | DELIVERED — verified on main 2026-08-14. The remaining local names are delegating wrappers, not duplicates: therapy-compass/ui.tsx:161-173 forwards to SharedEmptyState, :158 to LoadingPanel, :3 imports DS Chip. Recorded in ADOPTION.md section 7.1. PRs #1841/#1842 merged. | 2026-08-14 |
+| #178 | rec | pr-policy does not flag operational risk bundled with clinical or UI risk | DELIVERED — verified on main 2026-08-14. scripts/pr-policy.mjs:335 flags exactly the bundling this row asked for: if (classification.operationalRisk && (classification.clinicalRisk \|\| classification.ui)). PR #1837 merged. | 2026-08-14 |
+| #319 | task | Re-land PR #1803 (--shadow-tight retirement onto --e1); 67 files on main still use the retired alias | RESOLVED 2026-08-14 — the retirement is re-landed. 130 var(--shadow-tight) call sites across 67 files now read var(--e1), and both role-alias declarations are deleted; a tracked-tree grep for the token returns zero. This row was queued as inbox request 210e3db5 and reconciled into the ledger by PR #1936 while the work was already in flight, which is why the fix arrives as a done rather than a cancel. Value-preservation was confirmed before editing rather than inherited from #1803: the alias was a pure pass-through in both themes, and the forced-colors block at globals.css:3613 scopes ':root, .dark' — the same html element the alias is declared on — so --shadow-tight already resolved through the flattened '--e1: none' there. Identical in light, dark and forced-colors. The .ckb-v2 redeclaration hazard this row's neighbours warn about does not bite for the same reason: .ckb-v2 sits on <html> and .ckb-v2.ckb-v2 outspecifies :root, so both spellings substitute against the winning v2 tier. Guard added, and it is deliberately stronger than the one #1803 shipped: tests/design-token-contract.test.ts now sweeps the tracked src tree for BOTH spellings (a '--shadow-tight:' declaration and a 'var(--shadow-tight)' consumer) rather than asserting only that the declaration points at --e1. A declaration-only assertion would have caught the acf78bf revert, but only because the declarations happened to come back alongside the call sites; the tree sweep is independent of which half of a bad merge lands. Mutation-verified in both directions. Two artefacts confirm the original loss and are now consistent again: the globals.css comment 'the resting-hairline role is gone' and this test file's 'unlike the --shadow-tight assertion above' both survived acf78bf while the code they describe did not. This row's stop rule was honoured — the contract baseline was NOT refreshed to absorb the change; it was tightened DOWN to the moved measurement (legacyShadowAliases 220 -> 119) in its own commit, so the movement is pinned rather than hidden. #302 was re-measured after the reland rather than actioned on its stale numbers, and is closed in the same PR. Not bundled with the #1800 re-land, per this row's other stop rule. | 2026-08-14 |
+| #302 | rec | Design-system contract ratchets re-accumulate slack because paying debt down does not re-pin the ceiling | RESOLVED 2026-08-14 — the five ratchets carrying slack are re-pinned to measured, in the same PR that paid the debt, which is the coupling this row asked for. legacyShadowAliases 220 -> 119 (the row measured 193 on 2026-08-12; the reland of --shadow-tight pays down the debt the acf78bf revert had re-hidden, so the real gap was 101 units, not 27), edgeOwnershipConflicts 27 -> 25, rawPaddingLiterals 67 -> 63, rawGapLiterals 34 -> 32, layoutTransitionExceptions 12 -> 11. Regenerated with 'node scripts/check-design-system-contract.mjs --print-debt-baseline' rather than hand-edited, so per-path debtByPath moved with the totals — those are what findDebtPathRegressions compares, and the retirement moved them wholesale. Every metric in the diff decreases; nothing was absorbed upward. Verified zero slack on every ratchet afterwards by diffing the baseline against a fresh --print-metrics run. Mutation-verified: reintroducing one alias in button.tsx now fails at both the total (119 -> 120) and the per-path level, where the old 220 ceiling passed it silently. This is not the baseline refresh #262 warns against — that stop rule forbids refreshing to HIDE the movement, whereas this pins the movement in. The stale GATES.md section 3 numbers for all five were corrected in the same commit per #301. Residual risk this row should still be read for: nothing enforces the coupling. A future PR can still pay debt down and leave the ceiling, and only a manual --print-metrics diff will notice. A cheap guard would be a check that fails when any baseline metric exceeds its measured value by more than a stated tolerance. | 2026-08-14 |
+| #313 | issue | check:ledger-write-discipline reports a pass when run against an uncommitted working tree | Closed 2026-08-14 by PR #1944. scripts/check-ledger-write-discipline.mjs now reads git status for the paths it governs (docs/outstanding-issues.md, docs/branch-review-ledger.md, and docs/outstanding-issues-inbox/ including applied/) and refuses to report any verdict while one of them is dirty, naming each offending path and its status. Fixed as the row asked — the check was right, it just was not being asked the right question — rather than by relaxing the discipline. Two things only surfaced by running it: the module git() helper trims its output, which ate the leading space of porcelain's " M path" status field and shifted every path by one character so the guard silently never fired (the refusal now reads porcelain untrimmed, and tests/ledger-write-discipline.test.ts pins that specific shift); and scripts/guard-push.mjs:899 invokes this gate with an explicit committed --head at a moment when the tree is legitimately dirty, so the refusal fires only when head resolves to the default HEAD, leaving pre-push and clean CI unaffected. No override env var: both callers are unaffected by construction, so an escape hatch would only reopen the hole. Self-test extended with the dirty-tree case plus 9 focused tests. NOT addressed here, still open: the row's related contributing factor that node scripts/outstanding-issues.mjs done and npm run issues:done are different tools with nothing at the call site saying so. | 2026-08-14 |
+| #209 | task | DS V2 Gate 1: add contrast pair for --warning used as body text | DELIVERED — verified on main 2026-08-14. tests/design-token-contract.test.ts:202-204 asserts --warning against --surface at >= 4.5 (AA body text) per theme. PR #1841 merged. | 2026-08-14 |
+| #275 | task | The shared filter trigger carries arbitrary spacing values inherited from DocumentFilterTrigger | RESOLVED 2026-08-14 for the badge box; two carve-outs re-filed rather than guessed. SCOPE RE-MEASURED AGAIN on merged main and it has SHRUNK back, in the opposite direction to this row's 2026-08-12 re-measure: the badge role is down from five files to ONE. #170's convergence landed in between — document-search-results.tsx now renders the shared control and therapy-compass/filter-sheet.tsx was deleted outright (PRs #1885, #1889, #1910) — so the extraction reabsorbed the leak this row was written about. Fixed: 1.0625rem is now --spacing-search-band-badge in the globals.css @theme block, consumed as h-search-band-badge / min-w-search-band-badge at result-filter-control.tsx:236. Value-preserving and PROVEN, not inferred: compiling globals.css through @tailwindcss/postcss emits '.h-search-band-badge { height: var(--spacing-search-band-badge) }' and the matching min-width rule. No ratchet moved. NOT done, deliberately, each now its own follow-up: (a) pr-[0.6875rem] and min-[414px]:max-[429px] stay raw — the repo defines ZERO --breakpoint-* tokens and eight peer sites use the same raw min-[]/max-[] form (359px, 389px, 414px), so naming one window while the peers stay raw is this row's own drift on another axis, and Tailwind named breakpoints would add variants across the whole utility surface; that is a repo-wide decision. (b) The three remaining 1.0625rem hits in mode-nav.tsx:64,214 and nav-slot-ink.tsx:44 are NOT this token — they size <Icon> glyphs, a 17px icon against a 12/14/16/20/24 --spacing-icon-* scale, so folding them under a badge token would merge two roles that only share a number. check:icon-scale deliberately does not flag arbitrary h-[Nrem], so they are unguarded but real. Snapping them to 16 or 20px is a visible nav-chrome change and a design call. This row's stop rule ('do not change the measurements themselves') was honoured — every measured justification comment is intact and no value moved. | 2026-08-14 |
+| #234 | task | answer-copy-payload.ts is the single clipboard payload builder for three surfaces and has no documentation | DELIVERED — verified on main 2026-08-14. answer-copy-payload.ts (now src/components/clinical-dashboard/) carries a header documenting the single-builder contract, the three consuming surfaces, and why it sits outside src/lib and outside the design system. PR #1842 merged. | 2026-08-14 |
+| #213 | task | Stop swallowing fetch and stream errors with empty catch handlers | Closed 2026-08-14. The 2026-08-12 re-measure counted correctly but described the wrong thing: the 3 remaining bare catches under src/ were not fetch/stream swallowing at all. All 3 lived inside render-blocking inline bootstrap script strings — src/lib/theme.ts:46 (localStorage.getItem, then document.cookie) and src/app/layout.tsx:149 (JSON.parse of stored preferences) — where a throw means storage/cookies are unavailable and the correct behaviour is the documented fallback chain (cookie, then OS preference; defaults for density/motion). Each now carries an inline comment stating the throwing condition and the fallback that covers it; no behaviour changed, because there is no logger or toast before React mounts and surfacing the error would trade a correct default appearance for a broken first paint. The genuine fetch/stream catches this row was opened against were already dispositioned by earlier passes (api/answer/stream/route.ts:178,291 and api/search/universal/route.ts:102 carry comments and propagate via controller.error). Added tests/empty-catch-disposition.test.ts, a raw source-text scan asserting every empty catch under src/ carries a comment — raw text rather than an AST because ESLint's no-empty cannot see catches inside template-literal script strings, which is exactly where these 3 hid. Population is 21 empty catches, all dispositioned, 0 bare. | 2026-08-14 |
+| #245 | rec | responsive-compact CrossModeLinks keeps duplicate rails in the DOM | RESOLVED AS INTENTIONAL — verified on main 2026-08-14. The premise still holds literally (both rails are mounted) but it is now a documented decision, not a defect: cross-mode-links.tsx:220-224 states both rails stay mounted so SSR and first paint agree, hidden/md:hidden use display:none which removes the inactive rail from the accessibility tree, and distinct test ids stop phone vs wide selectors double-counting. Removing a rail would reintroduce the hydration mismatch this comment exists to prevent. PR #1842 merged. | 2026-08-14 |
+| #210 | task | npm run ensure generates .next/dev types that break typecheck and every Playwright build | Closed after PR #1953 landed on main: scripts/run-playwright.mjs now gives the generated isolated child tsconfig its own include/exclude, preventing stale repo-root .next/dev types from leaking into the Playwright build while retaining the run's generated types. | 2026-08-14 |
+| #335 | rec | Merge-loss detection covers file-level reverts and inbox-request loss separately; neither covers the other, and the scheduled run is undecided | Closed 2026-08-15 as duplicate follow-up of #324. The delivered file-level audit, the remaining schedule/owner decision, and the distinct inbox-request-loss scope are all retained in #324; no scheduling or CI policy was changed by this consolidation. | 2026-08-14 |
+| #215 | task | Add image-optimization basics for lightbox, PWA lifecycle and demo PNGs | Closed after PR #1949 landed on main: the PWA install-sheet icon now uses decoding="async". Demo PNG-to-WebP conversion was explicitly declined as a low-value synthetic-demo build step, preserving the row's requested implementation-or-drop decision. | 2026-08-14 |
+| #194 | task | L1: Archive retired backfill one-shots and dead ci-change-scope token | 3 of 5 named backfill one-shots archived via PR #1947 (backfill-document-covers.mjs, backfill-document-tags.ts, backfill-enrichment.ts moved to scripts/archive/, npm scripts repointed, one test import updated). The other 2 (backfill-gold-document-labels.ts, backfill-smart-index.ts) were found already classified [live] ongoing tooling in docs/scripts-index.md and docs/codebase-index.md, not one-shot candidates -- archiving them would have contradicted the repo's own documented convention, so they were correctly left in place. The 'dead ci-change-scope token' claim was confirmed FALSE by grep: scripts/ci-change-scope.mjs is live, central CI tooling wired into ci.yml and four other verify scripts. No removal made. | 2026-08-14 |
+| #189 | task | Pin /api/search route-level round trips and disposition the x3 text RPC probes | Route-level budget pinned via PR #1950 (16 round trips: auth/ratelimit/scope/enrichment/telemetry). The x3 text-RPC fan-out (match_document_chunks_text_v2 / match_document_table_facts_text_v2) is disposed as INTENTIONAL: src/lib/rag/rag-candidate-sources.ts fans out maxTextRpcQueryVariants (3) lexical query-variant phrasings for recall, with an existing PT-02 early exit (firstVariantPoolIsStrong) that skips sibling RPCs when the primary pool is already strong. No retrieval-behaviour change made; collapsing further would need a RAG flag plus a live canary, out of scope for this PR. | 2026-08-14 |
+| #333 | issue | check:medication-lexicon-report has been failing on main for every local verify:pr-local, and no CI job runs it | Closed 2026-08-15 as a duplicate of #331. Its clean-main and missing-CI evidence is preserved in #331, which is now the single owner of both the staleness diagnosis and the CI/local-preflight enforcement decision; no medication report was regenerated or clinical content changed. | 2026-08-14 |
+| #163 | task | Redesign Services search results (Progressive Referral Workflow) | CLOSED 2026-08-15 by PR #1982, but the row was half-stale when picked up and the split is worth recording. ALREADY ON MAIN before this PR, verified against e60b49a: the query is the <h1> via SearchResultsHeaderBand headingLevel={1} (the count is separate neutral text, never a heading), the shortlist bar is already conditional on selected.length, Compare already exists, and the four-card numbered walkthrough (ServiceReferralFlow) is mounted only on /services/[slug] — tests/ui-tools.spec.ts:1394 already asserted it absent from results. The current/ baseline PNG the row was written against is from 2026-07-31 and no longer reflects main, which is why the row read as untouched work. DELIVERED BY THIS PR: the tiny Search/Shortlist/Compare/Refer dot rail (new ServiceReferralProgress, accessible name Referral progress — deliberately not Referral workflow, so the absence assertion cannot be satisfied by renaming the old component back onto the route); row compaction dropping the Catchment/Eligibility/Cost strip and the confidence pill (both values remain untruncated on the record behind Review referral); a per-row bookmark wired to account favourites and kept distinct from the non-persisted shortlist, with a visible polite status because sign-in-required is the common guest outcome; and the shortlist banner moved below the heading it qualifies. NOT DONE, deliberately: the comp draws the query dominant and the count small, which is the reverse of the shipped band. That weighting is a documented contract (docs/search-chrome-behaviour.md Results band rules 1-2), shared by twelve modes, and visual-baselined from /services?q=CMHT&run=1, so inverting it is a repo-wide change and not this row. The outcome this row asked for holds either way. Captured separately. Verification: verify:pr-local all ten selected gates passed; UI proof delegated to CI Production UI because the container ships chromium-1194 against a pinned 1234 (#255/#312). | 2026-08-15 |
+| #164 | task | Redesign Favourites as hybrid dashboard + search (no ModeHome) | CLOSED 2026-08-15 by PR #1983. /favourites is one dashboard+search workspace; no ModeHome was reintroduced and no separate Favourites home route exists. DELIVERED: the 'Favourites command library' marketing H1, its heart icon tile and its explanatory subtitle are retired for a plain Favourites heading with the item count beside it as non-heading text; the desktop FavouritesSidebar plus the phone FavouritesMobileQuickViews and FavouritesMobileBrowseRail collapse into one chip rail carrying sets, Pinned/Source-backed and types with counts, after which favourites-library-nav.tsx had no callers and was deleted (529 lines, and it paid down one gate-8 edge conflict as a side effect: 25 to 24); the empty query shows Continue then Recent and Your sets side by side, a typed query demotes that band to a collapsed disclosure and filters the table in place with an 'N matches for ...' header; and the redundant filter computation is gone — filteredItems and the table's own tableRows were derived independently from identical inputs, so the band count and the table count were two answers to one question, and the page now derives rows once and passes them down. IN-PLACE FILTERING IS REAL, not just same-surface: the page reads the shared composer's live draft via useSearchCommand seeded from the route's submitted ?q=, the same pattern tools-search-results-page already uses, so typing filters without navigating and without a second input and the one-composer contract is untouched. NOT DONE, deliberately and worth knowing: Continue and Recent still render from the existing derivation, where lastUsedByItemId and pinnedItemIds are hard-coded five-entry literals for demo slugs and real registry items fall back to the literal string 'Saved'. Direction B leads with both surfaces, so they want a genuine per-item last-opened timestamp; that is a data-layer change and building it here would have silently rescoped this row. Captured as its own row. Verification: verify:pr-local all ten selected gates passed, unit suite 607 files / 6584 passed; UI proof delegated to CI Production UI (chromium-1194 vs pinned 1234, #255/#312). | 2026-08-15 |
+| #293 | issue | Gate 2 needs a phone-viewport deterministic surface; the `min-h-tap` 0px finding is REFUTED | Closed after PR #1962 landed on main (commit 885c613): tests/ui-style-contract.spec.ts now has a deterministic Gate 2 tap-carrier enumeration test at a 390x844 phone viewport on /forms's static home, polling until 3 consecutive reads agree. Finding 1 (min-height override) was already refuted as intentional (sm: desktop release of the phone-only floor); this closes Finding 2, the last open part. | 2026-08-15 |
diff --git a/docs/plans/edge-ingestion-overhaul-3pr-plan.md b/docs/plans/edge-ingestion-overhaul-3pr-plan.md
new file mode 100644
index 0000000000..4d849db56c
--- /dev/null
+++ b/docs/plans/edge-ingestion-overhaul-3pr-plan.md
@@ -0,0 +1,260 @@
+# Edge Ingestion Overhaul — 3-PR Execution Plan
+
+**Status:** Planning only. Revalidated against `main`
+`570740c84bc77b1c5d36493fd1011625c354f6d2` on 2026-08-16.
+
+**Current baseline:** `supabase/functions/ingestion-worker/` and
+`supabase/functions/indexing-v3-agent/` both remain present. App-layer document
+enrichment already uses a source-anchored structured schema through
+`generateStructuredTextResult` in `src/lib/document-enrichment.ts`.
+
+**Goal:** Retire the recovered ingestion worker, make the surviving indexing
+agent generation-aware and failure-isolated, move automated summaries onto the
+current structured-enrichment contract, then add lease fencing and quality
+gates.
+
+## Mandatory execution rules
+
+1. Start every implementation PR from a fresh, current `origin/main`. Re-run the
+   relevant searches before editing because paths, SQL signatures, and helper
+   contracts may have moved after this plan was written.
+2. Keep one owner for each hot file, especially
+   `supabase/functions/indexing-v3-agent/index.ts`. Parallel work may cover only
+   disjoint documentation, tests, or scripts.
+3. Format only files intentionally changed. Use targeted Prettier, then
+   `npm run format:changed`, and inspect the complete status and diff before
+   committing. Never use repository-wide formatting as a blanket handoff step,
+   and never commit test results, traces, screenshots, Lighthouse output, logs,
+   caches, scratch files, or unrelated corpus assets.
+4. Treat changes to selected chunks, summaries, labels, sections, or embeddings
+   as retrieval-behaviour changes even when ranking code is untouched. State the
+   RAG impact explicitly and run the smallest offline regression gate that can
+   detect the changed failure path.
+5. Do not run live Supabase reads or writes, migrations, edge deployments,
+   provider-backed evaluations, backfills, or paid OpenAI calls without
+   separate explicit approval.
+6. Use current source symbols rather than historical line numbers. Current
+   schema and migration signatures are authoritative. Mirror SQL changes into
+   `supabase/schema.sql` and generated database types or manifests only when the
+   repository contract requires them.
+7. After a PR opens, observe exact-head required CI and actionable review
+   threads only while the active authorised run continues. Do not claim
+   background monitoring and do not post periodic PR comments.
+8. Complete the current PR template, including concrete verification,
+   risk/rollback, the Clinical Governance Preflight when applicable, and the
+   exact RAG-impact statement.
+9. End each implementation PR with a clean diff and one immutable review-ledger
+   record created through `npm run ledger:append`. Never edit the historical
+   ledger table directly.
+
+---
+
+## PR 1 — Retire `ingestion-worker` and correct generation handling
+
+**Branch:** `codex/edge-ingestion-retire-p1`
+
+**Class:** Runtime removal plus enrichment-correctness change.
+
+### Scope
+
+1. Delete `supabase/functions/ingestion-worker/`.
+2. Remove the corresponding function block from `supabase/config.toml`.
+3. Add an idempotent migration that drops
+   `public.invoke_ingestion_worker(integer)`. Document that any dashboard
+   `pg_cron` schedule calling it must be removed before or with the migration.
+4. Mirror removal of the function, grants, and
+   `app.ingestion_worker_base_url` configuration from `supabase/schema.sql`.
+   Update generated schema artefacts only through their repository generators.
+5. In the surviving indexing agent, restrict summary, label, and section
+   source-chunk reads to:
+   - legacy visible rows where `index_generation_id is null`, or
+   - rows matching the document's committed generation.
+     Keep the predicate consistent across every enrichment read and add a focused
+     regression test for stale-generation exclusion plus legacy visibility.
+6. Isolate per-job failure recording. A failure inside the status/RPC update
+   must not abort processing of the remaining claimed jobs.
+7. Sweep documentation and tests for `ingestion-worker`,
+   `invoke_ingestion_worker`, and the retired base-URL setting. Update only
+   current operational references. Preserve historical audit records unless
+   repository policy explicitly requires a superseding note.
+8. Add a schema-contract assertion that the retired function cannot be
+   reintroduced accidentally.
+
+### Verification
+
+- `npm run check:edge:functions`
+- `npm run check:indexing`
+- focused schema and indexing-agent contract tests
+- `npm run check:migration-role`
+- `npm run verify:pr-local`
+- `npm run check:production-readiness`
+
+**RAG impact:** behaviour change — generation-aware chunk selection can change
+derived summaries, labels, and sections while leaving ranking code unchanged.
+Require focused offline enrichment/retrieval regression evidence. Any live
+canary remains provider-backed and separately approval-gated.
+
+### Operator approvals
+
+- Confirm and remove any live `pg_cron` schedule for
+  `invoke_ingestion_worker`.
+- Apply the retirement migration.
+- Deploy the updated `indexing-v3-agent`.
+
+**Rollback:** Restore the retired edge-function files and configuration, revert
+the agent change, and redeploy the previous version. Recreating the SQL wrapper
+must occur only after its cron and secret dependencies are deliberately
+restored.
+
+---
+
+## PR 2 — Structured, source-anchored summaries in `indexing-v3-agent`
+
+**Branch:** `codex/edge-ingestion-ai-summary`
+
+**Class:** Retrieval-input behaviour change.
+
+### Scope
+
+1. Make the edge summary contract match the current app-layer structured
+   enrichment contract in `src/lib/document-enrichment.ts`, including:
+   - a non-empty summary
+   - source-anchored clinical profile items
+   - labels with validated type and confidence
+   - bounded arrays and text lengths
+2. Prefer a transport-neutral shared schema and normaliser. Where the Node and
+   Deno runtime boundary prevents safe sharing, keep an explicit parity test
+   that fails when either contract changes.
+3. Port the current coverage-aware prompt selection strategy. Do not use
+   first-N-only chunk selection.
+4. Use the repository's current OpenAI structured-generation semantics rather
+   than hard-coding a legacy endpoint. Resolve the indexing model through the
+   current configuration contract, preserve timeout/retry handling, and verify
+   model availability before any approved live use.
+5. Generate and validate the complete payload before writing. Upsert only after
+   validation. Never delete a valid summary before replacement generation has
+   succeeded.
+6. Regenerate when the stored summary is missing, heuristic, from an older
+   summary version, or tied to a superseded committed generation. Skip only a
+   current, valid, source-anchored summary.
+7. Mark successful and fallback rows unambiguously. At minimum record:
+   `generated_by`, `summary_kind`, `summary_version`,
+   `index_generation_id`, model, and generation time. A heuristic fallback must
+   never claim LLM success.
+8. Keep embedding dimensions and model selection aligned with the current
+   schema and `EMBEDDING_DIMENSIONS` contract.
+9. Add contract tests for schema parity, parsing, source-anchor validation,
+   generation/version skip rules, fallback markers, and stage-then-swap
+   behaviour.
+10. Extend the existing backfill path with a dry-run filter for legacy
+    heuristic rows. Do not run it without explicit approval and a reviewed cost
+    estimate.
+
+### Verification
+
+- `npm run check:edge:functions`
+- `npm run check:indexing`
+- focused edge-summary and document-enrichment tests
+- `npm run eval:rag:offline` or the current offline selector invoked by
+  `verify:pr-local`
+- `npm run verify:pr-local`
+- `npm run check:production-readiness`
+
+**RAG impact:** behaviour change — summary text, labels, and summary embeddings
+feed retrieval. Record a pinned offline baseline and post-change result. A live
+retrieval-quality or answer canary requires separate approval and must compare
+the exact deployed commit.
+
+### Operator approvals
+
+- Deploy the updated edge function.
+- Run any provider-backed canary.
+- Run the legacy-summary backfill.
+
+**Rollback:** Redeploy the previous agent. Because replacement writes are
+validated upserts, previously valid rows remain recoverable. A canary regression
+requires reverting the responsible commit before broader rollout.
+
+---
+
+## PR 3 — Lease fencing, repair paths, and quality gates
+
+**Branch:** `codex/edge-ingestion-hardening`
+
+**Class:** Cross-cutting reliability and governance hardening.
+
+### Scope
+
+1. Add worker-identity fencing to indexing job status updates and lease
+   heartbeats. A stale worker must not refresh or complete a job owned by a
+   newer worker.
+2. Add a bounded, explicit repair path for documents requiring enrichment
+   artefacts. It must be dry-run capable, auditable, and unable to reopen
+   arbitrary completed work without a repair marker.
+3. Reconcile `supabase/schema.sql`, migrations, generated types, and the
+   repository's observed-live drift contract. Do not infer live state from this
+   plan. Confirm it only through a separately approved read.
+4. Extend offline indexing checks to report:
+   - missing summaries
+   - heuristic or outdated summary markers
+   - invalid source anchors
+   - generation mismatches
+   - unexpected truncation/fallback growth
+5. Fail closed on newly introduced invalid rows after the structured-summary
+   rollout, while reporting a separately tracked legacy remainder.
+6. Update the ingestion state-machine and deployment/runbook documentation with
+   the final ownership, retry, lease, repair, and rollback semantics.
+
+### Verification
+
+- `npm run check:migration-role`
+- `npm run check:edge:functions`
+- `npm run check:indexing`
+- focused status-RPC, lease-fencing, repair-path, and schema tests
+- `npm run verify:cheap`
+- `npm run check:production-readiness`
+
+**RAG impact:** no ranking-code change, but repair and quality enforcement can
+change which enrichment artefacts are accepted. Treat any regenerated summary
+or embedding as retrieval-affecting and apply the PR 2 evidence requirements.
+
+### Operator approvals
+
+- Apply migrations.
+- Deploy an agent whose status-RPC signature changed.
+- Perform any live repair or reconciliation run.
+
+**Rollback:** Revert the deployment first. Migrations must be designed to remain
+safe if the new worker is rolled back, or include an explicit, reviewed
+down-migration/compatibility path.
+
+---
+
+## Programme definition of done
+
+1. `ingestion-worker` is absent from active code, configuration, schema,
+   current runbooks, live functions, and live schedules.
+2. The surviving agent reads only visible/committed-generation content and
+   continues processing other jobs when one failure-recording path breaks.
+3. New summaries are structured, source-anchored, versioned,
+   generation-aware, and explicitly identify fallback generation.
+4. Offline retrieval/enrichment evidence is green, and any approved live
+   canary is pinned to the deployed commit.
+5. Lease fencing prevents stale workers from completing newer claims.
+6. Repair actions are explicit, dry-run capable, auditable, and bounded.
+7. Schema, migrations, generated artefacts, current documentation, and approved
+   live state agree.
+
+## Residual risks to resolve during implementation
+
+- Whether a live `invoke_ingestion_worker` cron still exists.
+- Whether live summary and embedding rows match the repository's current
+  dimension and generation contracts.
+- Whether the Deno edge runtime can share the structured schema directly with
+  the Node app without introducing an unsupported dependency boundary.
+- Provider model availability, latency, token cost, and structured-output
+  behaviour.
+- The volume of legacy heuristic rows and the cost and duration of backfill.
+
+These are discovery or approval items, not assumptions. Record the evidence in
+the implementation PR that resolves each item.
diff --git a/docs/pr-handoff-stop-cross-agent-gap.md b/docs/pr-handoff-stop-cross-agent-gap.md
new file mode 100644
index 0000000000..2e201d7942
--- /dev/null
+++ b/docs/pr-handoff-stop-cross-agent-gap.md
@@ -0,0 +1,95 @@
+# The PR-handoff stop rule is enforced for Claude Code only — a documented gap
+
+**Status:** gap documentation only — this document builds no mechanism
+**Ledger row:** `#258` (P2, rec)
+**Checked:** 2026-08-14 against `origin/main` at `d47aa6d`
+**Rule it backs:** `AGENTS.md` → "Stop when the pull request is open"
+
+Opening a pull request is the end of a session's handoff, not the start of a supervision
+shift. A session that stays attached to its own PR — polling `gh pr checks`, watching workflow
+runs, re-running failed jobs, re-syncing the branch, answering review bots, or parking a
+wake-up on it — spends a long tail of usage on work nobody asked for. Claude Code on the web is
+the worst case, because the cloud session keeps running and nothing naturally ends the loop.
+
+PR #1649 addressed that with two things: the `AGENTS.md` prose, and a Claude Code hook. **Only
+one of the three agents this repo supports gets the hook.** This document records where the
+enforcement lives, what the other two actually have, and what parity would require — so the
+gap is a known limit rather than an open task that looks unstarted.
+
+---
+
+## 1. What Claude Code has
+
+`.claude/hooks/pr-handoff-stop.sh` (259 lines), registered in `.claude/settings.json` as two
+matchers:
+
+| Phase         | Matcher                                                                                                                                                                                             | Effect                                                                                                       |
+| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
+| `PostToolUse` | `Bash`, `PowerShell`, and any tool whose name matches `create_pull_request`                                                                                                                         | On a call that returns a real PR URL, drops a session-scoped marker and tells the model the handoff is over. |
+| `PreToolUse`  | `Bash`, `PowerShell`, `Monitor`, `ScheduleWakeup`, `CronCreate`, plus tool names matching `pull_request` / `workflow_(run\|job)` / `check_(run\|suite)` / `job_log` / `pr_status` / `update_branch` | While that marker exists, denies the call with a reason naming the AGENTS.md rule.                           |
+
+Three deny classes, which is the useful summary of what "enforced" means here:
+
+1. **Shell polling** — `gh pr checks|status|view|diff|list|comment|review`, `gh run watch|view|list|rerun|download`, `gh api …actions/runs|check-runs|check-suites|/pulls/`, and `sync:pr-branches`.
+2. **GitHub MCP PR/CI tools**, matched by tool name, so a connector is not a way around the shell rule.
+3. **Loop machinery** — `Monitor`, `ScheduleWakeup`, `CronCreate`, which is how a session parks itself on a PR without running a single command.
+
+Committing, pushing, ledger appends, and PR create/merge stay allowed throughout.
+
+Details that matter to anyone reproducing this elsewhere:
+
+- **The marker is session-scoped and durable**, at `<absolute-git-dir>/claude-pr-handoff-<session_id>`, falling back to `TMPDIR` outside a repo. Using the absolute git dir keeps it valid from any cwd and in linked worktrees.
+- **It fails open on a missing or unsafe `session_id`** (`^[A-Za-z0-9_-]+$`), rather than sharing one marker across unrelated malformed payloads — path injection included.
+- **Sibling sessions' markers are deliberately never pruned.** Post-mode runs on every shell call, so age-based deletion of other sessions' files would disarm a long-lived handoff session that only uses `Read`/`Edit` after opening its PR.
+- **Post-mode scans only the request half of the payload**, never `tool_response`, so a command that merely _prints_ `gh pr create` and a PR URL cannot lock the session. Pre-mode deliberately scans the whole payload, because over-blocking is the safe direction there.
+- **The escape hatch is explicit and user-driven**: prefix a shell command with `CLAUDE_ALLOW_PR_FOLLOW=1`, or delete the marker the deny reason names. A command that merely mentions a blocked token cannot self-authorise — the prefix must be at the start of the command.
+- Sessions that never create a PR are untouched, so `Run PR` sweeps, `pr-ci-fix` work, and review sessions on someone else's PR still function.
+
+---
+
+## 2. What Codex and Cursor have
+
+**The `AGENTS.md` prose, and nothing else.** Checked, rather than assumed:
+
+- `.claude/settings.json` is read only by Claude Code. Its `PreToolUse` / `PostToolUse` registrations are invisible to the other two agents, so the marker is never dropped and no call is ever denied for them.
+- `plugins/clinical-kb/.codex-plugin/plugin.json` declares `name`, `version`, `description`, `author`, `repository`, `keywords`, `skills` and an `interface` block. **There is no hook, event, or pre-tool-interception field**, and the plugin ships exactly one skill (`skills/clinical-kb-workflow/SKILL.md`). A Codex session reads guidance; nothing intercepts its tool calls.
+- `.cursor/` contains `settings.json` (plugin enablement only — `context7-plugin`, `figma`), `mcp.json`, `agents/` (`design-review.md`, `pr-babysit.md`, `pr-bugbot.md`) and `skills/`. **No deny path.** Note that `.cursor/agents/pr-babysit.md` exists at all: Cursor has a documented agent for exactly the PR-following behaviour the stop rule restricts, with nothing to bound it.
+
+The consequence is precise, and it is worth stating plainly because it is easy to read the
+hook's existence as though the problem were solved: **prose alone is what was already in force
+before PR #1649, and it was already insufficient — that insufficiency is why the hook was
+built.** The cost was not removed; it was relocated to whichever agent lacks the gate. A cloud
+Codex session is the worst case, for the same reason Claude Code on the web was.
+
+---
+
+## 3. What a cross-agent mechanism would need
+
+Any parity mechanism has to answer the same three questions the hook answers:
+
+1. **Has this session already opened a PR?** Requires a durable, session-scoped marker written at the moment a PR-creating call returns a real PR URL — not at the moment one is attempted, since a failed create would otherwise end the session with no PR to hand over.
+2. **Is this call one of the three deny classes?** Shell PR/CI polling, PR/CI tool calls by name, and loop machinery. Matching must cover the connector path as well as the shell, or the rule is trivially bypassed.
+3. **Has the user explicitly asked to follow the PR anyway?** There must be an unlock, it must be user-driven, and a call must not be able to self-authorise by merely mentioning the unlock token.
+
+Plus three properties the existing hook already got right and a second implementation would
+have to match: fail open on an unidentifiable session; never prune a sibling session's marker;
+and never let a tool's _output_ arm the marker.
+
+**Cheapest first**, per `#258`'s own next step: check whether Codex or Cursor has since exposed
+any pre-tool interception this repo can register — Codex plugin hooks under
+`plugins/clinical-kb/`, Cursor rules or agent configuration under `.cursor/`. As of this
+document, neither manifest exposes one.
+
+**If no deny path exists**, the fallback the row proposes is a shared marker file plus a wrapper
+that agents are instructed to route `gh` through. That is strictly weaker — it is advisory, an
+agent can call `gh` directly, and it cannot touch the MCP-connector or loop-machinery classes at
+all — but a wrapper can _log_, which makes a violation detectable after the fact rather than
+invisible. Detection is not prevention, and a design that claims otherwise should be rejected.
+
+---
+
+## 4. Stop
+
+- **Do not weaken the Claude Code hook to make the three agents symmetric.** Removing working enforcement to achieve uniformity trades a real control for the appearance of one.
+- **Do not add a second copy of the deny list.** One script, multiple registrations. Two lists drift, and the drift is silent — the copy that falls behind still looks like enforcement.
+- **Do not close `#258` on the strength of this document.** The gap is now recorded rather than open-and-unexamined, but it is still a gap: two of three agents remain prose-only. Re-check the Codex and Cursor manifests when either tool ships hook support, and close the row only when a mechanism exists or the limit is accepted deliberately.
diff --git a/docs/pwa.md b/docs/pwa.md
index 2516055477..b5188936c6 100644
--- a/docs/pwa.md
+++ b/docs/pwa.md
@@ -52,9 +52,13 @@ registered service worker. Localhost is the browser's secure-context development
 is shown only when the browser emits `beforeinstallprompt`; browsers that do not expose that event retain their own
 install/Add to Home Screen flow.
 
-The install card is not shown in standalone mode. Choosing **Not now**, or dismissing the browser prompt, suppresses
-the custom prompt for 30 days using `clinical-kb-pwa-install-dismissed-at` in localStorage. `appinstalled` clears that
-value. Storage failures are treated as non-fatal progressive-enhancement failures.
+The install card is not shown in standalone mode. It stays non-blocking and lower-right on wide screens; on phones it
+becomes a compact sheet positioned clear of the current composer owner (above a bottom dock or below an in-flow home
+composer) and the safe area. The benefit list is deliberately limited to quick access, app-like launch, and the
+familiar Clinical KB workspace. It does not imply offline clinical access.
+Choosing **Not now**, using **Dismiss**, or dismissing the browser prompt suppresses the custom prompt for 30 days
+using `clinical-kb-pwa-install-dismissed-at` in localStorage. `appinstalled` clears that value. Storage failures are
+treated as non-fatal progressive-enhancement failures.
 
 iOS and iPadOS never emit `beforeinstallprompt`, so outside standalone mode those platforms get a one-time manual
 hint instead (Safari: Share, then Add to Home Screen). **Not now** suppresses it for 30 days via
@@ -155,11 +159,11 @@ clinical actions remain network-dependent.
 
 ### Update UX
 
-- An already-waiting worker, or an installing worker that reaches `installed` while a controller exists, shows **An
-  update is ready**.
+- An already-waiting worker, or an installing worker that reaches `installed` while a controller exists, shows
+  **Update available**.
 - When the page becomes visible or connectivity returns, the registration may check for an update. App-triggered
   checks are throttled to at most once per hour; there is no background polling timer.
-- **Refresh now** sends `SKIP_WAITING`. The page reloads once after `controllerchange`, so it cannot loop.
+- **Reload** sends `SKIP_WAITING`. The page reloads once after `controllerchange`, so it cannot loop.
 - **Later** hides the update for the current lifecycle instance. A later page load can surface the waiting update
   again.
 - If another tab activates the update, an already-controlled tab receives `controllerchange` and offers its own
@@ -232,7 +236,7 @@ resource problem by weakening the page CSP or adding a provider origin to the wo
 
 ## Accessibility, theme, and device fit
 
-- Lifecycle notices use a polite live region, labelled status/region containers, real buttons, 44 px minimum target
+- Lifecycle notices use a polite live region, labelled status/region containers, real buttons, 48 px minimum target
   height, and visible focus treatment.
 - The notice stack does not take page scroll ownership. Its cards restore pointer events while the container remains
   transparent to unrelated interaction.
@@ -299,7 +303,7 @@ explicitly authorized.
       document must appear and must not reveal prior content. Restore connectivity and verify the restored notice.
 - [ ] Confirm an offline API/document/media request is not answered from a PWA cache.
 - [ ] Deploy a worker with a new cache version in a staging environment. Verify the update waits, **Later** does not
-      force a refresh, **Refresh now** activates it, every older tab is offered a refresh, and only the two newest
+      force a refresh, **Reload** activates it, every older tab is offered a refresh, and only the two newest
       prior static caches remain for lazy-chunk compatibility.
 - [ ] Check keyboard focus, screen-reader announcements, forced colours, light/dark theme, portrait/landscape, display
       cutouts, and the standalone home-indicator area at phone and desktop breakpoints.
diff --git a/docs/scripts-index.md b/docs/scripts-index.md
index 74c080e44a..810ef988f8 100644
--- a/docs/scripts-index.md
+++ b/docs/scripts-index.md
@@ -1,6 +1,6 @@
 # Scripts index
 
-Curated map of `scripts/` (237 files) and the `package.json` script surface (245 entries),
+Curated map of `scripts/` (239 files) and the `package.json` script surface (246 entries),
 grouped by purpose. This is orientation, not an exhaustive per-file listing — the authoritative
 command list is `package.json`, and `npm run docs:check-scripts` verifies every `npm run <x>`
 referenced in docs resolves to a real script. `npm run docs:update` refreshes the exact counts above.
@@ -28,6 +28,7 @@ migration has shipped (see `docs/maturity-backlog-workorders.md` L1).
 | `check-outstanding-issues.mjs`, `check-pr-mergeability-workflow.mjs`                                                                                                                                                                                                    | Outstanding-issues ID/marker/no-driver guard + PR mergeability workflow contract                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 | `outstanding-issues.mjs`                                                                                                                                                                                                                                                | Writer for `docs/outstanding-issues.md` (`issues:add` / `issues:done` / `issues:update`) — allocates the id, picks the right table, escapes `\|`, and re-runs the guard on its own output. Never hand-edit that file, as with `ledger:append`                                                                                                                                                                                                                                                                                                                                          |
 | `check-installed-lock-parity.mjs`, `phone-chrome-plan.mjs`, `verify-phone-chrome.mjs`, `playwright-browser-preflight.mjs`                                                                                                                                               | Lock-trust preflight, change-scoped phone contracts, and Playwright browser-binary preflight before build                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `audit-merge-loss.mjs`                                                                                                                                                                                                                                                  | Advisory blob-comparison sweep for merged PRs a later merge resolution silently reverted (`audit:merge-loss`); names the PR and files and exits 0 — a deliberate revert is identical at blob level, so a positive needs human confirmation                                                                                                                                                                                                                                                                                                                                             |
 | `final-merge-audit.mjs`                                                                                                                                                                                                                                                 | Fail-closed local merge-tree audit; explicit provider mode adds PR/check/thread/tree/deployment proof                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | `child-process-result.mjs`, `cli-utils.ts`, `productivity-core.mjs`                                                                                                                                                                                                     | Shared helpers                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | `test-focused.mjs`, `test-run-selection.mjs`, `test-cache-path.mjs`, `test-environment.mjs`                                                                                                                                                                             | Backs `npm run test:focused` — change-scoped selection, cache pathing, env setup; fails closed for deleted files and test infrastructure                                                                                                                                                                                                                                                                                                                                                                                                                                               |
diff --git a/docs/search-chrome-behaviour.md b/docs/search-chrome-behaviour.md
index b96f9094a2..f28f5e564a 100644
--- a/docs/search-chrome-behaviour.md
+++ b/docs/search-chrome-behaviour.md
@@ -4,16 +4,17 @@ This repo uses one shared search experience across the global shell, dashboard r
 
 ## Page ownership model
 
-| Page state                          | Composer placement                                                          | Reserve owner                                                                  |
-| ----------------------------------- | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------ |
-| Answer home / standalone mode homes | In-flow hero composer on phones and larger breakpoints                      | Page content; no fixed phone dock reserve                                      |
-| Submitted/search-result views       | Compact bottom dock on phones; in normal page flow on tablets and desktops  | Shell/dashboard `--mobile-composer-reserve` on phones; page content on desktop |
-| Answer result view                  | Overlaid glass header plus answer composer dock                             | Dashboard `#main-content` top/bottom reserves                                  |
-| Document detail/source routes       | `DocumentViewer` floating composer                                          | `DocumentViewer` content padding                                               |
-| Document section navigation         | Header row disclosure (phone sheet) + rail index card at `lg`               | None — adds no chrome and no reserve                                           |
-| Record page breadcrumb header       | Same header row without the disclosure or track; view mode inline from `sm` | None — portals into the phone collapse row, sticky at `sm+`                    |
-| Calculators (`/calculators`)        | Page-owned composer (desktop top + phone bottom dock)                       | Calculators page pad; shell reserve stays `0`                                  |
-| Info/detail pages with no composer  | No fixed composer                                                           | Idle shell padding only                                                        |
+| Page state                                     | Composer placement                                                          | Reserve owner                                                                  |
+| ---------------------------------------------- | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------ |
+| Answer home / standalone mode homes            | In-flow hero composer on phones and larger breakpoints                      | Page content; no fixed phone dock reserve                                      |
+| Tools directory (`/tools`, no submitted query) | Compact bottom dock on phones; in-flow hero composer from `sm`              | Shell dock reserve on phones; page content from `sm`                           |
+| Submitted/search-result views                  | Compact bottom dock on phones; in normal page flow on tablets and desktops  | Shell/dashboard `--mobile-composer-reserve` on phones; page content on desktop |
+| Answer result view                             | Overlaid glass header plus answer composer dock                             | Dashboard `#main-content` top/bottom reserves                                  |
+| Document detail/source routes                  | `DocumentViewer` floating composer                                          | `DocumentViewer` content padding                                               |
+| Document section navigation                    | Header row disclosure (phone sheet) + rail index card at `lg`               | None — adds no chrome and no reserve                                           |
+| Record page breadcrumb header                  | Same header row without the disclosure or track; view mode inline from `sm` | None — portals into the phone collapse row, sticky at `sm+`                    |
+| Calculators (`/calculators`)                   | In-flow hero composer at home; shared compact dock after submission         | Page content at home; shell reserve for submitted results                      |
+| Info/detail pages with no composer             | No fixed composer                                                           | Idle shell padding only                                                        |
 
 ## Default in-page navigation template
 
@@ -320,7 +321,7 @@ in-page navigation work defaults to the DocumentViewer template above.
 6. Header and footer chrome that share the same scroll signal should hide/reveal symmetrically for the surfaces that actually hide. **Collapse motion (tablet and desktop only):** when the top bar is hidden, `chrome-safe-area-top` and the controls both release to `0rem` so underlying content paints to the physical viewport edge. **Overlay motion (every phone route on both hosts, no exception):** the stack translates instead; `chrome-safe-area-top` stays inside the translated layer at a stable height, and the content-facing `--phone-overlay-chrome-h` clearance is constant across hide/reveal — zeroing it on hide would reintroduce the layout shift overlay exists to remove. The visible phone header still owns `var(--safe-area-top)`; tablet/desktop top-bar chrome keeps its pinned inset. While visible that spacer is the top of the header, so it paints `var(--surface)` — the bar's own opaque phone colour — never `var(--background)`: the page colour there reads as a status-bar band above the bar, the seam overlay-strategy answer mode never shows because its header pads the inset itself. Keep it opaque so the sm+ pinned inset still hides scrolled content. Top-bar hide/reveal is cross-breakpoint; the search field belongs to page flow and scrolls away naturally on tablets and desktops; the bottom search dock is phone-only. Hidden bottom dock reserve stays `0rem` (invariant 4). Read "Scroll hide/reveal" below before changing either.
 7. Do not add page-local dock-sized `pb-[calc(...safe-area...)]` under a shell-owned dock. Put clearance in the shared reserve or the page-owned composer, never both.
 8. `GlobalSearchShell` uses an inner `mobile-composer-reserve-pad` so phone padding contributes to scroll height; do not move phone shell clearance back to scrollport padding without a browser proof.
-9. Page-owned fixed phone composers follow the same release contract: calculators use the shared footer backdrop; DocumentViewer keeps its floating pill but synchronizes transform, opacity, pointer release, and its own zero-reserve content padding. In-flow hero composers remain free of fixed-footer glass.
+9. Page-owned fixed phone composers follow the same release contract: DocumentViewer keeps its floating pill but synchronizes transform, opacity, pointer release, and its own zero-reserve content padding. In-flow hero composers remain free of fixed-footer glass; Calculators uses the shared shell dock after submission.
 10. Keep collapse-budget policy geometry-aware: an in-flow collapsing phone header needs enough remaining runway to absorb controls + released top safe-area + dock clearance, while a fixed overlay that only releases bottom reserve may hide when its post-collapse range retains the top reveal band plus deliberate hide intent _and_ the current offset already fits that post-collapse range (no material near-bottom clamp). Do not use synthetic page padding to make the stricter gate pass.
 11. Detect reserve-transition clamps from geometry, not a wider pixel tolerance: if the scroll range shrinks and the previous offset no longer fits inside the new maximum, rebase that frame as layout feedback. Once the range stabilizes, the same upward movement must reveal normally.
 12. Standalone mode-home detection (`isStandaloneModeHomePath`) is pathname-only. Do not gate hero vs dock on a React `searchMode` that can update before the router pathname lands — that one-frame mismatch animates reserve padding and reads as a choppy screen resize.
@@ -552,7 +553,7 @@ raw CSS `transform: translateY(...)` in `globals.css` are unaffected and stay on
 `MasterSearchHeader` additionally wraps the composer in `PhoneFooterLayerPortal`
 when `phoneOverlayMotion && usesPhoneBottomDock`, which covers the during-hide
 window when the transform genuinely exists, and matches the mechanism invariant
-21 already requires of the DocumentViewer, calculator and differential footers.
+21 already requires of the DocumentViewer and differential footers.
 Treat it as defence in depth, not the primary fix — `PhoneFooterLayerPortal`
 starts with `isPhone === false`, so it does nothing until hydration and cannot
 protect first paint on its own. Do not solve any of this by rendering the
@@ -564,7 +565,7 @@ Rules that keep this working:
 - **Hide the top bar, not the search field.** The collapse wrapper (`data-testid="universal-header-collapse"`) wraps `header#search` plus page navigation mounted through `PhoneHeaderCollapsePortal` into `#phone-header-collapse-addon-slot`. Keep composers outside the collapse row: tablet and desktop result search scroll with page content rather than being translated by the header.
 - **Every production phone navigation header has one collapse owner.** `PhoneHeaderCollapsePortal` moves Therapy section navigation, DocumentViewer navigation, and Differential detail navigation into `#phone-header-collapse-addon-slot` below `sm`; the same subtree stays in its existing page position at `sm+`. Do not add a second sticky/fixed phone header inside `#main-content`: the universal collapse row must own its safe area, focus pinning, timing, clipping, and measured release. Semantic content headings and modal/sheet headers are not viewport chrome and stay in their own flow/scroll context.
 - **Document phone headers overlay as one stable stack.** Document detail/source routes keep the complete phone header at a stable height and translate the safe area plus both header rows and the section track together. Hidden overlay chrome is transparent and non-interactive; revealed chrome frosts and covers the document. `readChromeCollapseMetrics` counts zero released top-header geometry for this overlay, while continuing to measure the independently hidden document composer reserve. Reveal must not change the active owner's scroll offset or a stable document/PDF anchor.
-- **Feed the reporter from the element that actually scrolls.** Both app hosts run `useDocumentScrollHideReporter` alongside their `<main>` reporter. In browser-mode phones the normal-flow shell and `overflow-y: visible` surface make the document the only vertical owner, which lets Safari minimize its browser UI. Installed standalone mode uses a normal-flow `100vh` shell plus bounded inner surface, so document scroll does not fire there. The hook measures the same collapse budget and blurs the same focused composer for either owner. Page-owned footer chrome must follow the same rule: `DocumentViewer` observes both the document and the inner surface, then combines the signals so only the active owner drives it. Its rendered footer, like calculator and differential page-owned footers, portals to the frame host so observing the inner scroll owner does not make the footer its descendant.
+- **Feed the reporter from the element that actually scrolls.** Both app hosts run `useDocumentScrollHideReporter` alongside their `<main>` reporter. In browser-mode phones the normal-flow shell and `overflow-y: visible` surface make the document the only vertical owner, which lets Safari minimize its browser UI. Installed standalone mode uses a normal-flow `100vh` shell plus bounded inner surface, so document scroll does not fire there. The hook measures the same collapse budget and blurs the same focused composer for either owner. Page-owned footer chrome must follow the same rule: `DocumentViewer` observes both the document and the inner surface, then combines the signals so only the active owner drives it. Its rendered footer, like the differential page-owned footer, portals to the frame host so observing the inner scroll owner does not make the footer its descendant.
 - **Keep browser-phone chrome attached to the viewport without fixing the app root.** Collapse-mode headers use one phone-sticky wrapper; answer overlay headers are fixed only in browser mode and remain absolute over the inner surface in standalone mode. Footer layers are likewise viewport-fixed in browser mode and shell-absolute in standalone. While either header or reserve transition changes document geometry, the corresponding transition marker disables anchoring on the active document/inner scroller so synthetic reverse scroll cannot cause a hide/reveal loop or reading-position jump.
 - **Do not treat CSSOM bounds as physical iOS paint proof.** A fixed root can report perfect `getBoundingClientRect()` and hit-testing while WebKit leaves an app-external band. Keep browser/document and standalone/`100vh` static guards, then verify Safari and a freshly relaunched Home Screen app on a physical phone before merge. If iOS reports a web viewport shorter than `screen.height`, pixels outside that viewport are system-owned; keep the root canvas opaque and matching, but do not fake reachability with negative safe-area overscan.
 - **Viewport stickiness belongs on the outer top-bar stack, not on `header#search`.** The top bar sits inside header-height boxes, which leaves a sticky rule on it zero travel. For the same reason the visible stack's ancestor in `GlobalSearchShell` is `display: contents` at every breakpoint rather than a block. The collapse result owns one phone-sticky wrapper (safe-area spacer + stack), while its `sm:` children retain the tablet/desktop offsets. At tablet and desktop widths the search portal leaves that outer stack holding only the top bar.
@@ -576,7 +577,7 @@ Rules that keep this working:
 - **Rebase the reporter on geometry switches.** Pass `resetKey` when the host changes the scrollport under it (`ClinicalDashboard` passes `searchMode`, which swaps `<main>`'s header reserve); otherwise the carried-over offset spends the first post-switch scroll on a spurious hide or reveal. Shared mode-home shells should also reset on `pathname` so collapsed chrome/scroll offset does not carry across modes.
 - **Do not carry composer focus into submitted result views.** Focus pins both chrome edges for keyboard safety. `GlobalSearchShell` must not pass `focus: true` with `run: true`, must gate `queryInputAutoFocus` on `!hasSubmittedModeSearch`, and both hosts must blur the dock input when the active result owner scrolls so hide-on-scroll can reclaim the header and bottom dock.
 
-Coverage: `tests/header-scroll-hide-contract.test.ts` (wiring), `tests/use-hide-on-scroll.test.ts` (decision logic), `tests/ui-chrome-scroll.spec.ts` (tablet/desktop page-flow search plus top-bar hide/reveal), `tests/ui-phone-scroll.spec.ts` (shared shell header hide/reveal, per-mode top-edge release, collapse owner), `tests/ui-phone-scroll-routes.spec.ts` (per-route phone scroll sweep), `tests/ui-phone-scroll-page-owned.spec.ts` (document-viewer composer, standalone frame-owned footers, calculators dock, Services canvas) — the three share `tests/helpers/phone-scroll.ts`, and `tests/playwright-project-isolation.test.ts` asserts every sibling is collected by the required browser projects, `tests/ui-therapy-nav-scroll.spec.ts` (Therapy section nav hide/reveal with the top bar).
+Coverage: `tests/header-scroll-hide-contract.test.ts` (wiring), `tests/use-hide-on-scroll.test.ts` (decision logic), `tests/ui-chrome-scroll.spec.ts` (tablet/desktop page-flow search plus top-bar hide/reveal), `tests/ui-phone-scroll.spec.ts` (shared shell header hide/reveal, per-mode top-edge release, collapse owner), `tests/ui-phone-scroll-routes.spec.ts` (per-route phone scroll sweep, including submitted calculator results), `tests/ui-phone-scroll-page-owned.spec.ts` (document-viewer composer, standalone frame-owned footers, Services canvas) — the three share `tests/helpers/phone-scroll.ts`, and `tests/playwright-project-isolation.test.ts` asserts every sibling is collected by the required browser projects, `tests/ui-therapy-nav-scroll.spec.ts` (Therapy section nav hide/reveal with the top bar).
 
 Run `npm run verify:phone-chrome` for phone-chrome work. For executable changes its classifier checks installed/lock parity first, runs focused static contracts and only the browser/PWA owners and route journeys implicated by the changed files, then escalates to `npm run verify:ui` automatically for shared chrome foundations. Documentation-only scopes run only documentation guards. Use `-- --dry-run` to inspect the plan, `-- --files <comma-separated paths>` for an explicit scope, and `-- --full=always|never` only for a deliberate override.
 
diff --git a/docs/site-map.md b/docs/site-map.md
index 55ea7e389e..c0282f85c6 100644
--- a/docs/site-map.md
+++ b/docs/site-map.md
@@ -59,6 +59,7 @@ This file is generated by `npm run docs:update` (or `npm run sitemap:update` dir
 - `/formulation` - Formulation mode. Search kind: `formulation`. Query example: `/formulation?q=I+keep+going+over+it&focus=1&run=1`.
 - `/medications` - Medication mode. Search kind: `documents`. Query example: `/?mode=prescribing&q=acamprosate+renal+dose&focus=1&run=1`.
 - `/tools` - Tools mode. Search kind: `tools`. Query example: `/tools?q=medications&focus=1&run=1`.
+- `/calculators` - Calculators mode. Search kind: `calculators`. Query example: `/calculators?q=PHQ-9&focus=1&run=1`.
 - `/therapy-compass` - Therapy mode. Search kind: `tools`. Query example: `/therapy-compass?q=behavioural+activation&focus=1&run=1`.
 - `/factsheets` - Factsheets mode. Search kind: `tools`. Query example: `/factsheets/search?q=sertraline&focus=1&run=1`.
 
@@ -76,7 +77,7 @@ This file is generated by `npm run docs:update` (or `npm run sitemap:update` dir
 | Specifiers      | `/specifiers`    | `/specifiers?q=depressed+but+racing+thoughts&focus=1&run=1`           | `/specifiers/[slug]`, `/specifiers/builder`, `/specifiers/compare`, and `/specifiers/map`.                                                                          |
 | Formulation     | `/formulation`   | `/formulation?q=I+keep+going+over+it&focus=1&run=1`                   | `/formulation/[slug]`, `/formulation/builder`, `/formulation/compare`, and `/formulation/map`.                                                                      |
 | Medication      | `/medications`   | `/?mode=prescribing&q=acamprosate+renal+dose&focus=1&run=1`           | `/medications/[slug]`; submitted searches resolve to `/?mode=prescribing&q=…&run=1`.                                                                                |
-| Tools           | `/tools`         | `/tools?q=medications&focus=1&run=1`                                  | Canonical Tools launcher at `/tools` (PT-11). `/?mode=tools` remains a dashboard-mode alias.                                                                        |
+| Tools           | `/tools`         | `/tools?q=medications&focus=1&run=1`                                  | Canonical all-tools results directory at `/tools`; the universal mode picker opens it directly. `/?mode=tools` remains a dashboard-mode alias.                      |
 
 ## Documents flow index
 
@@ -984,6 +985,7 @@ This file is generated by `npm run docs:update` (or `npm run sitemap:update` dir
 
 ## Mockup/prototype routes
 
+- `/mockups/accessible-table-browser-fixture` - Route discovered from app directory Source: `src/app/mockups/accessible-table-browser-fixture/page.tsx`.
 - `/mockups/answer-evidence-popups` - Route discovered from app directory Source: `src/app/mockups/answer-evidence-popups/page.tsx`.
 - `/mockups/answer-home-proposal` - Route discovered from app directory Source: `src/app/mockups/answer-home-proposal/page.tsx`.
 - `/mockups/calculators-bedside-sheet` - Route discovered from app directory Source: `src/app/mockups/calculators-bedside-sheet/page.tsx`.
diff --git a/package.json b/package.json
index d98e1e0328..aa5bc15901 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "test:coverage": "node scripts/run-vitest.mjs run --coverage",
     "test:coverage:node": "node scripts/run-vitest.mjs run --project=node --coverage",
     "test:coverage:ui": "node scripts/run-vitest.mjs run --project=jsdom --coverage",
-    "test:ci-workflows": "node scripts/run-vitest.mjs run tests/ci-cache-safety.test.ts tests/authenticated-live-workflow.test.ts tests/codex-autofix-workflow.test.ts tests/codex-run-pr-operator-workflow.test.ts tests/eval-canary-workflow.test.ts tests/container-ci-contract.test.ts tests/test-runner-safety.test.ts tests/installed-lock-parity.test.ts tests/railway-config.test.ts tests/ingestion-autopilot.test.ts tests/ingestion-autopilot-workflow.test.ts tests/check-lighthouse-budget.test.ts tests/live-web-vitals-inputs.test.ts tests/offline-release-profile.test.ts",
+    "test:ci-workflows": "node scripts/run-vitest.mjs run tests/ci-cache-safety.test.ts tests/authenticated-live-workflow.test.ts tests/codex-autofix-workflow.test.ts tests/codex-run-pr-operator-workflow.test.ts tests/eval-canary-workflow.test.ts tests/live-drift-workflow.test.ts tests/container-ci-contract.test.ts tests/test-runner-safety.test.ts tests/installed-lock-parity.test.ts tests/railway-config.test.ts tests/ingestion-autopilot.test.ts tests/ingestion-autopilot-workflow.test.ts tests/check-lighthouse-budget.test.ts tests/live-web-vitals-inputs.test.ts tests/offline-release-profile.test.ts",
     "test:e2e": "node scripts/run-playwright.mjs",
     "test:e2e:all": "node scripts/run-playwright.mjs",
     "test:e2e:accessibility": "node scripts/run-playwright.mjs tests/ui-accessibility.spec.ts --project=chromium",
@@ -73,6 +73,7 @@
     "verify:pr-local": "node scripts/verify-pr-local.mjs",
     "verify:phone-chrome": "node scripts/verify-phone-chrome.mjs",
     "audit:final-merge": "node scripts/final-merge-audit.mjs",
+    "audit:merge-loss": "node scripts/audit-merge-loss.mjs --self-test && node scripts/audit-merge-loss.mjs",
     "verify:ui": "npm run check:runtime && npm run check:installed-lock-parity && npm run test:e2e:pr",
     "verify:release": "npm run check:runtime && npm run check:installed-lock-parity && npm run lint && npm run typecheck && npm run test && npm run build && npm run test:e2e && npm run check:production-readiness && npm run governance:release && npm run eval:quality:release",
     "verify:release:offline": "node scripts/verify-release-offline.mjs",
diff --git a/scripts/archive/backfill-document-covers.mjs b/scripts/archive/backfill-document-covers.mjs
index dafa6796fc..b766623bbf 100644
--- a/scripts/archive/backfill-document-covers.mjs
+++ b/scripts/archive/backfill-document-covers.mjs
@@ -8,7 +8,7 @@
  * Safety:
  * - Requires explicit --apply (dry-run by default)
  * - Never marks covers searchable / never attaches them to chunks
- * - Prefers documents that do not already have a cover_page image
+ * - Audits existing cover objects and repairs stale document metadata
  *
  * One-shot backfill: retired from scripts/ once the ingestion pipeline started
  * generating cover thumbnails for new documents directly (see worker/main.ts,
@@ -18,6 +18,7 @@
  * Usage:
  *   node scripts/archive/backfill-document-covers.mjs
  *   node scripts/archive/backfill-document-covers.mjs --apply --limit 25
+ *   node scripts/archive/backfill-document-covers.mjs --apply --all
  *   node scripts/archive/backfill-document-covers.mjs --apply --document-id <uuid>
  */
 
@@ -26,8 +27,26 @@ import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { spawn } from "node:child_process";
+import { pathToFileURL } from "node:url";
 import { createClient } from "@supabase/supabase-js";
 
+export function isMissingStorageObject(error) {
+  if (!error || typeof error !== "object") return false;
+  return (
+    Number(error.status) === 404 || String(error.statusCode ?? "") === "404" || String(error.code ?? "") === "NoSuchKey"
+  );
+}
+
+export function selectCommittedCovers(covers, committedGeneration, coverImageId) {
+  const matches = covers.filter((cover) => {
+    const metadataGeneration = cover.metadata?.index_generation_id;
+    const rowGeneration = cover.index_generation_id || metadataGeneration;
+    return !committedGeneration || !rowGeneration || rowGeneration === committedGeneration;
+  });
+  const selected = matches.find((cover) => cover.id === coverImageId) ?? matches[0] ?? null;
+  return { selected, matches };
+}
+
 function argValue(flag) {
   const index = process.argv.indexOf(flag);
   if (index === -1) return null;
@@ -98,7 +117,8 @@ print(json.dumps(cover))
 
 async function main() {
   const apply = hasFlag("--apply");
-  const limit = Number(argValue("--limit") ?? "50");
+  const all = hasFlag("--all");
+  const limit = all ? Number.POSITIVE_INFINITY : Number(argValue("--limit") ?? "50");
   const documentId = argValue("--document-id");
   const url = process.env.NEXT_PUBLIC_SUPABASE_URL || process.env.SUPABASE_URL;
   const serviceKey = process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_SECRET_KEY;
@@ -113,20 +133,25 @@ async function main() {
 
   // Page through cover rows — PostgREST caps a single select at 1000 by default.
   // Stable ORDER BY is required for range/offset paging (otherwise pages can skip/dupe rows).
-  const coveredIds = new Set();
+  const coversByDocument = new Map();
   for (let from = 0; ; from += 1000) {
     const { data: existingCoverRows, error: existingCoverError } = await supabase
       .from("document_images")
-      .select("document_id")
+      .select("id,document_id,storage_path,index_generation_id,metadata")
       .eq("source_kind", "cover_page")
       .order("id", { ascending: true })
       .range(from, from + 999);
     if (existingCoverError) throw new Error(existingCoverError.message);
-    for (const row of existingCoverRows ?? []) coveredIds.add(String(row.document_id));
+    for (const row of existingCoverRows ?? []) {
+      const key = String(row.document_id);
+      const rows = coversByDocument.get(key) ?? [];
+      rows.push(row);
+      coversByDocument.set(key, rows);
+    }
     if (!existingCoverRows?.length || existingCoverRows.length < 1000) break;
   }
 
-  const targetLimit = Number.isFinite(limit) ? limit : 50;
+  const targetLimit = all ? Number.POSITIVE_INFINITY : Number.isFinite(limit) ? limit : 50;
   const candidates = [];
   if (documentId) {
     const { data: documents, error: docsError } = await supabase
@@ -137,7 +162,7 @@ async function main() {
       .ilike("file_type", "%pdf%");
     if (docsError) throw new Error(docsError.message);
     for (const doc of documents ?? []) {
-      if (doc.storage_path && !coveredIds.has(String(doc.id))) candidates.push(doc);
+      if (doc.storage_path) candidates.push(doc);
     }
   } else {
     // Walk the full indexed-PDF set until we fill this batch (or exhaust the corpus).
@@ -154,7 +179,7 @@ async function main() {
       if (docsError) throw new Error(docsError.message);
       if (!documents?.length) break;
       for (const doc of documents) {
-        if (!doc.storage_path || coveredIds.has(String(doc.id))) continue;
+        if (!doc.storage_path) continue;
         candidates.push(doc);
         if (candidates.length >= targetLimit) break;
       }
@@ -162,85 +187,251 @@ async function main() {
     }
   }
   console.log(
-    `Found ${candidates.length} uncovered PDF candidate(s) (already covered=${coveredIds.size}). mode=${apply ? "apply" : "dry-run"}`,
+    `Found ${candidates.length} indexed PDF candidate(s) (cover rows=${Array.from(coversByDocument.values()).reduce((sum, rows) => sum + rows.length, 0)}). mode=${apply ? "apply" : "dry-run"}`,
   );
 
   let created = 0;
+  let repaired = 0;
   let skipped = 0;
   let failed = 0;
 
-  async function patchCoverImageId(targetDocumentId, coverImageId) {
-    const { data: fresh, error: freshError } = await supabase
+  function committedGenerationId(metadata) {
+    return typeof metadata?.index_generation_id === "string" && metadata.index_generation_id
+      ? metadata.index_generation_id
+      : null;
+  }
+
+  async function loadCurrentDocument(targetDocumentId) {
+    const { data, error } = await supabase
       .from("documents")
-      .select("metadata")
+      .select("id,owner_id,title,file_name,file_type,storage_path,status,metadata")
       .eq("id", targetDocumentId)
-      .single();
-    if (freshError) throw new Error(freshError.message);
+      .maybeSingle();
+    if (error) throw new Error(error.message);
+    return data;
+  }
+
+  async function loadCurrentCovers(targetDocumentId) {
+    const { data, error } = await supabase
+      .from("document_images")
+      .select("id,document_id,storage_path,index_generation_id,metadata")
+      .eq("document_id", targetDocumentId)
+      .eq("source_kind", "cover_page")
+      .order("id", { ascending: true });
+    if (error) throw new Error(error.message);
+    return data ?? [];
+  }
+
+  async function patchCoverImageId(targetDocumentId, coverImageId, expectedGeneration) {
+    const fresh = await loadCurrentDocument(targetDocumentId);
+    if (!fresh || fresh.status !== "indexed" || committedGenerationId(fresh.metadata) !== expectedGeneration) {
+      return false;
+    }
     const current =
-      fresh?.metadata && typeof fresh.metadata === "object" && !Array.isArray(fresh.metadata) ? fresh.metadata : {};
-    if (current.cover_image_id === coverImageId) return false;
-    const { error: patchError } = await supabase
+      fresh.metadata && typeof fresh.metadata === "object" && !Array.isArray(fresh.metadata) ? fresh.metadata : {};
+    if (current.cover_image_id === coverImageId) return true;
+
+    let patch = supabase
       .from("documents")
       .update({ metadata: { ...current, cover_image_id: coverImageId } })
-      .eq("id", targetDocumentId);
+      .eq("id", targetDocumentId)
+      .eq("status", "indexed")
+      .eq("storage_path", fresh.storage_path)
+      .eq("metadata", JSON.stringify(current));
+    patch = expectedGeneration
+      ? patch.eq("metadata->>index_generation_id", expectedGeneration)
+      : patch.is("metadata->>index_generation_id", null);
+    const { data: patched, error: patchError } = await patch.select("id").maybeSingle();
     if (patchError) throw new Error(patchError.message);
+    return Boolean(patched);
+  }
+
+  async function generationIsCurrent(expectedDocument, expectedGeneration) {
+    const fresh = await loadCurrentDocument(expectedDocument.id);
+    return Boolean(
+      fresh &&
+      fresh.status === "indexed" &&
+      fresh.storage_path === expectedDocument.storage_path &&
+      committedGenerationId(fresh.metadata) === expectedGeneration,
+    );
+  }
+
+  async function removeOrQueueReplacedImage(targetDocument, replacedPath) {
+    const { data: references, error: referenceError } = await supabase
+      .from("document_images")
+      .select("id")
+      .eq("storage_path", replacedPath)
+      .limit(1);
+    if (referenceError) throw new Error(referenceError.message);
+    if (references?.length) return;
+
+    const removal = await supabase.storage.from(imageBucket).remove([replacedPath]);
+    if (!removal.error) return;
+
+    const { error: cleanupError } = await supabase.from("storage_cleanup_jobs").insert({
+      owner_id: targetDocument.owner_id ?? null,
+      document_id: targetDocument.id,
+      document_bucket: documentBucket,
+      document_paths: [],
+      image_bucket: imageBucket,
+      image_paths: [replacedPath],
+      status: "pending",
+      last_error: removal.error.message,
+      metadata: {
+        operation: "replace_document_cover",
+        created_by: "backfill-document-covers",
+      },
+    });
+    if (cleanupError) {
+      throw new Error(`failed to remove or queue replaced cover ${replacedPath}: ${cleanupError.message}`);
+    }
+  }
+
+  async function retireCoverRow(targetDocument, coverRow) {
+    const { error } = await supabase
+      .from("document_images")
+      .delete()
+      .eq("id", coverRow.id)
+      .eq("document_id", targetDocument.id);
+    if (error) throw new Error(`failed to retire cover row ${coverRow.id}: ${error.message}`);
+    if (coverRow.storage_path) {
+      await removeOrQueueReplacedImage(targetDocument, coverRow.storage_path);
+    }
+  }
+
+  async function rollbackReplacementCover(targetDocument, insertedId, imagePath) {
+    if (insertedId) {
+      const fresh = await loadCurrentDocument(targetDocument.id);
+      if (fresh?.metadata?.cover_image_id === insertedId) {
+        return false;
+      }
+      const { error } = await supabase
+        .from("document_images")
+        .delete()
+        .eq("id", insertedId)
+        .eq("document_id", targetDocument.id);
+      if (error) {
+        throw new Error(`failed to roll back replacement cover row ${insertedId}: ${error.message}`);
+      }
+    }
+    await removeOrQueueReplacedImage(targetDocument, imagePath);
     return true;
   }
 
-  for (const doc of candidates) {
+  for (const candidate of candidates) {
     try {
-      const { data: existingCovers, error: coverError } = await supabase
-        .from("document_images")
-        .select("id")
-        .eq("document_id", doc.id)
-        .eq("source_kind", "cover_page")
-        .limit(1);
-      if (coverError) throw new Error(coverError.message);
-      if (existingCovers?.length) {
-        const existingId = existingCovers[0].id;
+      // Candidate and cover inventories are only selection snapshots. Reload both
+      // immediately before work so an atomic reindex cannot leave this repair
+      // operating on the generation that was current when corpus paging began.
+      const doc = await loadCurrentDocument(candidate.id);
+      if (
+        !doc ||
+        doc.status !== "indexed" ||
+        !doc.storage_path ||
+        !String(doc.file_type).toLowerCase().includes("pdf")
+      ) {
+        console.log(`skipped stale candidate ${candidate.id}`);
+        skipped += 1;
+        continue;
+      }
+
+      const committedGeneration = committedGenerationId(doc.metadata);
+      const existingCovers = await loadCurrentCovers(doc.id);
+      const { selected: committedCover, matches: committedCovers } = selectCommittedCovers(
+        existingCovers,
+        committedGeneration,
+        doc.metadata?.cover_image_id,
+      );
+      const existingCover = committedCover ?? existingCovers[0];
+
+      let existingObjectIsLive = false;
+      if (committedCover?.storage_path) {
+        const probe = await supabase.storage.from(imageBucket).download(committedCover.storage_path);
+        if (probe.error && !isMissingStorageObject(probe.error)) {
+          throw new Error(`failed to verify existing cover ${committedCover.id}: ${probe.error.message}`);
+        }
+        existingObjectIsLive = !probe.error && Boolean(probe.data);
+      }
+
+      if (existingCover && existingObjectIsLive) {
+        const existingId = existingCover.id;
+        let changed = false;
         if (apply && doc.metadata?.cover_image_id !== existingId) {
-          await patchCoverImageId(doc.id, existingId);
+          const patched = await patchCoverImageId(doc.id, existingId, committedGeneration);
+          if (!patched) {
+            console.log(`skipped generation-changed metadata repair for ${doc.id}`);
+            skipped += 1;
+            continue;
+          }
           console.log(`recovered cover metadata ${existingId} for ${doc.id}`);
+          changed = true;
+        }
+        if (apply && committedGeneration) {
+          for (const duplicate of committedCovers) {
+            if (duplicate.id === existingId) continue;
+            await retireCoverRow(doc, duplicate);
+            console.log(`retired duplicate cover ${duplicate.id} for ${doc.id}`);
+            changed = true;
+          }
+        }
+        if (changed) {
+          repaired += 1;
         } else {
-          console.log(`skip ${doc.id} already has cover ${existingId}`);
+          skipped += 1;
+          console.log(`verified live cover ${existingId} for ${doc.id}`);
         }
-        skipped += 1;
         continue;
       }
 
       if (!apply) {
-        console.log(`dry-run would create cover for ${doc.id} (${doc.title || doc.file_name})`);
+        console.log(
+          `dry-run would ${existingCover ? "repair missing cover object" : "create cover"} for ${doc.id} (${doc.title || doc.file_name})`,
+        );
         continue;
       }
 
       const workDir = await mkdtemp(path.join(tmpdir(), "cover-backfill-"));
       try {
-        const { data: blob, error: downloadError } = await supabase.storage
-          .from(documentBucket)
-          .download(doc.storage_path);
-        if (downloadError || !blob) throw new Error(downloadError?.message || "download failed");
-        const pdfPath = path.join(workDir, "source.pdf");
-        await writeFile(pdfPath, Buffer.from(await blob.arrayBuffer()));
-        const cover = await runPythonCover(pdfPath, workDir);
-        if (!cover?.path) throw new Error("cover render returned empty");
-
-        const bytes = await readFile(cover.path);
-        const generationId =
-          typeof doc.metadata?.index_generation_id === "string" && doc.metadata.index_generation_id
-            ? doc.metadata.index_generation_id
-            : randomUUID();
-        const imagePrefix = doc.owner_id ? `${doc.owner_id}/images/${doc.id}` : `local/${doc.id}`;
-        const imagePath = `${imagePrefix}/${generationId}/cover-page-1.png`;
-        const upload = await supabase.storage.from(imageBucket).upload(imagePath, bytes, {
-          contentType: "image/png",
-          upsert: true,
-        });
-        if (upload.error) throw new Error(upload.error.message);
-
-        const imageHash = createHash("sha256").update(bytes).digest("hex");
-        const { data: inserted, error: insertError } = await supabase
-          .from("document_images")
-          .insert({
+        let replacementPath = null;
+        let replacementRowId = null;
+        let replacementNeedsRollback = false;
+        try {
+          const { data: blob, error: downloadError } = await supabase.storage
+            .from(documentBucket)
+            .download(doc.storage_path);
+          if (downloadError || !blob) throw new Error(downloadError?.message || "download failed");
+          const pdfPath = path.join(workDir, "source.pdf");
+          await writeFile(pdfPath, Buffer.from(await blob.arrayBuffer()));
+          const cover = await runPythonCover(pdfPath, workDir);
+          if (!cover?.path) throw new Error("cover render returned empty");
+
+          const bytes = await readFile(cover.path);
+          const generationId = committedGeneration ?? randomUUID();
+          const repairId = randomUUID();
+          const imagePrefix = doc.owner_id ? `${doc.owner_id}/images/${doc.id}` : `local/${doc.id}`;
+          const imagePath = `${imagePrefix}/${generationId}/cover-page-1-${repairId}.png`;
+          const upload = await supabase.storage.from(imageBucket).upload(imagePath, bytes, {
+            contentType: "image/png",
+            upsert: false,
+          });
+          if (upload.error) throw new Error(upload.error.message);
+          replacementPath = imagePath;
+          replacementNeedsRollback = true;
+
+          // Rendering and upload can be slow. Revalidate immediately before the
+          // database write, then use a generation-conditioned pointer update as
+          // the final compare-and-swap. If either fence fails, remove the new
+          // artifact instead of publishing an old-generation cover.
+          if (!(await generationIsCurrent(doc, committedGeneration))) {
+            await rollbackReplacementCover(doc, null, imagePath);
+            replacementNeedsRollback = false;
+            console.log(`skipped generation-changed cover repair for ${doc.id}`);
+            skipped += 1;
+            continue;
+          }
+
+          const imageHash = createHash("sha256").update(bytes).digest("hex");
+          const imageRow = {
             document_id: doc.id,
             page_number: 1,
             storage_path: imagePath,
@@ -263,33 +454,80 @@ async function main() {
               index_generation_id: generationId,
               backfill: "document-cover-thumbnails",
             },
-          })
-          .select("id")
-          .single();
-        if (insertError) throw new Error(insertError.message);
+          };
 
-        await patchCoverImageId(doc.id, inserted.id);
+          // Insert first and retire the previous row only after the document
+          // pointer moves. This preserves the old storage-path ledger until the
+          // replacement is committed and makes a failed compare-and-swap easy to
+          // roll back without reconstructing a mutated row.
+          const { data: inserted, error: insertError } = await supabase
+            .from("document_images")
+            .insert(imageRow)
+            .select("id")
+            .single();
+          if (insertError) throw new Error(insertError.message);
+          replacementRowId = inserted.id;
 
-        created += 1;
-        console.log(`created cover ${inserted.id} for ${doc.id}`);
+          const patched = await patchCoverImageId(doc.id, inserted.id, committedGeneration);
+          if (!patched) {
+            const rolledBack = await rollbackReplacementCover(doc, inserted.id, imagePath);
+            if (!rolledBack) {
+              throw new Error(`replacement cover ${inserted.id} became published during rollback`);
+            }
+            replacementNeedsRollback = false;
+            console.log(`rolled back generation-changed cover repair for ${doc.id}`);
+            skipped += 1;
+            continue;
+          }
+          replacementNeedsRollback = false;
+
+          if (existingCover) {
+            await retireCoverRow(doc, existingCover);
+            repaired += 1;
+            console.log(`repaired cover ${inserted.id} for ${doc.id}`);
+          } else {
+            created += 1;
+            console.log(`created cover ${inserted.id} for ${doc.id}`);
+          }
+        } catch (error) {
+          if (replacementNeedsRollback && replacementPath) {
+            try {
+              await rollbackReplacementCover(doc, replacementRowId, replacementPath);
+            } catch (rollbackError) {
+              const originalMessage = error instanceof Error ? error.message : String(error);
+              const rollbackMessage = rollbackError instanceof Error ? rollbackError.message : String(rollbackError);
+              throw new Error(`${originalMessage}; rollback failed: ${rollbackMessage}`);
+            }
+          }
+          throw error;
+        }
       } finally {
         await rm(workDir, { recursive: true, force: true });
       }
     } catch (error) {
       failed += 1;
-      console.error(`failed ${doc.id}:`, error instanceof Error ? error.message : error);
+      console.error(`failed ${candidate.id}:`, error instanceof Error ? error.message : error);
     }
   }
 
   console.log(
-    JSON.stringify({ mode: apply ? "apply" : "dry-run", created, skipped, failed, scanned: candidates.length }),
+    JSON.stringify({
+      mode: apply ? "apply" : "dry-run",
+      created,
+      repaired,
+      skipped,
+      failed,
+      scanned: candidates.length,
+    }),
   );
   if (!apply) {
     console.log("Re-run with --apply to write covers.");
   }
 }
 
-main().catch((error) => {
-  console.error(error);
-  process.exit(1);
-});
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+  main().catch((error) => {
+    console.error(error);
+    process.exit(1);
+  });
+}
diff --git a/scripts/audit-merge-loss.mjs b/scripts/audit-merge-loss.mjs
new file mode 100644
index 0000000000..9f34cdaaed
--- /dev/null
+++ b/scripts/audit-merge-loss.mjs
@@ -0,0 +1,574 @@
+#!/usr/bin/env node
+/**
+ * audit-merge-loss — find merged pull requests whose content was silently
+ * reverted by a later merge resolution.
+ *
+ * Why this exists. On 2026-08-11 merge commit acf78bf ("Merge remote-tracking
+ * branch origin/main into probe2-1815") took the stale branch side of several
+ * manual conflict resolutions and reverted seven already-merged PRs — #1800,
+ * #1803, #1804, #1809, #1811, #1815 and #1796. Nothing went red, because the
+ * reverts took each PR's tests in the same stroke: no assertion survived to
+ * fail. The docs casualties were repaired by 55f51ab; the source casualties
+ * went unnoticed for two days. Care at the keyboard is demonstrably not the
+ * control here — commit 6f8c70d shows a human consciously preserving the #1803
+ * migration and a later merge in the same chain undoing it anyway.
+ *
+ * The measurement. For each pull request that landed on the target ref inside
+ * the window, compare the ref's current tree entry for every file that landing
+ * changed against that file's tree entry at the landing's first parent. Equality
+ * means the landing's contribution to that file is no longer present. Tree
+ * entries include the file mode and blob OID, so mode-only landings are not
+ * mistaken for losses while the comparison stays cheap over a wide window.
+ *
+ * ADVISORY BY DESIGN — this exits 0 even when it finds something. A deliberate
+ * later revert is byte-identical to an accidental one at blob level, so a
+ * positive is a question for a human, not a verdict. The report names the pull
+ * request, the landing commit and every affected file so that question can be
+ * answered. `--strict` exits 1 for a caller that wants a hard failure.
+ *
+ * DELIBERATELY NOT WIRED INTO CI OR A SCHEDULE. Running this automatically is
+ * an operational change that needs its own pull request and explicit approval;
+ * its absence from .github/workflows/ is a decision, not an oversight. It is
+ * also not in `verify:cheap:internal`: check-gate-manifest.mjs would then
+ * require a matching ci.yml step.
+ *
+ * Run: npm run audit:merge-loss
+ *      npm run audit:merge-loss -- --since 30 --ref origin/main
+ *      npm run audit:merge-loss -- --json
+ *      npm run audit:merge-loss -- --strict     # exit 1 on any finding
+ *      node scripts/audit-merge-loss.mjs --self-test
+ */
+import { execFileSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const DEFAULT_REF = "origin/main";
+const DEFAULT_WINDOW_DAYS = 14;
+const LOG_FORMAT = "%H%x09%cI%x09%s";
+
+function git(args) {
+  return execFileSync("git", args, { cwd: ROOT, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+}
+
+function tryGit(args) {
+  try {
+    return git(args);
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * The pull request a landing commit belongs to, or undefined.
+ *
+ * Both shapes occur on this repo's main: a merge landing ("Merge pull request
+ * #1935 from …") and a squash landing ("… (#1933)"). A squash subject can carry
+ * more than one issue reference, so the pull request is the LAST parenthesised
+ * number — GitHub appends it.
+ */
+export function parsePullNumber(subject) {
+  const merge = /^Merge pull request #(\d+)\b/.exec(String(subject ?? ""));
+  if (merge) return Number(merge[1]);
+  const squashed = [...String(subject ?? "").matchAll(/\(#(\d+)\)/g)];
+  const last = squashed.at(-1);
+  return last ? Number(last[1]) : undefined;
+}
+
+/** Parse `git log --format=%H\t%cI\t%s` output into landing records. */
+export function parseLogEntries(rawLog) {
+  return String(rawLog ?? "")
+    .split(/\r?\n/)
+    .filter((line) => line.trim().length > 0)
+    .map((line) => {
+      const [sha, date, ...rest] = line.split("\t");
+      const subject = rest.join("\t");
+      return { sha, date, subject, pullNumber: parsePullNumber(subject) };
+    });
+}
+
+const INBOX = "docs/outstanding-issues-inbox";
+
+/**
+ * The one exemption, kept deliberately narrow.
+ *
+ * `npm run issues:reconcile` MOVES a pending request from the inbox to
+ * `applied/` verbatim, so every pull request that queues one looks like it
+ * added a file that is now gone. That is the request's designed lifecycle, not
+ * a loss — and it accounted for six of fifteen findings on the first real run,
+ * which would have buried the genuine #1803 signal. The move is only credited
+ * when the identically-named audit record exists at the target ref with the
+ * same tree entry as the request at its landing. This confirms the move was
+ * verbatim rather than hiding a mismatched or corrupted request.
+ */
+export function isReconciliationMove(file, landingRef, ref, entryAt) {
+  const match = new RegExp(`^${INBOX}/([^/]+\\.json)$`).exec(file);
+  if (!match) return false;
+  const requestAtLanding = entryAt(landingRef, file);
+  return requestAtLanding !== null && entryAt(ref, `${INBOX}/applied/${match[1]}`) === requestAtLanding;
+}
+
+/**
+ * Where a landing's contribution to one file disappeared, and by what mechanism.
+ *
+ * Walk the commits that touched `file` between the landing and the ref OLDEST
+ * FIRST and take the first one whose tree entry already equals the pre-landing
+ * entry. That is where the contribution stopped being present; a later commit
+ * that also matches is just carrying the absence forward.
+ *
+ * The mechanism is the triage signal, and it is the reason this tool can be read
+ * at all. A merge commit dropping a side is the accidental case the audit exists
+ * for. A single-parent commit is somebody choosing to remove the change, and its
+ * subject almost always says why. Measured over the 2026-08-01..15 window: of 66
+ * flagged non-inbox files, 14 were merge-resolution removals and 13 of those came
+ * from the single documented bad merge (acf78bf) — while every one of the other 52
+ * had an explanatory single-parent subject ("Re-land the --shadow-tight
+ * retirement", "rework the viewer for phone and PWA reading", "ci: speed
+ * iteration without weakening gates").
+ *
+ * This does NOT turn the audit into a verdict, and deliberately does not filter:
+ * a deliberate-looking commit can still be a mistake, and `unknown` means the
+ * walk found no commit matching the pre-landing entry, which is a question rather
+ * than a clean bill. It orders the reading list so the accidental cases are not
+ * buried under the deliberate ones.
+ *
+ * Pure, with git access injected, so it is testable without a repository.
+ *
+ * @param {{ file: string, landingSha: string, preEntry: string | null, ref: string,
+ *   historyOf: (landingSha: string, ref: string, file: string) => Array<{ sha: string, subject: string }>,
+ *   entryAt: (ref: string, file: string) => string | null,
+ *   isMergeCommit: (sha: string) => boolean }} options
+ */
+export function classifyRemoval({ file, landingSha, preEntry, ref, historyOf, entryAt, isMergeCommit }) {
+  const commits = historyOf(landingSha, ref, file) ?? [];
+  for (const commit of commits) {
+    if (entryAt(commit.sha, file) !== preEntry) continue;
+    return {
+      mechanism: isMergeCommit(commit.sha) ? "merge-resolution" : "deliberate-commit",
+      sha: commit.sha,
+      subject: commit.subject,
+    };
+  }
+  return { mechanism: "unknown", sha: undefined, subject: undefined };
+}
+
+const MECHANISMS = ["merge-resolution", "deliberate-commit", "unknown"];
+
+/** How many of a finding's files went in a merge resolution — the ordering key. */
+function mergeResolutionCount(finding) {
+  return finding.revertedFiles.filter((entry) => entry.removal?.mechanism === "merge-resolution").length;
+}
+
+/**
+ * Compare each landing's contribution against the ref's current state.
+ *
+ * `entryAt(ref, file)` returns a tree entry (mode, object type, and blob OID),
+ * or null when the path does not exist at that ref. Injected so the whole
+ * classifier is testable without git.
+ *
+ * A file is reported when its current blob equals its pre-landing blob. Both
+ * being null counts: that is the "the pull request added this file and it is
+ * gone again" case. A file the pull request DELETED and which is still absent
+ * does not match, because its pre-landing blob existed — the deletion survived.
+ *
+ * `removalOf` is optional. When given, each reported file carries the commit and
+ * mechanism that removed it (see classifyRemoval) and findings are ordered so the
+ * merge-resolution cases come first. Omitting it leaves the finding shape and the
+ * original ordering untouched.
+ *
+ * Pure and exported for the self-test and focused tests.
+ *
+ * @typedef {{ sha: string, date: string, subject: string, pullNumber: number | undefined,
+ *   preRef: string, files?: string[] }} Landing
+ * @typedef {{ mechanism: "merge-resolution" | "deliberate-commit" | "unknown",
+ *   sha: string | undefined, subject: string | undefined }} Removal
+ * @param {{ landings?: Landing[], entryAt: (ref: string, file: string) => string | null,
+ *   ref?: string,
+ *   removalOf?: (context: { file: string, landingSha: string, preEntry: string | null }) => Removal | undefined
+ *   }} options
+ */
+export function classifyMergeLoss({ landings = [], entryAt, ref = DEFAULT_REF, removalOf }) {
+  const findings = [];
+  let filesCompared = 0;
+  let filesExempted = 0;
+  const skipped = [];
+  const mechanismCounts = Object.fromEntries(MECHANISMS.map((mechanism) => [mechanism, 0]));
+  for (const landing of landings) {
+    if (landing.pullNumber === undefined) {
+      skipped.push(landing);
+      continue;
+    }
+    const reverted = [];
+    for (const file of landing.files ?? []) {
+      filesCompared += 1;
+      const before = entryAt(landing.preRef, file);
+      const now = entryAt(ref, file);
+      if (before !== now) continue;
+      if (now === null && isReconciliationMove(file, landing.sha, ref, entryAt)) {
+        filesExempted += 1;
+        continue;
+      }
+      // `removalOf` stays optional so the finding shape is unchanged for callers
+      // that only want the comparison — the mechanism costs a `git log` per
+      // flagged file, which is worth paying for findings and not for every
+      // compared file.
+      const removal = removalOf ? removalOf({ file, landingSha: landing.sha, preEntry: before }) : undefined;
+      if (removal) mechanismCounts[removal.mechanism] += 1;
+      reverted.push(removal ? { file, absent: now === null, removal } : { file, absent: now === null });
+    }
+    if (reverted.length > 0) {
+      findings.push({
+        pullNumber: landing.pullNumber,
+        sha: landing.sha,
+        date: landing.date,
+        subject: landing.subject,
+        changedFiles: (landing.files ?? []).length,
+        revertedFiles: reverted,
+      });
+    }
+  }
+  // Merge-resolution removals first: they are the accidental case. With no
+  // `removalOf` every count is 0, so this falls through to the original
+  // most-of-the-landing-missing order.
+  findings.sort(
+    (a, b) =>
+      mergeResolutionCount(b) - mergeResolutionCount(a) ||
+      b.revertedFiles.length - a.revertedFiles.length ||
+      a.pullNumber - b.pullNumber,
+  );
+  return {
+    findings,
+    scannedLandings: landings.length - skipped.length,
+    skipped,
+    filesCompared,
+    filesExempted,
+    mechanismCounts,
+  };
+}
+
+function resolveArgs(argv) {
+  const value = (name) => {
+    const index = argv.indexOf(name);
+    return index >= 0 ? argv[index + 1] : undefined;
+  };
+  const rawSince = value("--since");
+  const since = rawSince === undefined ? DEFAULT_WINDOW_DAYS : Number(rawSince);
+  if (!Number.isFinite(since) || since <= 0) {
+    throw new Error(`--since expects a positive number of days, received "${rawSince}"`);
+  }
+  return {
+    ref: value("--ref") ?? DEFAULT_REF,
+    since,
+    json: argv.includes("--json"),
+    strict: argv.includes("--strict"),
+  };
+}
+
+function collectLandings(ref, since) {
+  const rawLog = git(["log", "--first-parent", `--since=${since} days ago`, `--format=${LOG_FORMAT}`, ref]);
+  return parseLogEntries(rawLog).map((landing) => {
+    const preRef = `${landing.sha}^1`;
+    const names = tryGit(["diff", "--name-only", preRef, landing.sha]);
+    return { ...landing, preRef, files: names === undefined ? [] : names.split(/\r?\n/).filter(Boolean) };
+  });
+}
+
+/**
+ * The mode/type/OID prefix of one `git ls-tree` line, with the path removed.
+ *
+ * `ls-tree` renders `<mode> SP <type> SP <oid> TAB <path>`, so the split is on a
+ * REAL tab. This is exported because getting it wrong is invisible to any test
+ * that injects `entryAt` directly, which is how the original `"\\t"` (a literal
+ * backslash-t, matching nothing) survived a green suite: leaving the path on the
+ * entry is harmless for the same-path comparison that finds losses, and breaks
+ * only the cross-path reconciliation check, which compares an inbox request
+ * against its `applied/` record. That silently turned every reconciled request
+ * back into a finding — 189 of 255 flagged files on a 14-day window, with
+ * `filesExempted` reporting 0 — burying the genuine signal the exemption exists
+ * to protect. Parse it here, once, and test it against real `ls-tree` output.
+ */
+export function parseTreeEntry(raw) {
+  if (raw === undefined || raw === null) return null;
+  const line = String(raw);
+  if (line.length === 0) return null;
+  return line.split("\t", 1)[0];
+}
+
+function treeEntryReader() {
+  const cache = new Map();
+  return (ref, file) => {
+    const key = `${ref}:${file}`;
+    if (!cache.has(key)) {
+      cache.set(key, parseTreeEntry(tryGit(["ls-tree", ref, "--", file])));
+    }
+    return cache.get(key);
+  };
+}
+
+/**
+ * Commits touching `file` between a landing and the ref, oldest first.
+ *
+ * `--full-history` matters: default history simplification hides the merge
+ * commits that are exactly what this walk is looking for, so without it a
+ * merge-resolution removal reports as `unknown`.
+ */
+function historyReader() {
+  const cache = new Map();
+  return (landingSha, ref, file) => {
+    const key = `${landingSha}..${ref}:${file}`;
+    if (!cache.has(key)) {
+      const raw = tryGit([
+        "log",
+        "--reverse",
+        "--first-parent",
+        "--full-history",
+        "--format=%H%x1f%s",
+        `${landingSha}..${ref}`,
+        "--",
+        file,
+      ]);
+      cache.set(
+        key,
+        String(raw ?? "")
+          .split(/\r?\n/)
+          .filter((line) => line.trim().length > 0)
+          .map((line) => {
+            const [sha, ...rest] = line.split("\x1f");
+            return { sha, subject: rest.join("\x1f") };
+          }),
+      );
+    }
+    return cache.get(key);
+  };
+}
+
+function mergeCommitReader() {
+  const cache = new Map();
+  return (sha) => {
+    if (!cache.has(sha)) {
+      const raw = tryGit(["rev-list", "--parents", "-n", "1", sha]);
+      // `<sha> <parent>…` — more than one parent means a merge.
+      cache.set(sha, raw === undefined ? false : raw.trim().split(/\s+/).length - 1 > 1);
+    }
+    return cache.get(sha);
+  };
+}
+
+const MECHANISM_LABEL = {
+  "merge-resolution": "MERGE-RESOLUTION",
+  "deliberate-commit": "deliberate commit",
+  unknown: "unresolved",
+};
+
+function report(result, { ref, since, strict }) {
+  const { findings, scannedLandings, skipped, filesCompared, filesExempted } = result;
+  console.log(
+    `[merge-loss] scanned ${scannedLandings} pull request landing(s) on ${ref} over the last ${since} day(s); ` +
+      `compared ${filesCompared} file(s).`,
+  );
+  if (skipped.length > 0) {
+    console.log(
+      `[merge-loss] ${skipped.length} first-parent commit(s) carried no pull request number and were skipped.`,
+    );
+  }
+  if (filesExempted > 0) {
+    console.log(
+      `[merge-loss] ${filesExempted} inbox request(s) were excluded: issues:reconcile moved them to applied/ verbatim.`,
+    );
+  }
+  if (findings.length === 0) {
+    console.log("[merge-loss] No landing has been reverted to its pre-merge state.");
+    return 0;
+  }
+
+  console.log("");
+  console.log(`[merge-loss] ${findings.length} landing(s) look reverted — HUMAN CONFIRMATION REQUIRED.`);
+  console.log("A deliberate later revert is identical to an accidental one at blob level, so this is a");
+  console.log("question, not a verdict. For each entry below, decide whether the change was meant to go.");
+  const counts = result.mechanismCounts ?? {};
+  if (MECHANISMS.some((mechanism) => counts[mechanism] > 0)) {
+    console.log("");
+    console.log(
+      `[merge-loss] removal mechanism across ${MECHANISMS.reduce((total, m) => total + counts[m], 0)} flagged file(s): ` +
+        `${counts["merge-resolution"]} merge-resolution, ${counts["deliberate-commit"]} deliberate commit, ` +
+        `${counts.unknown} unresolved.`,
+    );
+    console.log("Merge-resolution removals are the accidental case and are listed FIRST. A deliberate commit");
+    console.log("with an explanatory subject is usually a real decision — check it, but check the others first.");
+    console.log("`unresolved` means no commit in the window matched the pre-merge entry; treat it as a question.");
+  }
+  for (const finding of findings) {
+    console.log("");
+    console.log(`  PR #${finding.pullNumber} — ${finding.subject}`);
+    console.log(`    landed ${finding.date} as ${finding.sha.slice(0, 12)}`);
+    console.log(
+      `    ${finding.revertedFiles.length} of ${finding.changedFiles} changed file(s) match the pre-merge tree entry:`,
+    );
+    for (const entry of finding.revertedFiles) {
+      console.log(`      - ${entry.file}${entry.absent ? " (added by the PR, absent now)" : ""}`);
+      if (entry.removal) {
+        const where = entry.removal.sha ? ` ${entry.removal.sha.slice(0, 12)} — ${entry.removal.subject}` : "";
+        console.log(`          via ${MECHANISM_LABEL[entry.removal.mechanism]}:${where}`);
+      }
+    }
+    console.log(`    Inspect: git diff ${finding.sha}^1 ${finding.sha} -- <file>`);
+  }
+  console.log("");
+  console.log("Confirmed losses are re-landed as their own pull request; record the decision with npm run issues:add.");
+  return strict ? 1 : 0;
+}
+
+function selfTest() {
+  if (parsePullNumber("Merge pull request #1935 from BigSimmo/codex/fix-x") !== 1935) {
+    throw new Error("self-test failed: merge-landing subject not parsed");
+  }
+  if (parsePullNumber("ci: speed iteration without weakening gates (#1926)") !== 1926) {
+    throw new Error("self-test failed: squash-landing subject not parsed");
+  }
+  if (parsePullNumber("fix: close (#12) properly (#1930)") !== 1930) {
+    throw new Error("self-test failed: trailing pull request number not preferred");
+  }
+  if (parsePullNumber("Merge branch 'main' into feature") !== undefined) {
+    throw new Error("self-test failed: a non-pull-request subject produced a number");
+  }
+
+  const entries = parseLogEntries("abc\t2026-08-14T06:00:11+08:00\tMerge pull request #10 from o/b\n");
+  if (entries.length !== 1 || entries[0].pullNumber !== 10 || entries[0].sha !== "abc") {
+    throw new Error("self-test failed: log parsing is incorrect");
+  }
+
+  const blobs = new Map([
+    ["pre:kept.ts", "aaa"],
+    ["head:kept.ts", "bbb"],
+    ["pre:lost.ts", "ccc"],
+    ["head:lost.ts", "ccc"],
+    ["head:deleted.ts", null],
+    ["pre:deleted.ts", "ddd"],
+  ]);
+  const entryAt = (ref, file) => blobs.get(`${ref}:${file}`) ?? null;
+  const { findings } = classifyMergeLoss({
+    ref: "head",
+    entryAt,
+    landings: [
+      { sha: "s1", date: "d", subject: "x (#1)", pullNumber: 1, preRef: "pre", files: ["kept.ts"] },
+      { sha: "s2", date: "d", subject: "y (#2)", pullNumber: 2, preRef: "pre", files: ["lost.ts", "kept.ts"] },
+      { sha: "s3", date: "d", subject: "z (#3)", pullNumber: 3, preRef: "pre", files: ["deleted.ts"] },
+      { sha: "s4", date: "d", subject: "w (#4)", pullNumber: 4, preRef: "pre", files: ["added.ts"] },
+    ],
+  });
+  const byPull = new Map(findings.map((finding) => [finding.pullNumber, finding]));
+  if (byPull.has(1)) throw new Error("self-test failed: a surviving change was reported as lost");
+  if (byPull.get(2)?.revertedFiles.length !== 1) throw new Error("self-test failed: a reverted file was not reported");
+  if (byPull.has(3)) throw new Error("self-test failed: a surviving deletion was reported as lost");
+  if (!byPull.get(4)) throw new Error("self-test failed: a vanished added file was not reported");
+
+  const request = `${INBOX}/11111111-1111-4111-8111-111111111111.json`;
+  const reconciled = classifyMergeLoss({
+    ref: "head",
+    entryAt: (reference, file) => {
+      if (reference === "s5" && file === request) return "100644 blob eee";
+      return reference === "head" && file === `${INBOX}/applied/${path.posix.basename(request)}`
+        ? "100644 blob eee"
+        : null;
+    },
+    landings: [{ sha: "s5", date: "d", subject: "q (#5)", pullNumber: 5, preRef: "pre", files: [request] }],
+  });
+  if (reconciled.findings.length !== 0 || reconciled.filesExempted !== 1) {
+    throw new Error("self-test failed: a reconciled inbox request was reported as a merge loss");
+  }
+
+  // Regression guard for the `"\\t"` bug. The check above injects bare entries, so
+  // it passes either way; this one runs real `ls-tree` output through the real
+  // parser, where leaving the path attached makes the cross-path comparison fail.
+  if (parseTreeEntry("100644 blob eee\tsome/path.json") !== "100644 blob eee") {
+    throw new Error("self-test failed: parseTreeEntry did not strip the path from an ls-tree line");
+  }
+  if (parseTreeEntry(undefined) !== null || parseTreeEntry("") !== null) {
+    throw new Error("self-test failed: parseTreeEntry did not treat a missing path as null");
+  }
+  const applied = `${INBOX}/applied/${path.posix.basename(request)}`;
+  const lsTree = (file) => parseTreeEntry(`100644 blob eee\t${file}`);
+  const realistic = classifyMergeLoss({
+    ref: "head",
+    entryAt: (reference, file) => {
+      if (reference === "s6" && file === request) return lsTree(file);
+      return reference === "head" && file === applied ? lsTree(file) : null;
+    },
+    landings: [{ sha: "s6", date: "d", subject: "r (#6)", pullNumber: 6, preRef: "pre", files: [request] }],
+  });
+  if (realistic.findings.length !== 0 || realistic.filesExempted !== 1) {
+    throw new Error("self-test failed: the reconciliation exemption does not survive real ls-tree entries");
+  }
+
+  const history = { "s7..head:lost.ts": [{ sha: "m1", subject: "Merge remote-tracking branch 'origin/main'" }] };
+  const removal = classifyRemoval({
+    file: "lost.ts",
+    landingSha: "s7",
+    preEntry: "pre-entry",
+    ref: "head",
+    historyOf: (landingSha, reference, file) => history[`${landingSha}..${reference}:${file}`] ?? [],
+    entryAt: () => "pre-entry",
+    isMergeCommit: (sha) => sha === "m1",
+  });
+  if (removal.mechanism !== "merge-resolution" || removal.sha !== "m1") {
+    throw new Error("self-test failed: a merge-resolution removal was not classified");
+  }
+  const unresolved = classifyRemoval({
+    file: "lost.ts",
+    landingSha: "s7",
+    preEntry: "pre-entry",
+    ref: "head",
+    historyOf: () => [],
+    entryAt: () => "pre-entry",
+    isMergeCommit: () => false,
+  });
+  if (unresolved.mechanism !== "unknown") {
+    throw new Error("self-test failed: an empty history should classify as unknown, not as deliberate");
+  }
+  console.error("merge-loss audit self-test passed.");
+}
+
+function main() {
+  if (process.argv.includes("--self-test")) return selfTest();
+  const options = resolveArgs(process.argv.slice(2));
+
+  const shallow = tryGit(["rev-parse", "--is-shallow-repository"]);
+  if (shallow?.trim() !== "false") {
+    console.error("[merge-loss] this is a shallow clone; pre-merge parents are unavailable and a clean sweep here");
+    console.error("[merge-loss] would be meaningless. Re-run after `git fetch --unshallow`.");
+    process.exitCode = 1;
+    return;
+  }
+  if (tryGit(["rev-parse", "--verify", "--quiet", `${options.ref}^{commit}`]) === undefined) {
+    console.error(`[merge-loss] cannot resolve ref "${options.ref}"; fetch it or pass --ref <ref>.`);
+    process.exitCode = 1;
+    return;
+  }
+
+  const landings = collectLandings(options.ref, options.since);
+  const entryAt = treeEntryReader();
+  const historyOf = historyReader();
+  const isMergeCommit = mergeCommitReader();
+  const result = classifyMergeLoss({
+    landings,
+    entryAt,
+    ref: options.ref,
+    removalOf: ({ file, landingSha, preEntry }) =>
+      classifyRemoval({ file, landingSha, preEntry, ref: options.ref, historyOf, entryAt, isMergeCommit }),
+  });
+  if (options.json) {
+    console.log(JSON.stringify({ ref: options.ref, sinceDays: options.since, ...result }, null, 2));
+    process.exitCode = options.strict && result.findings.length > 0 ? 1 : 0;
+    return;
+  }
+  process.exitCode = report(result, options);
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    main();
+  } catch (error) {
+    console.error(`[merge-loss] failed: ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 1;
+  }
+}
diff --git a/scripts/check-design-system-contract.mjs b/scripts/check-design-system-contract.mjs
index e9518001fa..b990dfa56f 100644
--- a/scripts/check-design-system-contract.mjs
+++ b/scripts/check-design-system-contract.mjs
@@ -10,6 +10,7 @@ import {
   findDebtPathRegressions,
   findErrorStateCountPropsInSource,
   findFailedStateResultCountsInSource,
+  findInteractiveTapFloorDeclarationsInSource,
   findInteractiveTapLiteralsInSource,
   findTextSoftConsumersInSource,
   findTypeStepCssUsagesInSource,
@@ -65,6 +66,11 @@ function findInteractiveTapLiterals(file) {
   return findInteractiveTapLiteralsInSource(file.relativePath, sourceText);
 }
 
+function findInteractiveTapFloorDeclarations(file) {
+  const sourceText = fs.readFileSync(file.absolutePath, "utf8");
+  return findInteractiveTapFloorDeclarationsInSource(file.relativePath, sourceText);
+}
+
 function findTherapyButtonsWithoutBaseClass(file) {
   if (!file.relativePath.startsWith("src/components/therapy-compass/") || !file.relativePath.endsWith(".tsx"))
     return [];
@@ -113,6 +119,7 @@ const metrics = {
   rawColorLiterals: 0,
   literalShadowClasses: 0,
   legacyTapClasses: 0,
+  interactiveTapFloorDeclarations: 0,
   colourOnlyStatusIndicators: 0,
   statusColouredNumerals: 0,
   edgeOwnershipConflicts: 0,
@@ -184,6 +191,7 @@ for (const file of files) {
   const classAnalysis = analyzeClassContractsInSource(file.relativePath, source);
   recordDebt("literalShadowClasses", file.relativePath, classAnalysis.literalShadowClasses.length);
   recordDebt("legacyTapClasses", file.relativePath, classAnalysis.legacyTapClasses.length);
+  recordDebt("interactiveTapFloorDeclarations", file.relativePath, findInteractiveTapFloorDeclarations(file).length);
   // Fail closed when a whole-file text scan finds debt the AST class-root pass
   // cannot see (unresolved identifiers, odd expression shapes). Baselines are 0,
   // so any miss would otherwise silently weaken the ratchet.
@@ -487,7 +495,7 @@ if (failures.length > 0) {
 }
 
 console.log(
-  `Design-system contract passed (${files.length} production files; raw colors ${metrics.rawColorLiterals}; literal shadows ${metrics.literalShadowClasses}; legacy tap classes ${metrics.legacyTapClasses}; edge conflicts ${metrics.edgeOwnershipConflicts}; 1px shadow spreads ${metrics.onePixelShadowSpreads}).`,
+  `Design-system contract passed (${files.length} production files; raw colors ${metrics.rawColorLiterals}; literal shadows ${metrics.literalShadowClasses}; legacy tap classes ${metrics.legacyTapClasses}; sub-floor interactive min-heights ${metrics.interactiveTapFloorDeclarations}; edge conflicts ${metrics.edgeOwnershipConflicts}; 1px shadow spreads ${metrics.onePixelShadowSpreads}).`,
 );
 console.log(
   `Motion/z/palette ratchets: hardcoded CSS durations ${metrics.hardcodedCssMotionDurations}; layout transitions ${metrics.layoutTransitionExceptions}; raw CSS z-index ${metrics.rawCssZIndices}; legacy palette utilities ${metrics.legacyPaletteUtilities}; dark color overrides ${metrics.darkColorOverrides}; legacy shadow aliases ${metrics.legacyShadowAliases}; arbitrary tracking ${metrics.arbitraryTracking}.`,
diff --git a/scripts/check-ledger-write-discipline.mjs b/scripts/check-ledger-write-discipline.mjs
index 3790dd297d..68ee61e02b 100644
--- a/scripts/check-ledger-write-discipline.mjs
+++ b/scripts/check-ledger-write-discipline.mjs
@@ -10,6 +10,12 @@
  *
  * This is deliberately stronger than a shape check. A valid-looking manual
  * edit would still reintroduce the shared-hunk race that the inbox removes.
+ *
+ * Both comparison endpoints are commits, so an edit that is still sitting in
+ * the working tree is invisible here and the audited range is empty. Reporting
+ * a pass in that state told an author on 2026-08-13 that a forbidden hand-edit
+ * of the canonical ledger was fine (issue #313). The gate therefore refuses to
+ * report any verdict while a governed path is dirty — see dirtyGovernedPaths.
  */
 import { execFileSync } from "node:child_process";
 import path from "node:path";
@@ -28,6 +34,19 @@ function git(args) {
   return execFileSync("git", args, { cwd: ROOT, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
 }
 
+/**
+ * Untrimmed on purpose: porcelain's status field is two columns wide and its
+ * first column is a space for an unstaged change, so trimming shifts every path
+ * by one character and the governed-path match silently stops firing.
+ */
+function statusPorcelain(pathspecs) {
+  return execFileSync("git", ["status", "--porcelain=v1", "-z", "--untracked-files=normal", "--", ...pathspecs], {
+    cwd: ROOT,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+  });
+}
+
 function readAt(ref, relative) {
   return execFileSync("git", ["show", `${ref}:${relative}`], {
     cwd: ROOT,
@@ -156,6 +175,48 @@ export function verifyIssueReconciliation({
   return failures;
 }
 
+function governedReason(relative) {
+  if (relative === ISSUES_LEDGER) return "the canonical outstanding-issues ledger";
+  if (relative === REVIEW_LEDGER) return "the frozen branch-review ledger";
+  if (relative === INBOX || relative.startsWith(`${INBOX}/`)) return "an outstanding-issues inbox request";
+  return undefined;
+}
+
+/**
+ * Governed paths carrying working-tree changes the committed-range audit cannot
+ * see. Input is `git status --porcelain=v1 -z --untracked-files=normal` output;
+ * NUL records avoid porcelain's quoting rules entirely, and a rename/copy record
+ * is followed by a second field holding its original path.
+ *
+ * Pure and exported so the script self-test and focused tests can exercise it
+ * without a fixture repository.
+ */
+export function dirtyGovernedPaths(porcelain) {
+  const fields = String(porcelain ?? "").split("\0");
+  const dirty = [];
+  const seen = new Set();
+  for (let index = 0; index < fields.length; index += 1) {
+    const record = fields[index];
+    if (record.length < 4) continue; // trailing empty field, never a real record
+    const status = record.slice(0, 2);
+    const paths = [record.slice(3)];
+    if (status[0] === "R" || status[0] === "C") {
+      const origin = fields[index + 1];
+      index += 1;
+      if (origin) paths.push(origin);
+    }
+    for (const relative of paths) {
+      const reason = governedReason(relative);
+      if (reason === undefined || seen.has(relative)) continue;
+      seen.add(relative);
+      const change =
+        status === "??" ? "is untracked" : `has an uncommitted change (${status.trim() || status.trimEnd()})`;
+      dirty.push({ path: relative, status, reason: `${reason} ${change}` });
+    }
+  }
+  return dirty;
+}
+
 export function reviewLedgerRowsChanged(baseMarkdown, headMarkdown) {
   const baseRows = parseLedgerRows(baseMarkdown).map((row) => row.raw);
   const headRows = parseLedgerRows(headMarkdown).map((row) => row.raw);
@@ -288,6 +349,23 @@ function selfTest() {
     throw new Error("self-test failed: partial reconciliation was accepted");
   }
 
+  // #313: the committed-range audit cannot see a working-tree edit, so a pass
+  // reported over a dirty governed path is a green that evaluated nothing.
+  if (dirtyGovernedPaths("").length !== 0) throw new Error("self-test failed: a clean worktree was reported dirty");
+  const dirtyLedger = dirtyGovernedPaths(` M ${ISSUES_LEDGER}\0`);
+  if (dirtyLedger.length !== 1 || dirtyLedger[0].path !== ISSUES_LEDGER) {
+    throw new Error("self-test failed: an uncommitted canonical ledger edit was not detected");
+  }
+  if (dirtyGovernedPaths(`?? ${INBOX}/${name}\0`).length !== 1) {
+    throw new Error("self-test failed: an untracked inbox request was not detected");
+  }
+  if (dirtyGovernedPaths(`R  ${APPLIED}/${name}\0${INBOX}/${name}\0`).length !== 2) {
+    throw new Error("self-test failed: a renamed request did not report both of its paths");
+  }
+  if (dirtyGovernedPaths(" M src/lib/rag/rag.ts\0").length !== 0) {
+    throw new Error("self-test failed: an unrelated dirty file was treated as a ledger violation");
+  }
+
   const review = `| 2026-08-13 | codex/a | ${"a".repeat(40)} | review | pass | test |\n`;
   if (!reviewLedgerRowsChanged("", review) || reviewLedgerRowsChanged(review, review)) {
     throw new Error("self-test failed: legacy review row change detection is incorrect");
@@ -298,6 +376,24 @@ function selfTest() {
 function main() {
   if (process.argv.includes("--self-test")) return selfTest();
   const { base, head } = resolveArgs(process.argv.slice(2));
+
+  // Only when the head endpoint is the working checkout's tip. guard-push.mjs
+  // passes an explicit committed --head at a moment when the tree is legitimately
+  // dirty, and CI checks out clean, so neither is affected by this refusal.
+  if (head === "HEAD") {
+    const dirty = dirtyGovernedPaths(statusPorcelain([ISSUES_LEDGER, REVIEW_LEDGER, INBOX]));
+    if (dirty.length > 0) {
+      console.error("Ledger write-discipline check refused to report a verdict:");
+      for (const entry of dirty) console.error(`- ${entry.path}: ${entry.reason}`);
+      console.error(
+        "\nThis gate compares two committed refs, so an uncommitted ledger edit is invisible to it and a pass " +
+          "would mean nothing. Commit the change first — git add the inbox request if it is new — then re-run.",
+      );
+      process.exitCode = 1;
+      return;
+    }
+  }
+
   const failures = [];
   const baseReview = readAt(base, REVIEW_LEDGER);
   const headReview = readAt(head, REVIEW_LEDGER);
diff --git a/scripts/check-outstanding-issues.mjs b/scripts/check-outstanding-issues.mjs
index 19e6d23e8a..56352940d8 100644
--- a/scripts/check-outstanding-issues.mjs
+++ b/scripts/check-outstanding-issues.mjs
@@ -1,8 +1,10 @@
 #!/usr/bin/env node
 // Structural gate for docs/outstanding-issues.md.
 //
-// Ledger #112. The `issues:next-id` marker is a plain HTML comment that every
-// editor read-modify-writes with no lock. A `merge=union` driver was tried (PR
+// Ledger #112/#168. The former `issues:next-id` allocator was a plain HTML
+// comment that every editor read-modify-wrote with no lock. New rows now carry
+// durable ULIDs and collision-extended display locators; a transition marker,
+// if still present, is deliberately ignored. A `merge=union` driver was tried (PR
 // #1416) and removed: unlike docs/branch-review-ledger.md this file allocates
 // IDs by read-modify-write, so union could not allocate unique IDs either, and
 // it silently concatenated conflicting hunks — two marker bumps became two
@@ -15,7 +17,7 @@
 //
 // This makes each of those failures loud:
 //   - an id used twice is a merge that kept both sides' rows under one number
-//   - an id above the marker is a merge that kept a row and lost the bump
+//   - a durable ULID or permanent display locator used twice is an identity collision
 //   - an id in both tables is an archive move that copied instead of moving
 //   - an id absent from both tables relative to the base is a row deletion
 //   - a malformed row is usually a hand-edit that broke the column count
@@ -31,6 +33,8 @@ import { execFileSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 
+import { canonicalLegacyIssueId, issueIdCitations, parseIssueIdCell } from "./issue-id.mjs";
+
 export const ISSUES_PATH = "docs/outstanding-issues.md";
 
 const OPEN_HEADING = "## Open items";
@@ -38,21 +42,6 @@ const ARCHIVE_HEADING = "## Resolved / archive";
 const QUEUE_HEADING = "## Recommended execution queue";
 const MARKER = /<!--\s*issues:next-id=(\d+)\s*-->/;
 const PRETTIER_IGNORE = "<!-- prettier-ignore -->";
-/** Match `#NNN` citations inside a queue ID(s) cell (backticks/commas allowed). */
-const QUEUE_ID_CITATION = /#(\d+)/g;
-/**
- * An id cell's shape, e.g. `#042`. Used to READ the number, never to decide
- * whether a line is a row.
- *
- * That distinction is the whole correctness argument. Matching only well-formed
- * ids and skipping the rest would make this gate claim more than it does: a
- * hand edit turning `#001` into `001` or `#OO1` would drop that row from EVERY
- * check below — duplicate detection, the marker comparison, the width check —
- * and the file would pass while carrying exactly the malformed row the gate
- * advertises. Rows are found positionally instead (see `tableBodies`), and the
- * id shape is validated rather than assumed.
- */
-const ID_CELL = /^#\d+$/;
 const ISSUE_ROW_FINGERPRINT = /^[0-9a-f]{64}$/i;
 /**
  * A table's separator row, e.g. `| ---- | --- |`, which declares its width.
@@ -160,14 +149,14 @@ function orphanRuns(lines, headingIndex, limit, bodies) {
 }
 
 /**
- * The canonical rendering of an id number: zero-padded to at least three
+ * The canonical rendering of a legacy id number: zero-padded to at least three
  * digits. `#1` and `#001` are the SAME allocation, so accepting both lets a
  * conflict keep two rows for one number while a string-keyed uniqueness check
  * calls them distinct. Comparing against this form rejects `#1`, `#0001` and
  * `#00042` while still allowing the scheme to grow past `#999`.
  */
 export function canonicalId(number) {
-  return `#${String(number).padStart(3, "0")}`;
+  return canonicalLegacyIssueId(number);
 }
 
 export function parseIssues(markdown) {
@@ -204,6 +193,7 @@ export function parseIssues(markdown) {
             ...record,
             id: "",
             number: null,
+            ulid: null,
             valid: false,
             cellCount: null,
             expectedCells: body.width,
@@ -212,13 +202,13 @@ export function parseIssues(markdown) {
           continue;
         }
         const parsed = cells(line);
-        const id = parsed[0] ?? "";
-        const number = ID_CELL.test(id) ? Number(id.slice(1)) : null;
+        const identity = parseIssueIdCell(parsed[0] ?? "");
         rows.push({
           ...record,
-          id,
-          number,
-          valid: number !== null && id === canonicalId(number),
+          id: identity.id,
+          number: identity.number,
+          ulid: identity.ulid,
+          valid: identity.valid,
           cellCount: parsed.length,
           // Each block declares its own width, so a row is checked against the
           // table it is actually in rather than a section-wide assumption.
@@ -238,11 +228,10 @@ export function parseIssues(markdown) {
       const parsed = cells(line);
       // Column 0 is Order; column 1 is ID(s). Ignore other cells (evidence prose).
       const idCell = parsed[1] ?? "";
-      for (const match of idCell.matchAll(QUEUE_ID_CITATION)) {
+      for (const id of issueIdCitations(idCell)) {
         queueCitations.push({
           line: index + 1,
-          number: Number(match[1]),
-          raw: match[0],
+          id,
         });
       }
     }
@@ -283,8 +272,7 @@ export function isValidIssueRowFingerprint(value) {
 
 export function checkIssues(markdown, { prettierIgnored = false } = {}) {
   const problems = [];
-  const { openStart, archiveStart, nextId, markerCount, rows, orphans, bodyCount, queueCitations } =
-    parseIssues(markdown);
+  const { openStart, archiveStart, markerCount, rows, orphans, bodyCount, queueCitations } = parseIssues(markdown);
   const lines = markdown.split("\n");
 
   // Prettier pads every Markdown table cell to the widest value in its column.
@@ -315,68 +303,63 @@ export function checkIssues(markdown, { prettierIgnored = false } = {}) {
   if (openStart >= 0 && archiveStart >= 0 && archiveStart < openStart) {
     problems.push(`"${ARCHIVE_HEADING}" appears before "${OPEN_HEADING}"`);
   }
-  if (nextId === null) problems.push("missing the <!-- issues:next-id=N --> marker");
   if (markerCount > 1) {
-    // Only the first is ever read, so a conflict that kept both leaves a stale
-    // value that a later editor can follow straight into a reused id.
     problems.push(
-      `${markerCount} <!-- issues:next-id=N --> markers — exactly one is allowed; ` +
-        "a second is a conflict resolution that kept both sides",
+      `${markerCount} deprecated <!-- issues:next-id=N --> markers — at most one transition marker is allowed`,
     );
   }
-  if (rows.length === 0) problems.push("no `| #NNN |` rows found — the parser or the file shape has drifted");
+  if (rows.length === 0) problems.push("no outstanding-issue rows found — the parser or the file shape has drifted");
 
-  // The failure this gate exists for: a lost-row merge that left two rows
-  // sharing one number, so one item's evidence is silently attributed to
-  // another and the next allocation collides again.
+  // Invalid spellings stay visible to every downstream collision check.
   for (const row of rows.filter((entry) => !entry.valid)) {
     problems.push(
       row.shape === "not-a-table-row"
         ? `line ${row.line} (${row.table} table body) is not a table row: ${JSON.stringify(row.raw.slice(0, 60))} — ` +
             "a row that lost its leading or trailing pipe has left the table while still sitting in it"
         : `line ${row.line} (${row.table} table) has a non-canonical id ${JSON.stringify(row.id)} — ` +
-            `ids are zero-padded to three digits (${row.number === null ? "#NNN" : canonicalId(row.number)}), ` +
-            "so two spellings of one number cannot both exist",
+            "use a zero-padded legacy #NNN id, or a stored collision-free display id with its derived issue-ulid comment",
     );
   }
 
-  // Keyed by NUMBER, not by the raw string: `#1` and `#001` are one allocation,
-  // and a string key would call them distinct and pass.
+  // Display locators are permanent citations, so they must remain unique even
+  // though modern rows also carry a durable ULID.
   const byId = new Map();
-  for (const row of rows.filter((entry) => entry.number !== null)) {
-    if (!byId.has(row.number)) byId.set(row.number, []);
-    byId.get(row.number).push(row);
+  for (const row of rows.filter((entry) => entry.valid || entry.number !== null)) {
+    const key = row.valid ? row.id : canonicalId(row.number);
+    if (!byId.has(key)) byId.set(key, []);
+    byId.get(key).push(row);
   }
-  for (const [number, entries] of byId) {
+  for (const [id, entries] of byId) {
     if (entries.length > 1) {
       problems.push(
-        `${canonicalId(number)} appears ${entries.length} times (lines ${entries.map((entry) => entry.line).join(", ")}) — ` +
+        `${id} appears ${entries.length} times (lines ${entries.map((entry) => entry.line).join(", ")}) — ` +
           "ids are never reused; a collision usually means a merge kept both sides under one number",
       );
     }
   }
 
-  // An item cannot be open and resolved at once. This catches an archive move
-  // that copied the row instead of moving it — the shape a reader trusts least,
-  // because the two copies then disagree about whether the work is done.
-  for (const [number, entries] of byId) {
-    const tables = new Set(entries.map((entry) => entry.table));
-    if (tables.size > 1) problems.push(`${canonicalId(number)} is in BOTH the open and archive tables`);
+  const byUlid = new Map();
+  for (const row of rows.filter((entry) => entry.ulid !== null)) {
+    if (!byUlid.has(row.ulid)) byUlid.set(row.ulid, []);
+    byUlid.get(row.ulid).push(row);
   }
-
-  // The marker must lead the whole file, not just the open table: ids are never
-  // reused, so an archived row still burns its number.
-  const numbered = rows.filter((row) => row.number !== null);
-  if (nextId !== null && numbered.length > 0) {
-    const highest = Math.max(...numbered.map((row) => row.number));
-    if (nextId <= highest) {
+  for (const [ulid, entries] of byUlid) {
+    if (entries.length > 1) {
       problems.push(
-        `issues:next-id=${nextId} is not above the highest id #${String(highest).padStart(3, "0")} — ` +
-          "the next allocation would reuse a number that is already taken",
+        `issue ULID ${ulid} appears ${entries.length} times (lines ${entries.map((entry) => entry.line).join(", ")}) — ` +
+          "durable identities are never reused",
       );
     }
   }
 
+  // An item cannot be open and resolved at once. This catches an archive move
+  // that copied the row instead of moving it — the shape a reader trusts least,
+  // because the two copies then disagree about whether the work is done.
+  for (const [id, entries] of byId) {
+    const tables = new Set(entries.map((entry) => entry.table));
+    if (tables.size > 1) problems.push(`${id} is in BOTH the open and archive tables`);
+  }
+
   // Rows stranded outside every table. A blank line mid-table is the usual
   // cause and the least visible one: the rows keep their pipes, so a diff looks
   // ordinary while GFM stops rendering them as a table at that point.
@@ -419,13 +402,11 @@ export function checkIssues(markdown, { prettierIgnored = false } = {}) {
 
   // Recommended execution queue may only cite currently open IDs (#201). Parse
   // the ID(s) column alone so archive mentions in evidence prose do not fail.
-  const openNumbers = new Set(
-    rows.filter((row) => row.table === "open" && row.number !== null).map((row) => row.number),
-  );
+  const openIds = new Set(rows.filter((row) => row.table === "open" && row.valid).map((row) => row.id));
   for (const citation of queueCitations ?? []) {
-    if (!openNumbers.has(citation.number)) {
+    if (!openIds.has(citation.id)) {
       problems.push(
-        `recommended queue line ${citation.line} cites ${canonicalId(citation.number)} which is not in Open items — ` +
+        `recommended queue line ${citation.line} cites ${citation.id} which is not in Open items — ` +
           "prune the queue row or restore the open item; do not treat evidence prose as queue membership",
       );
     }
@@ -444,15 +425,15 @@ export function prettierIgnoreCoversIssues(prettierIgnore) {
  * therefore passes; deleting it from both tables does not.
  */
 export function missingIssueIds(baseMarkdown, currentMarkdown) {
-  const numbers = (markdown) =>
+  const ids = (markdown) =>
     new Set(
       parseIssues(markdown)
-        .rows.filter((row) => row.number !== null)
-        .map((row) => row.number),
+        .rows.filter((row) => row.valid)
+        .map((row) => row.id),
     );
-  const baseIds = numbers(baseMarkdown);
-  const currentIds = numbers(currentMarkdown);
-  return [...baseIds].filter((number) => !currentIds.has(number)).sort((left, right) => left - right);
+  const baseIds = ids(baseMarkdown);
+  const currentIds = ids(currentMarkdown);
+  return [...baseIds].filter((id) => !currentIds.has(id)).sort();
 }
 
 function argumentValue(name) {
@@ -521,9 +502,9 @@ function selfTest() {
     ],
     ["a padded table row", good.replace("| #001 | P2 | a |", "| #001 | P2      | a |"), 1],
     ["a duplicated id", good.replace("| #002 | b |", "| #001 | b |"), 2], // duplicate + both-tables
-    ["an id at the marker", good.replace("next-id=3", "next-id=2"), 1],
+    ["a stale transition marker", good.replace("next-id=3", "next-id=2"), 0],
     ["a row with a stray pipe", good.replace("| #001 | P2 | a |", "| #001 | P2 | a | b |"), 1],
-    ["a missing marker", good.replace("<!-- issues:next-id=3 -->", ""), 1],
+    ["a removed transition marker", good.replace("<!-- issues:next-id=3 -->", ""), 0],
     // A literal pipe inside a cell is escaped, not a column boundary. The real
     // file has rows like this and an earlier draft of the checker failed them.
     ["an escaped pipe inside a cell", good.replace("| #001 | P2 | a |", "| #001 | P2 | a \\| b |"), 0],
@@ -546,7 +527,7 @@ function selfTest() {
     // non-canonical + duplicate #001 + in-both-tables: the collision a
     // string-keyed uniqueness check would have called two distinct ids.
     ["a short id that collides with a padded one", good.replace("| #002 | b |", "| #1 | b |"), 3],
-    ["an over-padded id", good.replace("| #001 | P2 | a |", "| #0001 | P2 | a |"), 1],
+    ["an over-padded id", good.replace("| #001 | P2 | a |", "| #0001 | P2 | a |"), 2],
     // Deleting a separator used to disable the width check for its whole table
     // silently — the check had nothing to compare against and skipped.
     ["a deleted separator row", good.replace("| --- | --- | --- |\n", ""), 3], // no table + orphan pipes + queue cites missing open
@@ -564,6 +545,26 @@ function selfTest() {
     ["a blank line stranding the rows below it", good.replace("| #002 | b |", "| #002 | b |\n\n| #003 | c |"), 1],
     // #201: queue ID(s) column must cite open items only.
     ["a queue row citing an archived id", good.replace("| 1 | `#001` |", "| 1 | `#002` |"), 1],
+    [
+      "a modern durable id",
+      good
+        .replace("`#001`", "`#ABCDEF`")
+        .replace("| #001 | P2 | a |", "| #ABCDEF <!-- issue-ulid:0000000000ABCDEF0000000000 --> | P2 | a |"),
+      0,
+    ],
+    [
+      "a modern display id without its durable identity",
+      good.replace("`#001`", "`#ABCDEF`").replace("| #001 | P2 | a |", "| #ABCDEF | P2 | a |"),
+      2,
+    ],
+    [
+      "a reused modern durable identity",
+      good
+        .replace("`#001`", "`#ABCDEF`")
+        .replace("| #001 | P2 | a |", "| #ABCDEF <!-- issue-ulid:0000000000ABCDEF0000000000 --> | P2 | a |")
+        .replace("| #002 | b |", "| #ABCDEF0 <!-- issue-ulid:0000000000ABCDEF0000000000 --> | b |"),
+      1,
+    ],
   ];
   let failures = 0;
   for (const [name, markdown, expected] of cases) {
@@ -591,7 +592,7 @@ function selfTest() {
 
   const deletionCases = [
     ["an unchanged id set", good, []],
-    ["an open row deleted from both tables", good.replace("| #001 | P2 | a |\n", ""), [1]],
+    ["an open row deleted from both tables", good.replace("| #001 | P2 | a |\n", ""), ["#001"]],
     [
       "an open row moved to the archive",
       good.replace("| #001 | P2 | a |\n", "").replace("| #002 | b |", "| #002 | b |\n| #001 | a |"),
@@ -667,9 +668,9 @@ function main() {
     try {
       const missing = missingIssueIds(readIssuesAtRevision(base.ref), markdown);
       checkedBase = base.ref;
-      for (const number of missing) {
+      for (const id of missing) {
         problems.push(
-          `${canonicalId(number)} existed at base ${base.ref.slice(0, 12)} but is absent from both open and archive tables — ` +
+          `${id} existed at base ${base.ref.slice(0, 12)} but is absent from both open and archive tables — ` +
             "move resolved or superseded rows to the archive; never delete their allocation",
         );
       }
@@ -685,23 +686,25 @@ function main() {
   // A merge driver on this file is a regression, not an improvement: union
   // concatenated conflicting hunks and duplicated the whole table rather than
   // failing (#133, and four times on PR #1430). Honest conflicts are the
-  // contract; ids still need manual renumbering either way.
+  // contract. Immutable inbox requests plus serialized reconciliation remain
+  // the only supported way to mutate the canonical ledger.
   const mergeProblem = mergeAttributeProblem(effectiveMergeAttribute());
   if (mergeProblem) problems.push(mergeProblem);
   if (problems.length > 0) {
     console.error(`${ISSUES_PATH} check FAILED:`);
     for (const problem of problems) console.error(`  - ${problem}`);
     console.error(
-      "\nIds are never reused. If a merge collided, renumber the incoming rows above the marker " +
-        "and bump it — do not resolve by taking one side wholesale, which drops the other's rows.",
+      "\nIds are never reused. Do not hand-edit or renumber rows after a conflict: preserve immutable " +
+        "inbox requests and run one serialized reconciliation from a fresh origin/main base.",
     );
     process.exit(1);
   }
-  const { rows, nextId } = parseIssues(markdown);
+  const { rows, markerCount } = parseIssues(markdown);
   const open = rows.filter((row) => row.table === "open").length;
   console.log(
     `Outstanding-issues guard passed: ${rows.length} rows (${open} open, ${rows.length - open} archived), ` +
-      `unique ids, next-id=${nextId} above the highest, no merge driver` +
+      `unique display and durable ids, collision-free allocation enabled` +
+      `${markerCount ? ", deprecated next-id marker ignored" : ""}, no merge driver` +
       `${checkedBase ? `, no ids deleted from base ${checkedBase.slice(0, 12)}` : ", deletion baseline unavailable"}.`,
   );
 }
diff --git a/scripts/check-playwright-browser-revision.mjs b/scripts/check-playwright-browser-revision.mjs
index 5dda976d24..d9c719371e 100644
--- a/scripts/check-playwright-browser-revision.mjs
+++ b/scripts/check-playwright-browser-revision.mjs
@@ -1,19 +1,56 @@
 #!/usr/bin/env node
 /**
- * Fail closed when a designated container browser root cannot satisfy the
- * Playwright revision pinned by the installed playwright-core package (#255).
+ * Fail closed unless the pinned Chromium revision (from the installed
+ * playwright-core package) has a launchable binary actually present on disk —
+ * not merely a same-named directory, and not merely "no path is forced" (#312).
+ *
+ * Earlier versions of this check only inspected directory *names* under a
+ * forced `/opt/pw-browsers` container root, and skipped the disk entirely
+ * whenever no such root was forced — silently reporting `ok: true` even when
+ * the managed cache (or an explicit `PLAYWRIGHT_BROWSERS_PATH`) had no
+ * matching Chromium binary at all. That produced a false "OK" that was read
+ * as a green light for `verify:ui` before two Playwright runs died at
+ * preflight (docs/outstanding-issues.md #312, session 2026-08-12).
+ *
+ * This check now always resolves the effective browsers root — an explicit
+ * `PLAYWRIGHT_BROWSERS_PATH` override if set, otherwise Playwright's own
+ * default managed-cache directory — and verifies a real executable exists
+ * for the pinned revision inside it, using the same executable layout table
+ * Playwright itself ships (mirrored below; keep in sync with
+ * `playwright-core`'s `EXECUTABLE_PATHS`).
  *
  * Local managed caches (`~/.cache/ms-playwright`) are fine. The trap is
  * PLAYWRIGHT_BROWSERS_PATH=/opt/pw-browsers with PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD
  * where a newer lock expects chromium-1234 but the image only ships 1194 —
  * pointing PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH at the stale shell is forbidden.
  */
-import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { accessSync, constants, existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 const DEFAULT_CONTAINER_ROOT = "/opt/pw-browsers";
 
+// Mirrors playwright-core's `EXECUTABLE_PATHS["chromium-headless-shell"]`
+// (installed under a `chromium_headless_shell-<revision>` directory — the
+// binary the default headless chromium/chromium-mockups projects launch).
+const CHROMIUM_HEADLESS_SHELL_EXECUTABLE_LAYOUTS = Object.freeze({
+  linux: {
+    x64: [["chrome-headless-shell-linux64", "chrome-headless-shell"]],
+    arm64: [["chrome-linux", "headless_shell"]],
+  },
+  darwin: {
+    x64: [["chrome-headless-shell-mac-x64", "chrome-headless-shell"]],
+    arm64: [["chrome-headless-shell-mac-arm64", "chrome-headless-shell"]],
+  },
+  win32: [["chrome-headless-shell-win64", "chrome-headless-shell.exe"]],
+});
+
+function layoutsForPlatform(table, platform, architecture) {
+  if (platform === "linux" || platform === "darwin") return table[platform]?.[architecture] ?? [];
+  return table[platform] ?? [];
+}
+
 export function readExpectedChromiumRevision(projectRoot = process.cwd()) {
   const browsersJsonPath = path.join(projectRoot, "node_modules", "playwright-core", "browsers.json");
   if (!existsSync(browsersJsonPath)) {
@@ -43,17 +80,104 @@ export function listInstalledChromiumRevisions(browsersRoot) {
   return [...revisions].sort();
 }
 
+/**
+ * Playwright's own default managed-cache directory when no
+ * `PLAYWRIGHT_BROWSERS_PATH` override is set — mirrors
+ * `playwright-core`'s `defaultRegistryDirectory` computation exactly
+ * (Linux: `$XDG_CACHE_HOME || ~/.cache`; macOS: `~/Library/Caches`;
+ * Windows: `%LOCALAPPDATA% || ~/AppData/Local`), each joined with
+ * `ms-playwright`. Accepts `env`/`homeDirectory`/`platform` so tests never
+ * depend on the real host's actual cache directory or files within it.
+ */
+export function resolveDefaultManagedBrowsersRoot(
+  env = process.env,
+  homeDirectory = os.homedir(),
+  platform = process.platform,
+) {
+  if (platform === "linux") {
+    return path.join(env.XDG_CACHE_HOME?.trim() || path.join(homeDirectory, ".cache"), "ms-playwright");
+  }
+  if (platform === "darwin") {
+    return path.join(homeDirectory, "Library", "Caches", "ms-playwright");
+  }
+  if (platform === "win32") {
+    return path.join(env.LOCALAPPDATA?.trim() || path.join(homeDirectory, "AppData", "Local"), "ms-playwright");
+  }
+  return path.join(homeDirectory, ".cache", "ms-playwright");
+}
+
+/**
+ * Resolve the cache root with the same special/relative-path semantics that
+ * playwright-core uses. `PLAYWRIGHT_BROWSERS_PATH=0` opts into the installed
+ * package's `.local-browsers`; relative overrides resolve from INIT_CWD (or
+ * the invoking working directory), not from a literal directory named "0".
+ */
+export function resolvePlaywrightBrowsersRoot({
+  env = process.env,
+  defaultManagedBrowsersRoot = resolveDefaultManagedBrowsersRoot(env),
+  playwrightCoreRoot,
+  workingDirectory = process.cwd(),
+} = {}) {
+  const configured = env.PLAYWRIGHT_BROWSERS_PATH?.trim() ?? "";
+  if (configured === "0") return path.join(playwrightCoreRoot, ".local-browsers");
+  if (!configured) return defaultManagedBrowsersRoot;
+  return path.isAbsolute(configured) ? configured : path.resolve(env.INIT_CWD?.trim() || workingDirectory, configured);
+}
+
+export function isLaunchableFile(filePath, platform = process.platform) {
+  try {
+    if (!statSync(filePath).isFile()) return false;
+    if (platform !== "win32") accessSync(filePath, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The real, load-bearing check this file exists for: does a launchable
+ * headless-shell binary for `revision` actually exist under `browsersRoot`? A
+ * same-named directory with no executable inside it (partial/corrupt
+ * install) must not count — that was the residual gap even in the old
+ * "container-aligned" path, which only checked directory names (#312).
+ */
+export function findInstalledChromiumBinary(
+  browsersRoot,
+  revision,
+  { platform = process.platform, architecture = process.arch, fileIsLaunchable = isLaunchableFile } = {},
+) {
+  if (!browsersRoot || !revision) return null;
+  const candidates = layoutsForPlatform(CHROMIUM_HEADLESS_SHELL_EXECUTABLE_LAYOUTS, platform, architecture).map(
+    (layout) => ({
+      dir: `chromium_headless_shell-${revision}`,
+      layout,
+    }),
+  );
+  for (const candidate of candidates) {
+    const executable = path.join(browsersRoot, candidate.dir, ...candidate.layout);
+    if (fileIsLaunchable(executable, platform)) return executable;
+  }
+  return null;
+}
+
 /**
  * @param {{
  *   projectRoot?: string,
  *   env?: NodeJS.ProcessEnv,
  *   containerBrowsersRoot?: string,
+ *   defaultManagedBrowsersRoot?: string,
+ *   platform?: string,
+ *   architecture?: string,
+ *   workingDirectory?: string,
  * }} [options]
  */
 export function playwrightBrowserRevisionCheck(options = {}) {
   const projectRoot = options.projectRoot ?? process.cwd();
   const env = options.env ?? process.env;
   const containerBrowsersRoot = options.containerBrowsersRoot ?? DEFAULT_CONTAINER_ROOT;
+  const platform = options.platform ?? process.platform;
+  const architecture = options.architecture ?? process.arch;
+
   const expected = readExpectedChromiumRevision(projectRoot);
   if (!expected.ok) {
     return {
@@ -70,37 +194,75 @@ export function playwrightBrowserRevisionCheck(options = {}) {
   const designatedContainer =
     exposedRoot.replaceAll("\\", "/") === containerBrowsersRoot.replaceAll("\\", "/") && downloadsDisabled;
 
-  if (!designatedContainer) {
+  // Any PLAYWRIGHT_BROWSERS_PATH override — the designated download-disabled
+  // container or any other forced path — points at the exact root Playwright
+  // will actually launch from. With no override, fall back to Playwright's
+  // own default managed-cache location so a plain, "unconstrained" run still
+  // gets checked against real disk state instead of being trusted on version
+  // metadata alone. This is the #312 fix: the previous version skipped this
+  // check entirely whenever no container root was forced.
+  const defaultManagedBrowsersRoot = options.defaultManagedBrowsersRoot ?? resolveDefaultManagedBrowsersRoot(env);
+  const browsersRoot = resolvePlaywrightBrowsersRoot({
+    env,
+    defaultManagedBrowsersRoot,
+    playwrightCoreRoot: path.dirname(expected.browsersJsonPath),
+    workingDirectory: options.workingDirectory,
+  });
+
+  const installed = listInstalledChromiumRevisions(browsersRoot);
+  const revisionDirectoryPresent = installed.includes(expected.revision);
+  const binaryPath = findInstalledChromiumBinary(browsersRoot, expected.revision, {
+    platform,
+    architecture,
+  });
+
+  if (revisionDirectoryPresent && binaryPath) {
     return {
       ok: true,
-      status: "managed-or-unconstrained",
-      message:
-        "No designated container browser root is forced; use the Playwright-managed cache or install matching browsers.",
+      status: designatedContainer ? "container-aligned" : "installed",
+      message: designatedContainer
+        ? `Container browsers at ${exposedRoot} include a launchable chromium revision ${expected.revision} binary (${binaryPath}).`
+        : `Chromium revision ${expected.revision} is installed and launchable at ${binaryPath}.`,
       expectedRevision: expected.revision,
-      installedRevisions: [],
+      installedRevisions: installed,
+      binaryPath,
     };
   }
 
-  const installed = listInstalledChromiumRevisions(exposedRoot);
-  if (installed.includes(expected.revision)) {
+  if (designatedContainer) {
     return {
-      ok: true,
-      status: "container-aligned",
-      message: `Container browsers at ${exposedRoot} include chromium revision ${expected.revision}.`,
+      ok: false,
+      status: "container-revision-drift",
+      message: [
+        `Playwright browser revision drift (#255): lock/playwright-core expects chromium-${expected.revision},`,
+        `but ${exposedRoot} only has: ${installed.length ? installed.map((r) => `chromium-${r}`).join(", ") : "(none)"}.`,
+        "Do not set PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH to a mismatched shell.",
+        "Delegate browser proof to CI Production UI, or refresh the image / run `npx playwright install` into a matching cache,",
+        "or unset PLAYWRIGHT_BROWSERS_PATH and PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD so the managed cache can be used.",
+      ].join(" "),
       expectedRevision: expected.revision,
       installedRevisions: installed,
     };
   }
 
+  // Unconstrained / plain-managed-cache path: downloads are not disabled
+  // here, so the actionable fix is normally `npx playwright install
+  // chromium`, not a container image refresh (#312).
+  const rootDescription = exposedRoot
+    ? `${browsersRoot} (from PLAYWRIGHT_BROWSERS_PATH)`
+    : `${browsersRoot} (Playwright's default managed cache)`;
   return {
     ok: false,
-    status: "container-revision-drift",
+    status: revisionDirectoryPresent ? "binary-missing" : "not-installed",
     message: [
-      `Playwright browser revision drift (#255): lock/playwright-core expects chromium-${expected.revision},`,
-      `but ${exposedRoot} only has: ${installed.length ? installed.map((r) => `chromium-${r}`).join(", ") : "(none)"}.`,
-      "Do not set PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH to a mismatched shell.",
-      "Delegate browser proof to CI Production UI, or refresh the image / run `npx playwright install` into a matching cache,",
-      "or unset PLAYWRIGHT_BROWSERS_PATH and PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD so the managed cache can be used.",
+      revisionDirectoryPresent
+        ? `Playwright expects chromium revision ${expected.revision}: a matching directory exists at ${rootDescription} but no launchable Chromium binary was found inside it (partial or corrupt install).`
+        : `Playwright expects chromium revision ${expected.revision}, but no matching install was found at ${rootDescription}` +
+          (installed.length
+            ? ` (found instead: ${installed.map((r) => `chromium-${r}`).join(", ")}).`
+            : " (no chromium revisions installed at all).") +
+          "",
+      "Run `npx playwright install chromium` to install the pinned revision, or point PLAYWRIGHT_BROWSERS_PATH at a cache that already has it.",
     ].join(" "),
     expectedRevision: expected.revision,
     installedRevisions: installed,
@@ -143,7 +305,7 @@ if (isDirectRun()) {
   } else if (result.ok) {
     console.log(`Playwright browser revision check OK (${result.status}): ${result.message}`);
   } else {
-    console.error(result.message);
+    console.error(`Playwright browser revision check FAILED (${result.status}): ${result.message}`);
   }
   process.exit(result.ok ? 0 : 1);
 }
diff --git a/scripts/ci-change-scope.mjs b/scripts/ci-change-scope.mjs
index 431749391f..03307a9e6d 100644
--- a/scripts/ci-change-scope.mjs
+++ b/scripts/ci-change-scope.mjs
@@ -121,6 +121,11 @@ const docPatterns = [
   /^LICENSE(?:\..*)?$/i,
 ];
 
+// This Markdown file is generated from the medication interaction lexicon. A
+// direct edit must run its freshness check; otherwise the ordinary docs-only
+// classification would let a stale clinical-facing report through CI.
+const generatedMedicationLexiconReport = "docs/medication-interaction-lexicon-review.md";
+
 const workflowPatterns = [
   ".github/workflows",
   ".github/actions",
@@ -371,6 +376,7 @@ function isExecutableWorkflowSurfacePath(filePath) {
  * YAML/policy under workflow surfaces stay light; executable files there do not.
  */
 function isRecognisedLightPath(filePath) {
+  if (filePath === generatedMedicationLexiconReport) return false;
   if (pathMatches(filePath, docPatterns)) return true;
   if (!pathMatches(filePath, workflowPatterns)) return false;
   return !isExecutableWorkflowSurfacePath(filePath);
@@ -413,6 +419,7 @@ function classify(files, { readLedger = readFlakeLedger } = {}) {
   const docsOnly =
     normalized.length > 0 &&
     normalized.every((file) => pathMatches(file, docPatterns)) &&
+    !normalized.includes(generatedMedicationLexiconReport) &&
     !sourceChanged &&
     !workflowChanged;
   const workflowOnly = workflowChanged && !staticHeavyChanged;
@@ -767,6 +774,12 @@ function selfTest() {
     build_changed: false,
     lockfile_changed: false,
   });
+  assertScope("generated-medication-lexicon-report-stays-heavy", [generatedMedicationLexiconReport], {
+    docs_only: false,
+    docs_changed: true,
+    static_heavy_changed: true,
+    coverage_changed: true,
+  });
   assertScope("tests-only", ["tests/rag-routing.test.ts"], {
     source_changed: true,
     coverage_changed: true,
diff --git a/scripts/design-system-contract-baseline.json b/scripts/design-system-contract-baseline.json
index aa5fed15e8..91d131c7ac 100644
--- a/scripts/design-system-contract-baseline.json
+++ b/scripts/design-system-contract-baseline.json
@@ -3,19 +3,20 @@
     "rawColorLiterals": 2,
     "literalShadowClasses": 0,
     "legacyTapClasses": 0,
+    "interactiveTapFloorDeclarations": 40,
     "colourOnlyStatusIndicators": 4,
-    "statusColouredNumerals": 2,
-    "edgeOwnershipConflicts": 25,
+    "statusColouredNumerals": 1,
+    "edgeOwnershipConflicts": 19,
     "onePixelShadowSpreads": 2,
-    "hardcodedCssMotionDurations": 42,
+    "hardcodedCssMotionDurations": 41,
     "rawCssZIndices": 9,
     "legacyPaletteUtilities": 0,
     "darkColorOverrides": 0,
-    "legacyShadowAliases": 119,
+    "legacyShadowAliases": 114,
     "arbitraryTracking": 0,
     "rawPaddingLiterals": 63,
-    "rawRadiusLiterals": 24,
-    "rawGapLiterals": 32,
+    "rawRadiusLiterals": 23,
+    "rawGapLiterals": 31,
     "rawLineHeightLiterals": 3,
     "layoutTransitionExceptions": 11,
     "textSoftConsumers": 0,
@@ -29,24 +30,39 @@
     },
     "literalShadowClasses": {},
     "legacyTapClasses": {},
+    "interactiveTapFloorDeclarations": {
+      "src/components/DocumentTagCloud.tsx": 2,
+      "src/components/calculators/bedside-sheet.tsx": 3,
+      "src/components/calculators/calculator-ui.tsx": 3,
+      "src/components/calculators/clinical-console.tsx": 2,
+      "src/components/calculators/directory-grid.tsx": 1,
+      "src/components/clinical-dashboard/DocumentManagerPanel.tsx": 6,
+      "src/components/clinical-dashboard/answer-content.tsx": 1,
+      "src/components/clinical-dashboard/document-admin.tsx": 5,
+      "src/components/clinical-dashboard/favourites-command-library-page.tsx": 1,
+      "src/components/clinical-dashboard/favourites-hub.tsx": 2,
+      "src/components/clinical-dashboard/search-results-header-band.tsx": 1,
+      "src/components/clinical-dashboard/settings-dialog.tsx": 3,
+      "src/components/forms/form-detail-page.tsx": 3,
+      "src/components/forms/forms-search-results-page.tsx": 2,
+      "src/components/patient-safety-plan.tsx": 4,
+      "src/components/ui/chip.tsx": 1
+    },
     "colourOnlyStatusIndicators": {
       "src/components/calculators/calculator-ui.tsx": 1,
       "src/components/therapy-compass/ui.tsx": 1,
       "src/components/ui-primitives.tsx": 2
     },
     "statusColouredNumerals": {
-      "src/components/clinical-dashboard/differentials-home.tsx": 1,
       "src/components/clinical-dashboard/visual-evidence.tsx": 1
     },
     "edgeOwnershipConflicts": {
       "src/components/DocumentTagCloud.tsx": 3,
       "src/components/clinical-dashboard/dashboard-nav.tsx": 1,
       "src/components/clinical-dashboard/favourites-command-library-page.tsx": 1,
-      "src/components/clinical-dashboard/favourites-library-nav.tsx": 1,
       "src/components/clinical-dashboard/master-search-header.tsx": 5,
       "src/components/formulation/formulation-builder-page.tsx": 3,
       "src/components/formulation/formulation-compare-page.tsx": 1,
-      "src/components/pwa-lifecycle.tsx": 5,
       "src/components/services/services-navigator-page.tsx": 1,
       "src/components/specifiers/specifier-builder-page.tsx": 1,
       "src/components/specifiers/specifier-compare-page.tsx": 1,
@@ -56,7 +72,7 @@
       "src/app/globals.css": 2
     },
     "hardcodedCssMotionDurations": {
-      "src/app/globals.css": 42
+      "src/app/globals.css": 41
     },
     "rawCssZIndices": {
       "src/app/globals.css": 9
@@ -77,14 +93,12 @@
       "src/components/calculators/search-detail.tsx": 8,
       "src/components/calculators/search-page.tsx": 2,
       "src/components/clinical-dashboard/ClinicalSidebar.tsx": 2,
-      "src/components/clinical-dashboard/account-setup-dialog.tsx": 1,
       "src/components/clinical-dashboard/auth-panel.tsx": 1,
       "src/components/clinical-dashboard/dashboard-nav.tsx": 2,
       "src/components/clinical-dashboard/differentials-home.tsx": 2,
       "src/components/clinical-dashboard/document-search-results.tsx": 4,
       "src/components/clinical-dashboard/favourites-command-library-page.tsx": 2,
       "src/components/clinical-dashboard/favourites-hub.tsx": 1,
-      "src/components/clinical-dashboard/favourites-library-nav.tsx": 3,
       "src/components/clinical-dashboard/library-health-strip.tsx": 1,
       "src/components/clinical-dashboard/master-search-header.tsx": 5,
       "src/components/clinical-dashboard/medication-prescribing-workspace.tsx": 1,
@@ -109,7 +123,6 @@
       "src/components/mode-home-template.tsx": 2,
       "src/components/mode-nav/mode-nav.tsx": 1,
       "src/components/patient-safety-plan.tsx": 1,
-      "src/components/pwa-lifecycle.tsx": 1,
       "src/components/registry-record-loader.tsx": 1,
       "src/components/route-error-boundary.tsx": 1,
       "src/components/specifiers/specifier-map-page.tsx": 1,
@@ -146,12 +159,12 @@
       "src/components/therapy-compass/therapy-card.tsx": 1
     },
     "rawRadiusLiterals": {
-      "src/app/globals.css": 22,
+      "src/app/globals.css": 21,
       "src/components/clinical-dashboard/search-results-header-band.tsx": 1,
       "src/components/mode-nav/mode-nav.tsx": 1
     },
     "rawGapLiterals": {
-      "src/app/globals.css": 13,
+      "src/app/globals.css": 12,
       "src/components/therapy-compass/controls.ts": 1,
       "src/components/therapy-compass/screens/brief-screen.tsx": 4,
       "src/components/therapy-compass/screens/compare-screen.tsx": 2,
diff --git a/scripts/design-system-contract-utils.mjs b/scripts/design-system-contract-utils.mjs
index 42a701c062..316f164274 100644
--- a/scripts/design-system-contract-utils.mjs
+++ b/scripts/design-system-contract-utils.mjs
@@ -195,6 +195,153 @@ export function findInteractiveTapLiteralsInSource(relativePath, sourceText) {
   return findings;
 }
 
+/**
+ * Gate 2's remaining named case: an interactive control that declares its OWN
+ * minimum height below the 48px tap floor.
+ *
+ * Scoped to `min-h-*` deliberately, and NOT to `h-*`/`size-*`. A short `h-4` on
+ * an interactive element is frequently the *visible* box of a control whose hit
+ * area is owned by a tap-sized wrapper — `SelectionCheckbox` in
+ * `differentials-home.tsx` is exactly that, and `ui-smoke` asserts the label
+ * around it still meets the floor. Flagging those would pad the baseline with
+ * findings that are not defects, which GATES.md §5 calls out as the way a gate
+ * gets switched off. `min-h-*` carries no such ambiguity: it is the element's
+ * own declared floor, so a value under the token is a lowered tap target by
+ * construction.
+ *
+ * Unprefixed only. `min-h-12 sm:min-h-10` is the repo's correct pattern — 48px
+ * on phones, 40px from `sm` up — so a variant-prefixed short value is a
+ * deliberate desktop release, not a violation. An unprefixed `min-h-tap` or
+ * `min-h-12`+ on the same element rescues it.
+ */
+const TAP_FLOOR_INTERACTIVE_TAGS = new Set(["a", "button", "input", "select", "summary", "textarea"]);
+const MAX_CLASS_ALTERNATIVES = 128;
+
+function combineClassAlternatives(left, right) {
+  const combined = [];
+  for (const first of left) {
+    for (const second of right) {
+      combined.push(`${first} ${second}`.trim());
+      if (combined.length >= MAX_CLASS_ALTERNATIVES) return [...new Set(combined)];
+    }
+  }
+  return [...new Set(combined)];
+}
+
+function classExpressionAlternatives(node) {
+  if (ts.isStringLiteralLike(node) || ts.isNoSubstitutionTemplateLiteral(node)) return [node.text];
+  if (ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isNonNullExpression(node)) {
+    return classExpressionAlternatives(node.expression);
+  }
+  if (ts.isSatisfiesExpression?.(node)) return classExpressionAlternatives(node.expression);
+  if (ts.isConditionalExpression(node)) {
+    return [
+      ...new Set([...classExpressionAlternatives(node.whenTrue), ...classExpressionAlternatives(node.whenFalse)]),
+    ];
+  }
+  if (ts.isBinaryExpression(node)) {
+    if (node.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken) {
+      return [...new Set(["", ...classExpressionAlternatives(node.right)])];
+    }
+    if (
+      node.operatorToken.kind === ts.SyntaxKind.BarBarToken ||
+      node.operatorToken.kind === ts.SyntaxKind.QuestionQuestionToken
+    ) {
+      return [...new Set([...classExpressionAlternatives(node.left), ...classExpressionAlternatives(node.right)])];
+    }
+    if (node.operatorToken.kind === ts.SyntaxKind.PlusToken) {
+      return combineClassAlternatives(classExpressionAlternatives(node.left), classExpressionAlternatives(node.right));
+    }
+    return [""];
+  }
+  if (ts.isTemplateExpression(node)) {
+    let alternatives = [node.head.text];
+    for (const span of node.templateSpans) {
+      alternatives = combineClassAlternatives(alternatives, classExpressionAlternatives(span.expression));
+      alternatives = alternatives.map((value) => `${value}${span.literal.text}`);
+    }
+    return alternatives;
+  }
+  if (ts.isCallExpression(node) || ts.isArrayLiteralExpression(node)) {
+    const values = ts.isCallExpression(node) ? node.arguments : node.elements;
+    return values.reduce(
+      (alternatives, value) => combineClassAlternatives(alternatives, classExpressionAlternatives(value)),
+      [""],
+    );
+  }
+  if (ts.isObjectLiteralExpression(node)) {
+    return node.properties.reduce(
+      (alternatives, property) => {
+        if (!ts.isPropertyAssignment(property) && !ts.isShorthandPropertyAssignment(property)) return alternatives;
+        const name = property.name;
+        const className =
+          name && (ts.isStringLiteralLike(name) || ts.isIdentifier(name) || ts.isNumericLiteral(name)) ? name.text : "";
+        return className ? combineClassAlternatives(alternatives, ["", className]) : alternatives;
+      },
+      [""],
+    );
+  }
+  return [""];
+}
+
+function jsxClassAlternatives(attribute) {
+  const initializer = attribute.initializer;
+  if (!initializer) return [];
+  if (ts.isStringLiteral(initializer)) return [initializer.text];
+  if (!ts.isJsxExpression(initializer) || !initializer.expression) return [];
+  return classExpressionAlternatives(initializer.expression);
+}
+
+function minHeightPixels(token) {
+  const normalized = token.replace(/^!/, "");
+  if (normalized === "min-h-tap") return 48;
+  if (normalized === "min-h-px") return 1;
+  const spacing = normalized.match(/^min-h-(\d+(?:\.\d+)?)$/);
+  if (spacing) return Number(spacing[1]) * 4;
+  const arbitrary = normalized.match(/^min-h-\[(-?\d+(?:\.\d+)?)(px|rem)\]$/);
+  if (!arbitrary) return null;
+  const value = Number(arbitrary[1]);
+  return arbitrary[2] === "rem" ? value * 16 : value;
+}
+
+function hasSubFloorEffectiveMinHeight(classText) {
+  const minHeightTokens = classText
+    .split(/\s+/)
+    .filter((token) => token && !token.includes(":"))
+    .map((token) => token.replace(/^!/, ""))
+    .filter((token) => token.startsWith("min-h-"));
+  if (minHeightTokens.length === 0) return false;
+  const pixels = minHeightPixels(minHeightTokens.at(-1));
+  return pixels !== null && pixels < 48;
+}
+
+export function findInteractiveTapFloorDeclarationsInSource(relativePath, sourceText) {
+  if (!relativePath.endsWith(".tsx")) return [];
+  if (!/\bmin-h-(?:[0-9]|1[01]|\[)/.test(sourceText)) return [];
+  const source = ts.createSourceFile(relativePath, sourceText, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+  const findings = [];
+
+  function inspectOpeningElement(node) {
+    if (!TAP_FLOOR_INTERACTIVE_TAGS.has(node.tagName.getText(source))) return;
+    const classAttribute = node.attributes.properties.find(
+      (attribute) => ts.isJsxAttribute(attribute) && attribute.name.getText(source) === "className",
+    );
+    if (!classAttribute || !ts.isJsxAttribute(classAttribute)) return;
+    const alternatives = jsxClassAlternatives(classAttribute);
+    if (!alternatives.some(hasSubFloorEffectiveMinHeight)) return;
+    const line = source.getLineAndCharacterOfPosition(classAttribute.getStart(source)).line + 1;
+    findings.push(`${relativePath}:${line}`);
+  }
+
+  function visit(node) {
+    if (ts.isJsxOpeningElement(node) || ts.isJsxSelfClosingElement(node)) inspectOpeningElement(node);
+    ts.forEachChild(node, visit);
+  }
+
+  visit(source);
+  return findings;
+}
+
 const BORDER_WIDTH_UTILITY = /^border(?:-[xytrblse])?(?:-(?:0|2|4|8|\[(?!color:)[^\]]+\]))?$/;
 const RING_WIDTH_UTILITY = /^ring(?:-(?:0|1|2|4|8|\[(?!color:)[^\]]+\]))?$/;
 // The status-colour family declared in `globals.css` (`--success`/`--warning`/
diff --git a/scripts/generate-site-map.ts b/scripts/generate-site-map.ts
index 3ed43b080e..dd263175c9 100644
--- a/scripts/generate-site-map.ts
+++ b/scripts/generate-site-map.ts
@@ -277,6 +277,7 @@ function renderModeRoutes() {
     formulation: appModeHomeHref("formulation", { query: "I keep going over it", focus: true, run: true }),
     prescribing: appModeHomeHref("prescribing", { query: "acamprosate renal dose", focus: true, run: true }),
     tools: appModeHomeHref("tools", { query: "medications", focus: true, run: true }),
+    calculators: appModeHomeHref("calculators", { query: "PHQ-9", focus: true, run: true }),
     "therapy-compass": appModeHomeHref("therapy-compass", { query: "behavioural activation", focus: true, run: true }),
     factsheets: appModeHomeHref("factsheets", { query: "sertraline", focus: true, run: true }),
   };
@@ -374,7 +375,8 @@ function renderModePageIndex() {
       mode: "Tools",
       home: appModeHomeHref("tools"),
       search: appModeHomeHref("tools", { query: "medications", focus: true, run: true }),
-      detail: "Canonical Tools launcher at `/tools` (PT-11). `/?mode=tools` remains a dashboard-mode alias.",
+      detail:
+        "Canonical all-tools results directory at `/tools`; the universal mode picker opens it directly. `/?mode=tools` remains a dashboard-mode alias.",
     },
   ]);
 }
diff --git a/scripts/guard-push.mjs b/scripts/guard-push.mjs
index 4d754e4d62..6857372e93 100755
--- a/scripts/guard-push.mjs
+++ b/scripts/guard-push.mjs
@@ -116,17 +116,46 @@ export function pushedBranchNames(ranges, fallbackBranch = "") {
   return [...branches];
 }
 
-/** Exported for tests: existing branches compare from their remote tip; new
- * branches compare from the PR merge base so newer main-only commits are out of
- * scope for transaction guards that accept explicit base/head commits. */
-export function guardBaseForRange(range, cwd = PROJECT_ROOT) {
-  if (range.remoteSha && range.remoteSha !== ZERO_SHA) return range.remoteSha;
+/** True when `ancestor` is reachable from `descendant`, i.e. the push fast-forwards. */
+function isAncestor(ancestor, descendant, cwd = PROJECT_ROOT) {
+  try {
+    execFileSync("git", ["merge-base", "--is-ancestor", ancestor, descendant], { cwd, stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Merge base with origin/main — the base a PR is actually evaluated against, and
+ * the same one CI passes as LEDGER_WRITE_BASE_SHA (.github/workflows/ci.yml). */
+function mainMergeBase(range, cwd = PROJECT_ROOT) {
   if (!tryGit(["rev-parse", "--verify", "--quiet", MAIN_REMOTE_REF], cwd)) return undefined;
   return tryGit(["merge-base", MAIN_REMOTE_REF, range.localSha], cwd);
 }
 
+/** Exported for tests: a fast-forward push compares from its remote tip; a new
+ * branch, or one whose history was rewritten, compares from the PR merge base so
+ * newer main-only commits are out of scope for transaction guards that accept
+ * explicit base/head commits.
+ *
+ * The rewritten-history case matters: after a force-push the old remote tip is an
+ * abandoned line, so every request it carried reads as deleted and the ledger
+ * transaction guard can never pass — no matter how clean the rebuild is. Falling
+ * back to the merge base asks the question CI asks instead of an unanswerable one. */
+export function guardBaseForRange(range, cwd = PROJECT_ROOT) {
+  if (range.remoteSha && range.remoteSha !== ZERO_SHA) {
+    if (isAncestor(range.remoteSha, range.localSha, cwd)) return range.remoteSha;
+    return mainMergeBase(range, cwd);
+  }
+  return mainMergeBase(range, cwd);
+}
+
 export function changedFilesForRange(range, cwd = PROJECT_ROOT) {
-  const existingRemote = range.remoteSha && range.remoteSha !== ZERO_SHA;
+  // A rewritten history is treated like a new branch here for the same reason as
+  // guardBaseForRange: `<abandoned tip>..<local>` is not the set of files this push
+  // actually introduces relative to main.
+  const existingRemote =
+    range.remoteSha && range.remoteSha !== ZERO_SHA && isAncestor(range.remoteSha, range.localSha, cwd);
   const hasOriginMain = !existingRemote && tryGit(["rev-parse", "--verify", "--quiet", MAIN_REMOTE_REF], cwd);
   const spec = existingRemote
     ? `${range.remoteSha}..${range.localSha}`
diff --git a/scripts/issue-id.mjs b/scripts/issue-id.mjs
new file mode 100644
index 0000000000..8b6c4bc353
--- /dev/null
+++ b/scripts/issue-id.mjs
@@ -0,0 +1,119 @@
+import { createHash, randomBytes } from "node:crypto";
+
+const CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+const CROCKFORD_CHARS = "[0-9A-HJKMNP-TV-Z]";
+
+export const ISSUE_ULID_PATTERN = new RegExp(`^[0-7]${CROCKFORD_CHARS}{25}$`);
+export const LEGACY_ISSUE_ID_PATTERN = /^#\d{3,}$/;
+export const DISPLAY_ISSUE_ID_PATTERN = new RegExp(`^#${CROCKFORD_CHARS}{6,16}$`);
+const ISSUE_ID_CELL_PATTERN = new RegExp(
+  `^(#(?:\\d{3,}|${CROCKFORD_CHARS}{6,16}))(?:\\s+<!--\\s*issue-ulid:([0-7]${CROCKFORD_CHARS}{25})\\s*-->)?$`,
+);
+const ISSUE_CITATION_PATTERN = new RegExp(`#(?:${CROCKFORD_CHARS}{6,16}|\\d{3,})`, "g");
+
+function encodeBase32(value, length) {
+  let remaining = BigInt(value);
+  const output = Array.from({ length }, () => "0");
+  for (let index = length - 1; index >= 0; index -= 1) {
+    output[index] = CROCKFORD[Number(remaining & 31n)];
+    remaining >>= 5n;
+  }
+  if (remaining !== 0n) throw new Error(`value does not fit in ${length} Crockford base32 characters`);
+  return output.join("");
+}
+
+function entropyValue(bytes) {
+  if (!(bytes instanceof Uint8Array) || bytes.length !== 10) {
+    throw new Error("ULID entropy must be exactly 10 bytes");
+  }
+  let value = 0n;
+  for (const byte of bytes) value = (value << 8n) | BigInt(byte);
+  return value;
+}
+
+export function issueUlid(timestamp = Date.now(), entropy = randomBytes(10)) {
+  if (!Number.isSafeInteger(timestamp) || timestamp < 0 || timestamp > 0xffffffffffff) {
+    throw new Error("ULID timestamp must be a non-negative 48-bit integer");
+  }
+  return `${encodeBase32(BigInt(timestamp), 10)}${encodeBase32(entropyValue(entropy), 16)}`;
+}
+
+/** Stable identity for legacy version-1 add requests during the schema transition. */
+export function issueUlidFromRequest(createdOn, requestId) {
+  const timestamp = Date.parse(`${createdOn}T00:00:00.000Z`);
+  if (!Number.isSafeInteger(timestamp)) throw new Error(`cannot derive an issue ULID from createdOn=${createdOn}`);
+  const entropy = createHash("sha256").update(String(requestId)).digest().subarray(0, 10);
+  return issueUlid(timestamp, entropy);
+}
+
+export function isIssueUlid(value) {
+  return ISSUE_ULID_PATTERN.test(String(value ?? ""));
+}
+
+export function canonicalLegacyIssueId(number) {
+  return `#${String(number).padStart(3, "0")}`;
+}
+
+export function isIssueDisplayId(value) {
+  const id = String(value ?? "");
+  if (DISPLAY_ISSUE_ID_PATTERN.test(id)) return true;
+  if (!LEGACY_ISSUE_ID_PATTERN.test(id)) return false;
+  const number = Number(id.slice(1));
+  return Number.isSafeInteger(number) && id === canonicalLegacyIssueId(number);
+}
+
+export function displayIdForUlid(ulid, length = 6) {
+  if (!isIssueUlid(ulid)) throw new Error(`invalid issue ULID: ${ulid}`);
+  if (!Number.isInteger(length) || length < 6 || length > 16) {
+    throw new Error("issue display-id length must be between 6 and 16");
+  }
+  return `#${ulid.slice(10, 10 + length)}`;
+}
+
+export function allocateDisplayId(ulid, usedIds) {
+  const allocated = usedIds instanceof Set ? usedIds : new Set(usedIds);
+  for (let length = 6; length <= 16; length += 1) {
+    const candidate = displayIdForUlid(ulid, length);
+    if (!allocated.has(candidate)) return candidate;
+  }
+  throw new Error(`issue ULID ${ulid} duplicates an existing durable identity`);
+}
+
+export function issueIdCell(displayId, ulid) {
+  if (!DISPLAY_ISSUE_ID_PATTERN.test(String(displayId ?? ""))) {
+    throw new Error(`invalid collision-free issue display id: ${displayId}`);
+  }
+  if (!isIssueUlid(ulid)) throw new Error(`invalid issue ULID: ${ulid}`);
+  const suffix = ulid.slice(10);
+  if (!suffix.startsWith(displayId.slice(1))) {
+    throw new Error(`issue display id ${displayId} is not derived from ULID ${ulid}`);
+  }
+  return `${displayId} <!-- issue-ulid:${ulid} -->`;
+}
+
+export function parseIssueIdCell(cell) {
+  const raw = String(cell ?? "").trim();
+  const match = raw.match(ISSUE_ID_CELL_PATTERN);
+  if (!match) {
+    const numeric = raw.match(/^#(\d+)$/);
+    const number = numeric ? Number(numeric[1]) : null;
+    return { id: raw, number: Number.isSafeInteger(number) ? number : null, ulid: null, valid: false };
+  }
+  const [, id, ulid = null] = match;
+  if (ulid) {
+    const valid = DISPLAY_ISSUE_ID_PATTERN.test(id) && ulid.slice(10).startsWith(id.slice(1));
+    return { id, number: null, ulid, valid };
+  }
+  if (!LEGACY_ISSUE_ID_PATTERN.test(id)) return { id, number: null, ulid: null, valid: false };
+  const number = Number(id.slice(1));
+  return {
+    id,
+    number,
+    ulid: null,
+    valid: Number.isSafeInteger(number) && id === canonicalLegacyIssueId(number),
+  };
+}
+
+export function issueIdCitations(value) {
+  return [...String(value ?? "").matchAll(ISSUE_CITATION_PATTERN)].map((match) => match[0]);
+}
diff --git a/scripts/issues-report.mjs b/scripts/issues-report.mjs
index f85f01964b..42447a3a7d 100644
--- a/scripts/issues-report.mjs
+++ b/scripts/issues-report.mjs
@@ -4,6 +4,7 @@ import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 
 import { parseIssues } from "./check-outstanding-issues.mjs";
+import { issueIdCitations } from "./issue-id.mjs";
 import { splitCells } from "./outstanding-issues.mjs";
 
 const LEDGER_PATH = "docs/outstanding-issues.md";
@@ -31,7 +32,7 @@ function queueRows(markdown) {
     if (cells.length !== 7) continue;
     rows.push({
       order: Number(cells[0]),
-      ids: [...cells[1].matchAll(/#\d+/g)].map((match) => match[0]),
+      ids: issueIdCitations(cells[1]),
       acuity: cells[2],
       capability: cells[3],
       when: cells[4],
@@ -75,7 +76,8 @@ export function buildIssuesReport(markdown, source) {
     .map((row) => {
       const cells = splitCells(row.raw);
       return {
-        id: cells[0],
+        // parseIssues strips the durable ULID comment from the human-facing id.
+        id: row.id,
         priority: cells[1],
         type: cells[2],
         summary: cells[3],
diff --git a/scripts/ledger-inbox.mjs b/scripts/ledger-inbox.mjs
index 637b849207..4376f0a6cc 100644
--- a/scripts/ledger-inbox.mjs
+++ b/scripts/ledger-inbox.mjs
@@ -3,8 +3,8 @@
  * Conflict-free intake for the outstanding-issues ledger.
  *
  * Feature branches write one immutable request file; only a deliberately serialized
- * `reconcile` operation edits docs/outstanding-issues.md and allocates numeric IDs.
- * This keeps a busy PR queue from contending on the next-id marker or one table row.
+ * `reconcile` operation edits docs/outstanding-issues.md. Add requests carry a
+ * durable ULID, so independent branches no longer contend on a numeric marker.
  */
 import { randomUUID } from "node:crypto";
 import { execFileSync } from "node:child_process";
@@ -19,6 +19,7 @@ import {
   issueRowFingerprint,
   isValidIssueRowFingerprint,
 } from "./check-outstanding-issues.mjs";
+import { isIssueDisplayId, isIssueUlid, issueUlid, issueUlidFromRequest } from "./issue-id.mjs";
 
 const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
 const INBOX_DIR = "docs/outstanding-issues-inbox";
@@ -50,7 +51,7 @@ function readOutstandingIssues() {
 export function validateRequest(request) {
   const problems = [];
   if (!request || typeof request !== "object") return ["request must be an object"];
-  if (request.version !== 1) problems.push("version must be 1");
+  if (![1, 2].includes(request.version)) problems.push("version must be 1 or 2");
   if (!REQUEST_ID.test(request.id ?? "")) problems.push("id must be a UUID");
   if (!/^\d{4}-\d{2}-\d{2}$/.test(request.createdOn ?? "")) problems.push("createdOn must be YYYY-MM-DD");
   if (!ACTIONS.has(request.action)) problems.push("action must be add, done, update, or cancel");
@@ -58,9 +59,15 @@ export function validateRequest(request) {
   if (request.action === "add") {
     for (const field of ["pri", "type", "summary"])
       if (!request.payload?.[field]) problems.push(`add requires ${field}`);
+    if (request.payload?.issueUlid !== undefined && !isIssueUlid(request.payload.issueUlid)) {
+      problems.push("add issueUlid must be a valid ULID");
+    }
+    if (request.version === 2 && request.payload?.issueUlid === undefined) {
+      problems.push("version 2 add requires a valid issueUlid");
+    }
   }
   if (request.action === "done") {
-    if (!/^#\d{3,}$/.test(request.payload?.id ?? "")) problems.push("done requires a canonical #NNN id");
+    if (!isIssueDisplayId(request.payload?.id)) problems.push("done requires a canonical issue display id");
     if (!request.payload?.outcome) problems.push("done requires outcome");
     if (
       request.payload?.baseRowFingerprint !== undefined &&
@@ -69,7 +76,7 @@ export function validateRequest(request) {
       problems.push("done requires a valid baseRowFingerprint");
   }
   if (request.action === "update") {
-    if (!/^#\d{3,}$/.test(request.payload?.id ?? "")) problems.push("update requires a canonical #NNN id");
+    if (!isIssueDisplayId(request.payload?.id)) problems.push("update requires a canonical issue display id");
     // `pri` counts as a mutation on its own: a re-prioritisation with no prose
     // change is a legitimate and common triage edit, and leaving it out here
     // made `--pri` unusable alone even once the CLI could emit it (ledger #313).
@@ -107,13 +114,16 @@ export function applyRequest(markdown, request) {
     if (!fingerprint) {
       throw new Error(`${id} is no longer open; reread and reissue this request from the latest ledger`);
     }
-    if (fingerprint !== request.payload.baseRowFingerprint) {
+    if (fingerprint !== String(request.payload.baseRowFingerprint).toLowerCase()) {
       throw new Error(
         `${id} is stale: the ledger row changed after this request was queued; reread and reissue from the latest ledger`,
       );
     }
   }
-  if (request.action === "add") return addIssue(markdown, request.payload, options);
+  if (request.action === "add") {
+    const durableId = request.payload.issueUlid ?? issueUlidFromRequest(request.createdOn, request.id);
+    return addIssue(markdown, request.payload, { ...options, issueUlid: durableId });
+  }
   if (request.action === "done") return resolveIssue(markdown, request.payload.id, request.payload.outcome, options);
   return updateIssue(markdown, request.payload.id, request.payload);
 }
@@ -130,12 +140,43 @@ function mutationConflicts(requests) {
   return [...byIssue.entries()].filter(([, requestIds]) => requestIds.length > 1);
 }
 
+/**
+ * Ids of requests that a previous reconciliation already applied. Used to tell a
+ * cancellation that lost a race (its target landed via another branch's batch)
+ * apart from one that names a request which never existed.
+ */
+function appliedRequestsById() {
+  try {
+    return new Map(
+      loadRequestsIn(APPLIED_DIR)
+        .map((entry) => entry.request)
+        .filter((request) => request?.id)
+        .map((request) => [request.id, request]),
+    );
+  } catch {
+    return new Map();
+  }
+}
+
 /**
  * Resolve immutable cancellation decisions before applying a pending request batch.
  * A cancellation request is itself retained in the applied audit trail, while the
  * targeted request is moved unchanged but deliberately not applied to the ledger.
+ *
+ * Parallel reconciliations are normal here: several branches queue requests and one
+ * of them reconciles first. A cancellation whose target was applied by that earlier
+ * batch has therefore *failed* — but throwing would wedge every consumer of this
+ * function (check:docs-links, check:ledger-write-discipline and reconcile itself)
+ * with no legal way out, because write discipline forbids deleting the queued file.
+ * So an already-applied target is reported loudly and skipped rather than fatal; a
+ * genuinely unknown target still throws.
+ *
+ * @param {Array<object>} requests pending requests in the batch
+ * @param {{ appliedRequests?: Map<string, object>, warn?: (message: string) => void }} [options]
  */
-export function planRequestBatch(requests) {
+export function planRequestBatch(requests, options = {}) {
+  const applied = options.appliedRequests ?? appliedRequestsById();
+  const warn = options.warn ?? ((message) => console.warn(message));
   const byId = new Map();
   for (const request of requests) {
     const problems = validateRequest(request);
@@ -146,10 +187,27 @@ export function planRequestBatch(requests) {
 
   const cancelledIds = new Set();
   const cancellations = [];
+  const ineffective = [];
   for (const request of requests) {
     if (request.action !== "cancel") continue;
     const target = byId.get(request.payload.requestId);
     if (!target) {
+      const appliedTarget = applied.get(request.payload.requestId);
+      if (appliedTarget) {
+        if (appliedTarget.action === "cancel") {
+          throw new Error(`cancel request ${request.id} cannot cancel another cancellation request`);
+        }
+        // Lost the race. Say so plainly: the correction this cancellation was
+        // protecting did NOT take effect, and whoever queued it needs to fix the
+        // row with a fresh update rather than assume the cancel did its job.
+        ineffective.push({ requestId: request.id, targetId: request.payload.requestId });
+        warn(
+          `ledger inbox: cancel request ${request.id} did not take effect — its target ` +
+            `${request.payload.requestId} was already applied by an earlier reconciliation. ` +
+            `The cancellation is recorded but changed nothing; correct the affected row with a new update request.`,
+        );
+        continue;
+      }
       throw new Error(`cancel request ${request.id} targets missing pending request ${request.payload.requestId}`);
     }
     if (target.action === "cancel") {
@@ -176,7 +234,7 @@ export function planRequestBatch(requests) {
     );
   }
 
-  return { active, cancellations, cancelledIds: [...cancelledIds] };
+  return { active, cancellations, cancelledIds: [...cancelledIds], ineffectiveCancellations: ineffective };
 }
 
 export function applyRequestBatch(markdown, requests) {
@@ -357,6 +415,7 @@ function createRequest(action, argv) {
           summary: argValue(argv, "summary"),
           detail: argValue(argv, "detail"),
           source: argValue(argv, "source"),
+          issueUlid: issueUlid(),
         }
       : action === "done"
         ? { id: argv[1], outcome: argValue(argv, "outcome") }
@@ -382,7 +441,7 @@ function createRequest(action, argv) {
     }
     payload.baseRowFingerprint = currentFingerprint;
   }
-  const request = { version: 1, id: randomUUID(), createdOn: date(), action, payload };
+  const request = { version: 2, id: randomUUID(), createdOn: date(), action, payload };
   const problems = validateRequest(request);
   if (problems.length > 0) throw new Error(problems.join("; "));
   const relative = requestPath(request.id);
@@ -574,7 +633,22 @@ function selfTest() {
   }
 
   const added = applyRequest(base, add);
-  if (!added.includes("#002")) throw new Error("self-test failed: queued add did not preserve ledger invariants");
+  const replayed = applyRequest(base, add);
+  const legacyUlid = issueUlidFromRequest(add.createdOn, add.id);
+  if (!added.includes(`issue-ulid:${legacyUlid}`) || added !== replayed) {
+    throw new Error("self-test failed: legacy queued add did not derive a stable durable id");
+  }
+  const v2Add = {
+    ...add,
+    version: 2,
+    payload: { ...add.payload, issueUlid: issueUlid(1, new Uint8Array(10)) },
+  };
+  if (validateRequest(v2Add).length > 0 || !applyRequest(base, v2Add).includes(v2Add.payload.issueUlid)) {
+    throw new Error("self-test failed: version 2 add did not preserve its durable id");
+  }
+  if (validateRequest({ ...v2Add, payload: { ...v2Add.payload, issueUlid: "invalid" } }).length === 0) {
+    throw new Error("self-test failed: invalid version 2 durable id accepted");
+  }
   const resolved = applyRequest(base, done);
   if (resolved.includes("`#001`"))
     throw new Error("self-test failed: queued resolve did not preserve ledger invariants");
diff --git a/scripts/outstanding-issues.mjs b/scripts/outstanding-issues.mjs
index 0ae1d6b593..2bbe836b75 100644
--- a/scripts/outstanding-issues.mjs
+++ b/scripts/outstanding-issues.mjs
@@ -12,18 +12,17 @@
 //     that had since been archived (the gate caught it as a cell-count error,
 //     which is a confusing way to be told "wrong table")
 //   - an unescaped `|` inside prose splitting one row into extra cells
-//   - ids allocated by reading the marker by eye and colliding with a
-//     concurrent branch
+//   - ids formerly allocated by reading a numeric marker by eye and colliding
+//     with a concurrent branch
 //
 // So the rules live in ONE place: this writer imports the gate's parser rather
 // than re-deriving where the tables are or how wide they are, and it re-runs the
 // gate against its own output before writing. A refusal here is the same
 // refusal CI would give, minus the round trip.
 //
-// It deliberately does NOT solve id collisions between concurrent branches:
-// allocation is still read-modify-write against the marker, so two branches can
-// still pick the same number. That is ledger #156 / #168 territory and needs a
-// different id scheme, not a better writer.
+// New rows use a request-owned durable ULID and a permanent Crockford display
+// locator. The locator starts at six characters and extends only on collision;
+// existing sequential ids remain valid and are never rewritten.
 //
 // Usage:
 //   node scripts/outstanding-issues.mjs add --pri P2 --type issue \
@@ -43,7 +42,8 @@
 import { readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 
-import { ISSUES_PATH, canonicalId, checkIssues, parseIssues } from "./check-outstanding-issues.mjs";
+import { ISSUES_PATH, checkIssues, parseIssues } from "./check-outstanding-issues.mjs";
+import { allocateDisplayId, displayIdForUlid, issueIdCell, issueIdCitations, issueUlid } from "./issue-id.mjs";
 
 const OPEN_CELLS = 7; // ID | Pri | Type | Summary | Detail / next action | Source | Added
 const ARCHIVE_CELLS = 5; // ID | Type | Summary | Outcome | Resolved
@@ -124,8 +124,7 @@ function isQueueSeparatorRow(cells) {
  * - Renumbers Order 1..N to close gaps (skill contract).
  */
 export function pruneResolvedIdFromQueue(markdown, id) {
-  const target = Number(String(id).replace(/^#/, ""));
-  if (!Number.isFinite(target)) return markdown;
+  const target = String(id);
 
   const lines = markdown.split("\n");
   const queueStart = lines.findIndex((line) => line.startsWith("## Recommended execution queue"));
@@ -142,15 +141,15 @@ export function pruneResolvedIdFromQueue(markdown, id) {
     if (cells.length < 2 || isQueueHeaderRow(cells) || isQueueSeparatorRow(cells)) continue;
 
     const idCell = cells[1] ?? "";
-    const cited = [...idCell.matchAll(/#(\d+)/g)].map((match) => Number(match[1]));
+    const cited = issueIdCitations(idCell);
     if (!cited.includes(target)) continue;
 
-    const remaining = cited.filter((number) => number !== target);
+    const remaining = cited.filter((candidate) => candidate !== target);
     if (remaining.length === 0) {
       lines.splice(index, 1);
       continue;
     }
-    cells[1] = remaining.map((number) => `\`${canonicalId(number)}\``).join(", ");
+    cells[1] = remaining.map((candidate) => `\`${candidate}\``).join(", ");
     lines[index] = buildRow(cells);
   }
 
@@ -196,12 +195,12 @@ export function addIssue(markdown, fields, options = {}) {
 
   return guarded(markdown, (current) => {
     const parsed = parseIssues(current);
-    if (parsed.nextId === null) throw new Error("no issues:next-id marker found");
     if (parsed.openStart < 0) throw new Error("no '## Open items' heading found");
 
-    const id = canonicalId(parsed.nextId);
+    const ulid = String(fields.issueUlid ?? options.issueUlid ?? issueUlid());
+    const id = allocateDisplayId(ulid, new Set(parsed.rows.filter((entry) => entry.valid).map((entry) => entry.id)));
     const row = buildRow([
-      id,
+      issueIdCell(id, ulid),
       pri,
       type,
       escapeCell(fields.summary),
@@ -218,9 +217,7 @@ export function addIssue(markdown, fields, options = {}) {
 
     const lines = current.split("\n");
     lines.splice(anchor + 1, 0, row);
-    let next = lines.join("\n");
-    next = next.replace(/<!--\s*issues:next-id=\d+\s*-->/, `<!-- issues:next-id=${parsed.nextId + 1} -->`);
-    return next;
+    return lines.join("\n");
   });
 }
 
@@ -323,32 +320,35 @@ function selfTest() {
     if (!condition) failures.push(label);
   };
 
-  // add: lands in the OPEN table, takes the marker's id, bumps it.
+  const testUlid = issueUlid(Date.UTC(2026, 1, 2), new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]));
+  const testId = displayIdForUlid(testUlid);
+
+  // add: lands in the OPEN table with a durable, collision-free identity.
   const added = addIssue(
     fixture,
     { pri: "P1", type: "rec", summary: "third", detail: "d", source: "s" },
-    { date: "2026-02-02" },
+    { date: "2026-02-02", issueUlid: testUlid },
   );
   const addedParsed = parseIssues(added);
   check(
-    "add uses the marker id",
-    addedParsed.rows.some((r) => r.id === "#017" && r.table === "open"),
+    "add stores the derived display id",
+    addedParsed.rows.some((r) => r.id === testId && r.ulid === testUlid && r.table === "open"),
   );
-  check("add bumps the marker", addedParsed.nextId === 18);
-  check("add appends after the last open row", added.indexOf("#017") > added.indexOf("#016"));
-  check("add stays out of the archive", !addedParsed.rows.some((r) => r.id === "#017" && r.table === "archive"));
+  check("add leaves the deprecated marker untouched", addedParsed.nextId === 17);
+  check("add appends after the last open row", added.indexOf(testId) > added.indexOf("#016"));
+  check("add stays out of the archive", !addedParsed.rows.some((r) => r.id === testId && r.table === "archive"));
 
   // The wrong-table failure that motivated this writer: appending must not land
   // in the archive even though an archived row sits later in the file.
-  check("add lands before the archive heading", added.indexOf("| #017 ") < added.indexOf("## Resolved / archive"));
+  check("add lands before the archive heading", added.indexOf(`| ${testId} `) < added.indexOf("## Resolved / archive"));
 
   // escaping: a pipe in prose must not become a column.
   const piped = addIssue(
     fixture,
     { pri: "P2", type: "task", summary: "a | b", detail: "c | d" },
-    { date: "2026-02-02" },
+    { date: "2026-02-02", issueUlid: testUlid },
   );
-  const pipedRow = parseIssues(piped).rows.find((r) => r.id === "#017");
+  const pipedRow = parseIssues(piped).rows.find((r) => r.id === testId);
   check("pipes are escaped, not new cells", splitCells(pipedRow.raw).length === OPEN_CELLS);
   check("escaped pipe survives in the text", pipedRow.raw.includes("a \\| b"));
 
@@ -528,7 +528,7 @@ function main() {
   const parsed = parseIssues(next);
   const open = parsed.rows.filter((r) => r.table === "open").length;
   const archived = parsed.rows.filter((r) => r.table === "archive").length;
-  console.log(`${ISSUES_PATH} updated: ${open} open, ${archived} archived, next-id=${parsed.nextId}.`);
+  console.log(`${ISSUES_PATH} updated: ${open} open, ${archived} archived, collision-free id allocation enabled.`);
 }
 
 const invokedDirectly = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
diff --git a/scripts/run-playwright.mjs b/scripts/run-playwright.mjs
index 0365ce018b..28c4f7fa2b 100644
--- a/scripts/run-playwright.mjs
+++ b/scripts/run-playwright.mjs
@@ -261,6 +261,33 @@ try {
           baseUrl: "../..",
           paths: { "@/*": ["src/*"] },
         },
+        // Declaring include/exclude here (rather than leaving them unset and
+        // inheriting the root tsconfig.json's) is deliberate. TypeScript resolves
+        // an extended config's *inherited* relative include/exclude entries
+        // against the repo root, so an unset include here would still resolve
+        // "**/*.ts" and ".next/dev/types/**/*.ts" against the shared top-level
+        // .next/ directory — not this isolated run's own NEXT_DIST_DIR output
+        // under `dist/`. That pulls stale/foreign route types from whatever the
+        // top-level .next happens to contain (a prior `npm run dev` or `npm run
+        // build`) into this run's typecheck. Excluding the repo-root .next/ and
+        // pointing at this run's own dist/types + dist/dev/types keeps the
+        // isolated build's typecheck scoped to itself (outstanding-issues #210).
+        include: [
+          "../../next-env.d.ts",
+          "../../**/*.ts",
+          "../../**/*.tsx",
+          "../../**/*.mts",
+          "dist/types/**/*.ts",
+          "dist/dev/types/**/*.ts",
+        ],
+        exclude: [
+          "../../node_modules",
+          "../../scratch/**",
+          "../../supabase/functions/**",
+          "../../worktrees/**",
+          "../../scripts/archive/**",
+          "../../.next/**",
+        ],
       },
       null,
       2,
diff --git a/src/app/(search-app)/calculators/page.tsx b/src/app/(search-app)/calculators/page.tsx
index cb6ca98959..802403f7a8 100644
--- a/src/app/(search-app)/calculators/page.tsx
+++ b/src/app/(search-app)/calculators/page.tsx
@@ -1,12 +1,45 @@
 import type { Metadata } from "next";
+import { redirect } from "next/navigation";
 
-import { CalculatorsSearchPage } from "@/components/calculators";
+import { CalculatorsHomePage, CalculatorsSearchPage } from "@/components/calculators";
 
 export const metadata: Metadata = {
   title: "Calculators - Clinical KB",
   description: "Psychiatry clinical decision calculators and rating scales with source-cited scoring guidance.",
 };
 
-export default function CalculatorsRoute() {
-  return <CalculatorsSearchPage />;
+type CalculatorsSearchParams = Promise<{ [key: string]: string | string[] | undefined }>;
+
+function readFirstSearchParam(value: string | string[] | undefined) {
+  return Array.isArray(value) ? value[0] : value;
+}
+
+function toURLSearchParams(params: Awaited<CalculatorsSearchParams>) {
+  const normalized = new URLSearchParams();
+  for (const [key, value] of Object.entries(params)) {
+    if (Array.isArray(value)) value.forEach((item) => normalized.append(key, item));
+    else if (value !== undefined) normalized.set(key, value);
+  }
+  return normalized;
+}
+
+export default async function CalculatorsRoute({ searchParams }: { searchParams: CalculatorsSearchParams }) {
+  const resolvedSearchParams = await searchParams;
+  const hasSubmittedSearch = readFirstSearchParam(resolvedSearchParams.run) === "1";
+  const primaryQuery = readFirstSearchParam(resolvedSearchParams.q)?.trim();
+  const legacyQuery = readFirstSearchParam(resolvedSearchParams.query)?.trim();
+  const query = primaryQuery || legacyQuery;
+
+  if (resolvedSearchParams.query !== undefined) {
+    const canonicalSearchParams = toURLSearchParams(resolvedSearchParams);
+    if (query) canonicalSearchParams.set("q", query);
+    else canonicalSearchParams.delete("q");
+    canonicalSearchParams.delete("query");
+    const suffix = canonicalSearchParams.toString();
+    redirect(suffix ? `/calculators?${suffix}` : "/calculators");
+  }
+
+  if (!hasSubmittedSearch || !query) return <CalculatorsHomePage />;
+
+  return <CalculatorsSearchPage initialQuery={query} />;
 }
diff --git a/src/app/(search-app)/tools/page.tsx b/src/app/(search-app)/tools/page.tsx
index 0ff0305dba..73a91b725c 100644
--- a/src/app/(search-app)/tools/page.tsx
+++ b/src/app/(search-app)/tools/page.tsx
@@ -1,7 +1,7 @@
 import type { Metadata } from "next";
 
-import { ApplicationsLauncherPage } from "@/components/applications-launcher-page";
 import { ToolsSearchResultsPage } from "@/components/tools/tools-search-results-page";
+import { modeHomeDesktopComposerSlotId } from "@/lib/mode-home-composer";
 
 type ToolsRouteProps = {
   searchParams?: Promise<{ query?: string | string[]; q?: string | string[]; run?: string | string[] }>;
@@ -21,5 +21,10 @@ export default async function ToolsRoute({ searchParams }: ToolsRouteProps) {
   const query = (firstSearchParam(params.q) ?? firstSearchParam(params.query) ?? "").trim();
   const hasSubmittedSearch = firstSearchParam(params.run) === "1" && query.length > 0;
 
-  return hasSubmittedSearch ? <ToolsSearchResultsPage initialQuery={query} /> : <ApplicationsLauncherPage />;
+  return (
+    <ToolsSearchResultsPage
+      initialQuery={query}
+      desktopComposerSlotId={hasSubmittedSearch ? undefined : modeHomeDesktopComposerSlotId}
+    />
+  );
 }
diff --git a/src/app/api/documents/route.ts b/src/app/api/documents/route.ts
index a1af530449..b610378a9a 100644
--- a/src/app/api/documents/route.ts
+++ b/src/app/api/documents/route.ts
@@ -1,5 +1,10 @@
 import { z } from "zod";
-import { ACTIVE_INDEXING_POLL_MS, indexingListResponse, offsetPagination } from "@/lib/api-list-response";
+import {
+  ACTIVE_INDEXING_POLL_MS,
+  indexingListResponse,
+  offsetPagination,
+  parseListRows,
+} from "@/lib/api-list-response";
 import { rateLimitJsonResponse } from "@/lib/api-rate-limit";
 import { demoDocuments } from "@/lib/demo-data";
 import { isDemoMode } from "@/lib/env";
@@ -96,9 +101,17 @@ const SUMMARY_LIST_COLUMNS = [
 const VALID_STATUSES = new Set(["queued", "processing", "indexed", "failed"]);
 const ACTIVE_DOCUMENT_STATUSES = new Set(["queued", "processing"]);
 
-type DocumentListRow = Record<string, unknown> & { id: string; owner_id?: unknown; status?: string | null };
-type LabelListRow = Record<string, unknown> & { document_id: string };
-type SummaryListRow = Record<string, unknown> & { document_id: string };
+const documentListRowSchema = z
+  .object({
+    id: z.string(),
+    owner_id: z.unknown().optional(),
+    status: z.string().nullable().optional(),
+  })
+  .passthrough();
+const labelListRowSchema = z.object({ document_id: z.string() }).passthrough();
+const summaryListRowSchema = z.object({ document_id: z.string() }).passthrough();
+
+type DocumentListRow = z.infer<typeof documentListRowSchema>;
 
 function projectPublicFields<T extends Record<string, unknown>>(row: T, columns: string): Partial<T> {
   const projected: Record<string, unknown> = {};
@@ -189,7 +202,7 @@ export async function GET(request: Request) {
     // An authenticated caller reads PUBLIC (owner_id IS NULL) documents alongside their own via
     // withOwnerReadScope. Redact operator-internal storage fields on the rows they do not own so a
     // shared public document never exposes its owner's storage_path/content_hash/etc. (S1/D1).
-    const rawDocuments = (error ? [] : (data ?? [])) as unknown as DocumentListRow[];
+    const rawDocuments = parseListRows(error ? [] : data, documentListRowSchema);
     const ownedDocumentIds = new Set(
       rawDocuments.filter((document) => callerOwnsDocumentRow(document, access.ownerId)).map((document) => document.id),
     );
@@ -228,10 +241,10 @@ export async function GET(request: Request) {
     }
 
     const labelsByDocument = new Map<string, unknown[]>();
-    const labelRows = [
-      ...(ownedLabelsResult.data ?? []),
-      ...(publicLabelsResult.data ?? []),
-    ] as unknown as LabelListRow[];
+    const labelRows = parseListRows(
+      [...(ownedLabelsResult.data ?? []), ...(publicLabelsResult.data ?? [])],
+      labelListRowSchema,
+    );
     for (const label of labelRows) {
       const existing = labelsByDocument.get(label.document_id) ?? [];
       existing.push(
@@ -239,16 +252,15 @@ export async function GET(request: Request) {
       );
       labelsByDocument.set(label.document_id, existing);
     }
+    const summaryRows = parseListRows(
+      [...(ownedSummariesResult.data ?? []), ...(publicSummariesResult.data ?? [])],
+      summaryListRowSchema,
+    );
     const summariesByDocument = new Map(
-      [...(ownedSummariesResult.data ?? []), ...(publicSummariesResult.data ?? [])].map((value) => {
-        const summary = value as unknown as SummaryListRow;
-        return [
-          summary.document_id,
-          ownedDocumentIds.has(summary.document_id)
-            ? summary
-            : projectPublicFields(summary, PUBLIC_SUMMARY_LIST_COLUMNS),
-        ];
-      }),
+      summaryRows.map((summary) => [
+        summary.document_id,
+        ownedDocumentIds.has(summary.document_id) ? summary : projectPublicFields(summary, PUBLIC_SUMMARY_LIST_COLUMNS),
+      ]),
     );
 
     return documentsResponse(
diff --git a/src/app/api/ingestion/batches/route.ts b/src/app/api/ingestion/batches/route.ts
index 270369613e..036c9f8311 100644
--- a/src/app/api/ingestion/batches/route.ts
+++ b/src/app/api/ingestion/batches/route.ts
@@ -5,6 +5,7 @@ import {
   emptyPagination,
   indexingListResponse,
   offsetPagination,
+  parseStatusRows,
   type StatusRow,
 } from "@/lib/api-list-response";
 import { isDemoMode } from "@/lib/env";
@@ -63,7 +64,7 @@ export async function GET(request: Request) {
       .range(offset, offset + limit - 1);
 
     if (error) throw new Error(error.message);
-    const batches = (data ?? []) as unknown as BatchRow[];
+    const batches = parseStatusRows(data);
     return batchesResponse(batches, {
       pagination: offsetPagination({ limit, offset, pageLength: batches.length, count }),
     });
diff --git a/src/app/api/ingestion/jobs/route.ts b/src/app/api/ingestion/jobs/route.ts
index b1ba5c9fa0..8ff6cb9ef8 100644
--- a/src/app/api/ingestion/jobs/route.ts
+++ b/src/app/api/ingestion/jobs/route.ts
@@ -5,6 +5,7 @@ import {
   emptyPagination,
   indexingListResponse,
   offsetPagination,
+  parseStatusRows,
   type StatusRow,
 } from "@/lib/api-list-response";
 import { isDemoMode } from "@/lib/env";
@@ -69,7 +70,7 @@ export async function GET(request: Request) {
 
     const { data, error, count } = await query;
     if (error) throw new Error(error.message);
-    const jobs = (data ?? []) as unknown as JobRow[];
+    const jobs = parseStatusRows(data);
     return jobsResponse(jobs, {
       pagination: offsetPagination({ limit, offset, pageLength: jobs.length, count }),
     });
diff --git a/src/app/api/ingestion/quality/route.ts b/src/app/api/ingestion/quality/route.ts
index 12c32ef150..1c2ce14738 100644
--- a/src/app/api/ingestion/quality/route.ts
+++ b/src/app/api/ingestion/quality/route.ts
@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
+import { parseListRows } from "@/lib/api-list-response";
 import { consumeApiRateLimit, rateLimitJsonResponse } from "@/lib/api-rate-limit";
 import { isDemoMode } from "@/lib/env";
 import { jsonError } from "@/lib/http";
@@ -13,65 +14,88 @@ type Severity = "danger" | "warning" | "info";
 type ReviewType =
   "failed_ocr" | "low_extraction_confidence" | "missing_tables" | "image_only_pages" | "failed_job" | "manual_review";
 
-type DocumentRow = {
-  id: string;
-  title: string | null;
-  file_name: string | null;
-  status: string | null;
-  page_count: number | null;
-  chunk_count: number | null;
-  image_count: number | null;
-  error_message: string | null;
-  metadata: Record<string, unknown> | null;
-  updated_at: string | null;
-};
-
-type QualityRow = {
-  document_id: string;
-  quality_score: number | null;
-  extraction_quality: string | null;
-  metrics: Record<string, unknown> | null;
-  issues: string[] | null;
-  updated_at: string | null;
-};
-
-type JobRow = {
-  id: string;
-  document_id: string;
-  status: string | null;
-  stage: string | null;
-  error_message: string | null;
-  updated_at: string | null;
-};
-
-type StageRow = {
-  id: string;
-  document_id: string;
-  job_id: string | null;
-  stage_name: string | null;
-  stage_status: string | null;
-  error_message: string | null;
-  metadata: Record<string, unknown> | null;
-  artifact_counts: Record<string, unknown> | null;
-  finished_at: string | null;
-  started_at: string | null;
-};
-
-type PageRow = {
-  document_id: string;
-  page_number: number | null;
-  text: string | null;
-  ocr_used: boolean | null;
-  metadata: Record<string, unknown> | null;
-};
-
-type ImageRow = {
-  document_id: string;
-  page_number: number | null;
-  source_kind: string | null;
-  searchable: boolean | null;
-  metadata: Record<string, unknown> | null;
-};
+const nullableRecordSchema = z.record(z.string(), z.unknown()).nullable();
+const nullableStringSchema = z.string().nullable();
+const nullableNumberSchema = z.number().nullable();
+
+const documentRowSchema = z
+  .object({
+    id: z.string(),
+    title: nullableStringSchema,
+    file_name: nullableStringSchema,
+    status: nullableStringSchema,
+    page_count: nullableNumberSchema,
+    chunk_count: nullableNumberSchema,
+    image_count: nullableNumberSchema,
+    error_message: nullableStringSchema,
+    metadata: nullableRecordSchema,
+    updated_at: nullableStringSchema,
+  })
+  .passthrough();
+
+const qualityRowSchema = z
+  .object({
+    document_id: z.string(),
+    quality_score: nullableNumberSchema,
+    extraction_quality: nullableStringSchema,
+    metrics: nullableRecordSchema,
+    issues: z.array(z.string()).nullable(),
+    updated_at: nullableStringSchema,
+  })
+  .passthrough();
+
+const jobRowSchema = z
+  .object({
+    id: z.string(),
+    document_id: z.string(),
+    status: nullableStringSchema,
+    stage: nullableStringSchema,
+    error_message: nullableStringSchema,
+    updated_at: nullableStringSchema,
+  })
+  .passthrough();
+
+const stageRowSchema = z
+  .object({
+    id: z.string(),
+    document_id: z.string(),
+    job_id: nullableStringSchema,
+    stage_name: nullableStringSchema,
+    stage_status: nullableStringSchema,
+    error_message: nullableStringSchema,
+    metadata: nullableRecordSchema,
+    artifact_counts: nullableRecordSchema,
+    finished_at: nullableStringSchema,
+    started_at: nullableStringSchema,
+  })
+  .passthrough();
+
+const pageRowSchema = z
+  .object({
+    document_id: z.string(),
+    page_number: nullableNumberSchema,
+    text: nullableStringSchema,
+    ocr_used: z.boolean().nullable(),
+    metadata: nullableRecordSchema,
+  })
+  .passthrough();
+
+const imageRowSchema = z
+  .object({
+    document_id: z.string(),
+    page_number: nullableNumberSchema,
+    source_kind: nullableStringSchema,
+    searchable: z.boolean().nullable(),
+    metadata: nullableRecordSchema,
+  })
+  .passthrough();
+
+type DocumentRow = z.infer<typeof documentRowSchema>;
+type QualityRow = z.infer<typeof qualityRowSchema>;
+type JobRow = z.infer<typeof jobRowSchema>;
+type StageRow = z.infer<typeof stageRowSchema>;
+type PageRow = z.infer<typeof pageRowSchema>;
+type ImageRow = z.infer<typeof imageRowSchema>;
 
 type ReviewItem = {
   id: string;
@@ -343,7 +367,7 @@ export async function GET(request: Request) {
       .limit(limit);
     if (documentsError) throw new Error(documentsError.message);
 
-    const documents = (documentsData ?? []) as unknown as DocumentRow[];
+    const documents = parseListRows(documentsData, documentRowSchema);
     const documentIds = documents.map((document) => document.id);
     if (documentIds.length === 0) return NextResponse.json({ items: [] });
 
@@ -381,11 +405,11 @@ export async function GET(request: Request) {
     return NextResponse.json({
       items: buildReviewItems({
         documents,
-        qualityRows: (qualityResult.data ?? []) as unknown as QualityRow[],
-        jobs: (jobsResult.data ?? []) as unknown as JobRow[],
-        stages: (stagesResult.data ?? []) as unknown as StageRow[],
-        pages: (pagesResult.data ?? []) as unknown as PageRow[],
-        images: (imagesResult.data ?? []) as unknown as ImageRow[],
+        qualityRows: parseListRows(qualityResult.data, qualityRowSchema),
+        jobs: parseListRows(jobsResult.data, jobRowSchema),
+        stages: parseListRows(stagesResult.data, stageRowSchema),
+        pages: parseListRows(pagesResult.data, pageRowSchema),
+        images: parseListRows(imagesResult.data, imageRowSchema),
       }).slice(0, 80),
     });
   } catch (error) {
diff --git a/src/app/api/jobs/route.ts b/src/app/api/jobs/route.ts
index 7cf390be17..440a10863a 100644
--- a/src/app/api/jobs/route.ts
+++ b/src/app/api/jobs/route.ts
@@ -4,6 +4,7 @@ import {
   countActiveRows,
   indexingListResponse,
   offsetPagination,
+  parseStatusRows,
   type StatusRow,
 } from "@/lib/api-list-response";
 import { demoJobs } from "@/lib/demo-data";
@@ -61,7 +62,7 @@ export async function GET(request: Request) {
       .range(offset, offset + limit - 1);
 
     if (error) throw new Error(error.message);
-    const jobs = (data ?? []) as unknown as JobRow[];
+    const jobs = parseStatusRows(data);
     return jobsResponse(jobs, {
       pagination: offsetPagination({ limit, offset, pageLength: jobs.length, count }),
     });
diff --git a/src/app/api/search/universal/route.ts b/src/app/api/search/universal/route.ts
index 32d4d1702c..ed17b2a63d 100644
--- a/src/app/api/search/universal/route.ts
+++ b/src/app/api/search/universal/route.ts
@@ -95,7 +95,7 @@ function universalStreamResponse(
           enqueue({ type: "complete", response: { ...response, ...decoration } });
           controller.close();
         })
-        .catch((error: unknown) => {
+        .catch(() => {
           if (searchController.signal.aborted) {
             try {
               controller.close();
@@ -104,7 +104,12 @@ function universalStreamResponse(
             }
             return;
           }
-          controller.error(error);
+          // Headers have already been returned, so this failure cannot become a
+          // JSON 500. End the NDJSON protocol with a fixed, non-sensitive error
+          // event instead of erroring the response stream (which Next reports as
+          // an unhandled server request error and can leave consumers waiting).
+          enqueue({ type: "error", code: "universal_search_failed" });
+          controller.close();
         })
         .finally(() => request.signal.removeEventListener("abort", abortFromRequest));
     },
diff --git a/src/app/globals.css b/src/app/globals.css
index 23dfd37aae..f16a7f9e24 100644
--- a/src/app/globals.css
+++ b/src/app/globals.css
@@ -231,8 +231,8 @@
   --animate-dialog-rise: dialog-rise 220ms cubic-bezier(0.22, 1, 0.36, 1) both;
   --animate-action-tray-in: action-tray-in var(--swipe-duration, 160ms) cubic-bezier(0.22, 1, 0.36, 1) both;
   --animate-shimmer: shimmer 1.4s linear infinite;
-  --animate-answer-ecg: answer-ecg-sweep 1.8s linear infinite;
-  --animate-answer-ecg-compact: answer-ecg-sweep 1.6s linear infinite;
+  --animate-answer-ecg: answer-ecg-pulse 1.8s ease-in-out infinite;
+  --animate-answer-ecg-compact: answer-ecg-pulse 1.6s ease-in-out infinite;
 }
 
 /* Theme tokens */
@@ -2618,46 +2618,287 @@ summary::-webkit-details-marker {
   padding-bottom: calc(0.5rem + env(safe-area-inset-bottom));
 }
 
-/* Global PWA notices sit above the bottom composer and home indicator without
-   changing page scroll ownership. The lifecycle component renders only when an
-   offline, restored, installable, or waiting-update state needs attention. */
-/* PWA notices: bottom sheet-style on phones (thumb zone, above the fixed
-   composer), floating bottom-right card on medium screens, and top-right
-   toast under the header on desktop — beside the browser's own install
-   affordance and clear of the composer. */
+/* Global PWA notices sit above the phone composer and home indicator without
+   taking page scroll ownership. Install is a compact surface, not a modal:
+   central search stays usable and the wide-screen card remains lower-right. */
 .pwa-notice-stack {
-  --pwa-notice-bottom-gap: calc(max(0.75rem, var(--safe-area-bottom)) + 5.5rem);
+  --pwa-notice-bottom-gap: calc(max(0.75rem, var(--safe-area-bottom)) + 5rem);
+  /* PWA-only geometry and typography roles. Keep the component's exact
+     measured proportions while consuming the shared radius, spacing, and motion
+     ladders wherever a matching step exists. */
+  --pwa-notice-gap: var(--radius-lg);
+  --pwa-card-radius: var(--radius-xl);
+  --pwa-control-radius: var(--radius-md);
+  --pwa-inset-xs: var(--radius-xs);
+  --pwa-inset-sm: var(--radius-sm);
+  --pwa-inset-md: var(--radius-md);
+  --pwa-inset-lg: var(--radius-lg);
+  --pwa-inset-xl: var(--spacing-icon-md);
+  --pwa-grip-height: calc(var(--spacing-icon-sm) + var(--radius-xs));
+  --pwa-grip-width: calc(var(--spacing-icon-xl) + var(--radius-lg));
+  --pwa-grip-thickness: 0.1875rem;
+  --pwa-header-min-height: calc(4 * var(--radius-xl));
+  --pwa-row-min-height: calc(2 * var(--radius-xl) + 2 * var(--radius-xs));
+  --pwa-row-padding-block: 0.4375rem;
+  --pwa-line-height-control: 1;
+  --pwa-line-height-tagline: 1.35rem;
+  --pwa-line-height-copy: var(--spacing-icon-lg);
+  --pwa-line-height-support: var(--pwa-grip-height);
+  --pwa-motion-enter: 280ms;
 
   position: fixed;
   z-index: 95;
-  left: max(0.75rem, var(--safe-area-left));
-  right: max(0.75rem, var(--safe-area-right));
+  left: max(0.5rem, var(--safe-area-left));
+  right: max(0.5rem, var(--safe-area-right));
   bottom: var(--pwa-notice-bottom-gap);
   display: grid;
-  gap: 0.75rem;
+  gap: var(--pwa-notice-gap);
   pointer-events: none;
 }
 
-/* Install notices present as a native-feeling bottom sheet on phones: full
-   bleed to the viewport edges (escaping the stack gutter), flush to the
-   bottom over the composer zone while visible, top corners only, and content
-   padded clear of the home indicator. Matches the drag-grip language of the
-   phone Mode-menu sheet (src/components/ui/sheet.tsx). */
+.pwa-notice-card {
+  overflow: hidden;
+  border: 1px solid var(--border-lux);
+  border-radius: var(--pwa-card-radius);
+  background: var(--surface-lux);
+  box-shadow:
+    0 18px 48px color-mix(in srgb, var(--text-heading) 11%, transparent),
+    0 3px 10px color-mix(in srgb, var(--text-heading) 6%, transparent);
+  animation: pwa-notice-in var(--pwa-motion-enter) cubic-bezier(0.2, 0.9, 0.3, 1) both;
+}
+
+.pwa-lifecycle-card {
+  padding: var(--pwa-inset-xl);
+}
+
+.pwa-connection-restored {
+  justify-self: end;
+  border-color: color-mix(in srgb, var(--success) 24%, var(--border-lux));
+  border-radius: var(--radius-pill, 9999px);
+  background: color-mix(in srgb, var(--success-soft) 88%, var(--surface-lux));
+  padding: var(--pwa-inset-sm) var(--pwa-inset-lg) var(--pwa-inset-sm) calc(2 * var(--pwa-inset-xs));
+  box-shadow: var(--e1);
+}
+
+.pwa-connection-restored > div > span {
+  width: calc(2 * var(--pwa-inset-xl));
+  height: calc(2 * var(--pwa-inset-xl));
+  border-radius: var(--radius-pill, 9999px);
+}
+
+.pwa-install-sheet {
+  max-height: calc(100dvh - var(--pwa-notice-bottom-gap) - 4.25rem);
+  overflow-y: auto;
+  overscroll-behavior: contain;
+}
+
+.pwa-install-grip {
+  display: flex;
+  height: var(--pwa-grip-height);
+  align-items: center;
+  justify-content: center;
+  background: color-mix(in srgb, var(--clinical-accent-soft) 72%, var(--surface-lux));
+}
+
+.pwa-install-grip span {
+  width: var(--pwa-grip-width);
+  height: var(--pwa-grip-thickness);
+  border-radius: var(--radius-pill, 9999px);
+  background: color-mix(in srgb, var(--text-muted) 48%, transparent);
+}
+
+.pwa-install-header {
+  display: flex;
+  min-height: var(--pwa-header-min-height);
+  align-items: center;
+  justify-content: space-between;
+  gap: var(--pwa-notice-gap);
+  border-bottom: 1px solid color-mix(in srgb, var(--border-lux) 82%, transparent);
+  background: color-mix(in srgb, var(--clinical-accent-soft) 72%, var(--surface-lux));
+  padding: calc(2 * var(--pwa-inset-xs)) var(--pwa-inset-md) calc(2 * var(--pwa-inset-xs)) var(--pwa-inset-xl);
+}
+
+.pwa-install-mark {
+  border-radius: var(--pwa-control-radius);
+  filter: drop-shadow(0 2px 3px color-mix(in srgb, var(--clinical-accent) 18%, transparent));
+}
+
+.pwa-install-dismiss {
+  display: inline-flex;
+  min-height: var(--spacing-tap);
+  flex: none;
+  align-items: center;
+  justify-content: center;
+  gap: var(--pwa-inset-xs);
+  border-radius: var(--pwa-control-radius);
+  padding: 0 calc(2 * var(--pwa-inset-xs));
+  color: var(--text-muted);
+  font-size: 0.6875rem;
+  font-weight: 600;
+  line-height: var(--pwa-line-height-control);
+  transition:
+    color var(--duration-quick) ease,
+    background-color var(--duration-quick) ease;
+}
+
+.pwa-install-dismiss:hover {
+  background: color-mix(in srgb, var(--surface-lux) 72%, transparent);
+  color: var(--text-heading);
+}
+
+.pwa-install-dismiss:focus-visible {
+  outline: 2px solid var(--focus);
+  outline-offset: -2px;
+}
+
+.pwa-install-body {
+  background: var(--surface-lux);
+  padding: var(--spacing-icon-sm) var(--pwa-inset-xl) var(--pwa-inset-xl);
+}
+
+.pwa-install-compact-copy {
+  display: none;
+}
+
+.pwa-install-tagline {
+  color: var(--text-heading);
+  font-size: 0.875rem;
+  font-weight: 700;
+  line-height: var(--pwa-line-height-tagline);
+}
+
+.pwa-install-copy {
+  margin-top: var(--pwa-inset-sm);
+  color: var(--text-muted);
+  font-size: 0.8125rem;
+  line-height: var(--pwa-line-height-copy);
+}
+
+.pwa-install-support {
+  margin-top: var(--pwa-inset-sm);
+  color: var(--text-muted);
+  font-size: 0.75rem;
+  font-weight: 600;
+  line-height: var(--pwa-line-height-support);
+}
+
+.pwa-install-benefits,
+.pwa-install-steps {
+  margin-top: var(--pwa-inset-lg);
+  overflow: hidden;
+  border: 1px solid var(--border-lux);
+  border-radius: var(--pwa-control-radius);
+  background: color-mix(in srgb, var(--clinical-accent-soft) 20%, var(--surface-lux));
+}
+
+.pwa-install-benefits li,
+.pwa-install-steps li {
+  display: flex;
+  min-height: var(--pwa-row-min-height);
+  align-items: center;
+  gap: var(--pwa-inset-md);
+  padding: var(--pwa-row-padding-block) var(--pwa-inset-lg);
+  color: var(--text);
+  font-size: 0.75rem;
+  font-weight: 600;
+  line-height: var(--pwa-line-height-support);
+}
+
+.pwa-install-benefits li + li,
+.pwa-install-steps li + li {
+  border-top: 1px solid color-mix(in srgb, var(--border-lux) 80%, transparent);
+}
+
+.pwa-install-benefits svg,
+.pwa-install-steps svg {
+  flex: none;
+  color: var(--clinical-accent);
+}
+
+.pwa-install-steps li {
+  min-height: var(--spacing-tap);
+  justify-content: space-between;
+  font-size: 0.8125rem;
+}
+
+.pwa-install-actions {
+  display: grid;
+  grid-template-columns: minmax(0, 1.45fr) minmax(0, 1fr);
+  gap: calc(2 * var(--pwa-inset-xs));
+  margin-top: var(--pwa-inset-lg);
+}
+
+.pwa-install-actions-single {
+  grid-template-columns: 1fr;
+}
+
+/* The in-flow phone home composer sits near the viewport centre. Keep the
+   browser-native install prompt below it without moving page content: the full
+   value proposition remains on larger and dock-owned surfaces, while the phone
+   hero gets a concise, action-first card. */
 @media (max-width: 639.98px) {
-  .pwa-install-sheet {
-    margin-left: calc(-1 * max(0.75rem, var(--safe-area-left)));
-    margin-right: calc(-1 * max(0.75rem, var(--safe-area-right)));
-    margin-bottom: calc(-1 * var(--pwa-notice-bottom-gap));
-    border-radius: 1.25rem 1.25rem 0 0;
-    border-bottom: 0;
-    padding-left: max(1.25rem, var(--safe-area-left));
-    padding-right: max(1.25rem, var(--safe-area-right));
-    padding-bottom: calc(1.25rem + var(--safe-area-bottom));
+  body:has(#main-content[data-phone-footer-owner="hero"]):has(.pwa-install-native-sheet) .pwa-notice-stack {
+    --pwa-notice-bottom-gap: max(0.5rem, var(--safe-area-bottom));
+  }
+
+  body:has(#main-content[data-phone-footer-owner="hero"]):has(.pwa-install-native-sheet) .pwa-install-grip,
+  body:has(#main-content[data-phone-footer-owner="hero"]):has(.pwa-install-native-sheet) .pwa-install-tagline,
+  body:has(#main-content[data-phone-footer-owner="hero"]):has(.pwa-install-native-sheet) .pwa-install-copy,
+  body:has(#main-content[data-phone-footer-owner="hero"]):has(.pwa-install-native-sheet) .pwa-install-support,
+  body:has(#main-content[data-phone-footer-owner="hero"]):has(.pwa-install-native-sheet) .pwa-install-benefits {
+    display: none;
+  }
+
+  body:has(#main-content[data-phone-footer-owner="hero"]):has(.pwa-install-native-sheet) .pwa-install-header {
+    min-height: 3.25rem;
+    padding-block: calc(2 * var(--pwa-inset-xs));
+  }
+
+  body:has(#main-content[data-phone-footer-owner="hero"]):has(.pwa-install-native-sheet) .pwa-install-body {
+    padding: var(--pwa-inset-sm) var(--pwa-inset-xl) var(--pwa-inset-xl);
+  }
+
+  body:has(#main-content[data-phone-footer-owner="hero"]):has(.pwa-install-native-sheet) .pwa-install-compact-copy {
+    display: block;
+    color: var(--text-muted);
+    font-size: 0.75rem;
+    font-weight: 600;
+    line-height: var(--pwa-line-height-support);
+  }
+
+  body:has(#main-content[data-phone-footer-owner="hero"]):has(.pwa-install-native-sheet) .pwa-install-actions {
+    margin-top: var(--pwa-inset-sm);
   }
 }
 
-.pwa-notice-card {
-  animation: pwa-notice-in 280ms cubic-bezier(0.2, 0.9, 0.3, 1) both;
+.pwa-action {
+  transition:
+    border-color var(--duration-quick) ease,
+    background-color var(--duration-quick) ease,
+    color var(--duration-quick) ease,
+    box-shadow var(--duration-quick) ease;
+}
+
+.pwa-action-primary {
+  border: 1px solid var(--clinical-accent);
+  background: var(--clinical-accent);
+  color: var(--clinical-accent-contrast);
+  box-shadow: var(--e1);
+}
+
+.pwa-action-primary:hover {
+  border-color: var(--clinical-accent-hover);
+  background: var(--clinical-accent-hover);
+}
+
+.pwa-action-secondary {
+  border: 1px solid color-mix(in srgb, var(--clinical-accent) 58%, var(--border-lux));
+  background: var(--surface-lux);
+  color: var(--clinical-accent);
+}
+
+.pwa-action-secondary:hover {
+  background: var(--clinical-accent-soft);
 }
 
 @keyframes pwa-notice-in {
@@ -2674,32 +2915,33 @@ summary::-webkit-details-marker {
 @media (min-width: 640px) {
   .pwa-notice-stack {
     left: auto;
-    width: min(25rem, calc(100vw - 2rem - var(--safe-area-left) - var(--safe-area-right)));
+    right: max(1rem, var(--safe-area-right));
+    bottom: max(1rem, var(--safe-area-bottom));
+    width: min(27rem, calc(100vw - 2rem - var(--safe-area-left) - var(--safe-area-right)));
+  }
+
+  /* Submitted answer views own a fixed bottom composer. Keep the install
+     surface in the opposite corner so neither control can obscure the other. */
+  body:has(form.answer-footer-search-edge) .pwa-notice-stack {
+    top: calc(4.25rem + max(0.75rem, var(--safe-area-top)));
+    bottom: auto;
+  }
+
+  .pwa-install-grip {
+    display: none;
   }
 }
 
 @media (display-mode: standalone) {
   .pwa-notice-stack {
-    --pwa-notice-bottom-gap: calc(max(0.75rem, var(--safe-area-bottom)) + 6rem);
+    --pwa-notice-bottom-gap: calc(max(0.75rem, var(--safe-area-bottom)) + 5.5rem);
   }
 }
 
-/* Last so it also wins over the standalone bottom offset at desktop width. */
 @media (min-width: 1280px) {
   .pwa-notice-stack {
-    top: calc(4.25rem + max(0.5rem, var(--safe-area-top)));
-    bottom: auto;
-  }
-
-  @keyframes pwa-notice-in {
-    from {
-      opacity: 0;
-      transform: translateY(-0.625rem) scale(0.98);
-    }
-    to {
-      opacity: 1;
-      transform: none;
-    }
+    right: max(1.5rem, var(--safe-area-right));
+    bottom: max(1.5rem, var(--safe-area-bottom));
   }
 }
 
@@ -2713,6 +2955,24 @@ html[data-motion="reduced"] .pwa-notice-card {
   animation: none;
 }
 
+@media (forced-colors: active) {
+  .pwa-notice-card,
+  .pwa-install-benefits,
+  .pwa-install-steps,
+  .pwa-action,
+  .pwa-install-dismiss {
+    border-color: CanvasText;
+  }
+
+  .pwa-install-header,
+  .pwa-install-body,
+  .pwa-install-benefits,
+  .pwa-install-steps,
+  .pwa-action-secondary {
+    background: Canvas;
+  }
+}
+
 /* Tabular figures for data, counts, page numbers, byte sizes */
 @utility nums {
   font-variant-numeric: tabular-nums;
@@ -3159,14 +3419,17 @@ td,
   }
 }
 
-/* 320 → 0 is equivalent to 0 → -320 modulo the dash period, without
-   WebKit's unreliable negative SVG dash-offset interpolation. */
-@keyframes answer-ecg-sweep {
-  from {
-    stroke-dashoffset: 320;
+/* Animate compositable opacity on the HTML overlay that contains the bright ECG
+   path. Mobile WebKit can report animations on SVG path properties as running
+   without repainting them, especially in an installed PWA. Keeping animation on
+   a regular HTML layer makes the pulse visible without JavaScript or layout work. */
+@keyframes answer-ecg-pulse {
+  0%,
+  100% {
+    opacity: 0.2;
   }
-  to {
-    stroke-dashoffset: 0;
+  50% {
+    opacity: 1;
   }
 }
 
@@ -3183,12 +3446,9 @@ td,
  * those unlayered classes, check the class body first; the class wins.
  */
 @layer components {
-  .answer-activity-trace {
-    contain: paint;
-  }
-
   .answer-activity-trace__sweep {
     animation: var(--animate-answer-ecg);
+    will-change: opacity;
   }
 
   .answer-activity-trace[data-density="compact"] .answer-activity-trace__sweep {
diff --git a/src/app/mockups/accessible-table-browser-fixture/page.tsx b/src/app/mockups/accessible-table-browser-fixture/page.tsx
new file mode 100644
index 0000000000..cc4e4fd98e
--- /dev/null
+++ b/src/app/mockups/accessible-table-browser-fixture/page.tsx
@@ -0,0 +1,27 @@
+import { AccessibleTable } from "@/components/AccessibleTable";
+
+// An interleaved unnamed clinical column is the conservative normalizer's
+// `ambiguous_generic_column` case: it preserves the raw grid and marks it
+// low-confidence instead of guessing which dose belongs to which action.
+const columns = ["ANC level", "", "Action"];
+const rows = [
+  ["1.5", "", "Continue clozapine and monitor according to the local protocol"],
+  ["1.0", "", "Withhold dose and seek specialist advice"],
+];
+
+export default function AccessibleTableBrowserFixturePage() {
+  return (
+    <main
+      data-testid="accessible-table-browser-fixture"
+      className="mx-auto min-h-screen w-full max-w-lg bg-[color:var(--background)] px-3 py-6 text-[color:var(--text)]"
+    >
+      <h1 className="text-lg font-semibold text-[color:var(--text-heading)]">Accessible table browser fixture</h1>
+      <p className="mt-2 text-sm leading-6 text-[color:var(--text-muted)]">
+        Low-confidence clinical extraction with an explicitly missing dose value.
+      </p>
+      <section className="mt-4 min-w-0" aria-label="Low-confidence table example">
+        <AccessibleTable caption="Clozapine ANC response" columns={columns} rows={rows} densePreview expandOnMobile />
+      </section>
+    </main>
+  );
+}
diff --git a/src/components/ClinicalDashboard.tsx b/src/components/ClinicalDashboard.tsx
index 49eab09ba5..3d31ed7949 100644
--- a/src/components/ClinicalDashboard.tsx
+++ b/src/components/ClinicalDashboard.tsx
@@ -34,7 +34,12 @@ import { useUploadDesktopLayout } from "@/components/clinical-dashboard/use-uplo
 import { extractSafetyFindings } from "@/lib/clinical-safety";
 import { resolveScrollBehavior } from "@/lib/scroll-behavior";
 import { ownsVerticalScroll, scrollSurface } from "@/components/clinical-dashboard/scroll-surface";
-import { isLocalNoAuthMode, resolveClientDemoMode, resolveUploadReadOnlyMode } from "@/lib/client-env";
+import {
+  incrementalEvidencePreviewRenderingEnabled,
+  isLocalNoAuthMode,
+  resolveClientDemoMode,
+  resolveUploadReadOnlyMode,
+} from "@/lib/client-env";
 import { isAdministratorUser } from "@/lib/authorization";
 import { readLocalProjectIdentity, unsafeLocalProjectMessage } from "@/lib/local-project-identity";
 import { isDeployedClinicalKb } from "@/lib/deployed-app";
@@ -82,6 +87,8 @@ import {
   type AnswerProgressUpdate,
   type TimedAnswerProgressUpdate,
 } from "@/components/clinical-dashboard/answer-progress";
+import { AnswerEvidencePreview } from "@/components/clinical-dashboard/answer-evidence-preview";
+import { requestAnswerStream } from "@/components/clinical-dashboard/answer-request";
 import { evidenceMapRowsFromRenderModel } from "@/components/clinical-dashboard/evidence-map-model";
 import { MasterSearchHeader } from "@/components/clinical-dashboard/master-search-header";
 import { PhoneFooterLayerFrame } from "@/components/clinical-dashboard/phone-footer-layer-portal";
@@ -100,7 +107,6 @@ import {
 import { SearchCommandProvider } from "@/components/clinical-dashboard/search-command-context";
 import {
   answerReferencesDocument,
-  answerTimedOutError,
   applyRenamedDocumentToAnswer,
   compactScopeFilters,
   hasActiveIndexingWork,
@@ -110,6 +116,7 @@ import {
   replaceOwnedAbortController,
   mergeDocumentRefresh,
   normalizeNavigationHash,
+  shouldShowSharedHome,
   setupNeedsSlowRecheck,
   setupRecheckPollMs,
   shorterPollDelay,
@@ -170,12 +177,10 @@ import {
   keywordQueryFromNaturalLanguage,
   makeSearchError,
   progressForRetry,
-  readAnswerStream,
   searchRetryCount,
   searchRetryDelaysMs,
   sleep,
   type AnswerErrorKind,
-  type AnswerPayload,
   type SearchError,
 } from "@/components/clinical-dashboard/search-utils";
 import {
@@ -224,11 +229,13 @@ import {
 } from "@/components/clinical-dashboard/use-persisted-answer-thread";
 import { buildAnswerClipboardText } from "@/components/clinical-dashboard/answer-copy-payload";
 import { buildAnswerRenderModel, isAnswerSourceBacked } from "@/lib/answer-render-policy";
+import type { VerifiedEvidencePreviewUnit } from "@/lib/answer-stream-contract";
 import {
   frontendSourceGovernanceWarnings,
   groupSourceGovernanceWarnings,
   type SourceGovernanceWarning,
 } from "@/lib/source-governance";
+
 import { type SmartDocumentTag, type SmartDocumentTagFacet } from "@/lib/document-tags";
 import type {
   ClinicalDocument,
@@ -437,6 +444,7 @@ export function ClinicalDashboard({
     setSourceGovernanceWarnings([]);
     setError(null);
     setAnswerProgress(null);
+    setAnswerEvidencePreview(null);
     setDifferentialEvidenceQuery(null);
   }, [resetAnswerThread]);
   const [scopeFilters, setScopeFilters] = useState<SearchScopeFilters>(initialSearchNavigationContext.scopeFilters);
@@ -449,6 +457,7 @@ export function ClinicalDashboard({
   const [answerProgress, setAnswerProgress] = useState<string | null>(null);
   const [answerProgressEvents, setAnswerProgressEvents] = useState<TimedAnswerProgressUpdate[]>([]);
   const [answerProgressStartedAt, setAnswerProgressStartedAt] = useState<number | null>(null);
+  const [answerEvidencePreview, setAnswerEvidencePreview] = useState<VerifiedEvidencePreviewUnit | null>(null);
   const [answerLifecycle, dispatchAnswerLifecycle] = useReducer(answerLifecycleReducer, initialAnswerLifecycle);
   const [error, setError] = useState<string | null>(null);
   // Companion state for `error`, used to pick the right recovery UI (retry vs.
@@ -1670,57 +1679,30 @@ export function ClinicalDashboard({
     };
   }
 
-  async function requestAnswer(
+  function requestAnswer(
     queryText: string,
     filtersOverride: SearchScopeFilters = scopeFilters,
     queryModeOverride: ClinicalQueryMode = requestQueryMode,
     onProgress: (progress: AnswerProgressUpdate) => void,
+    onEvidencePreview: (preview: VerifiedEvidencePreviewUnit | null) => void,
     signal?: AbortSignal,
     onStreamActivity?: () => void,
   ) {
-    let response: Response;
-    try {
-      response = await fetch("/api/answer/stream", {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          ...(clientDemoMode ? {} : authorizationHeader),
-        },
-        body: JSON.stringify({
-          query: queryText,
-          documentIds: selectedDocumentIds.length > 0 ? selectedDocumentIds : undefined,
-          filters: compactScopeFilters(filtersOverride),
-          queryMode: queryModeOverride,
-        }),
-        signal,
-      });
-    } catch (error) {
-      if (answerTimedOutRef.current) throw answerTimedOutError();
-      if (isAbortError(error)) throw error;
-      throw searchNetworkFailure("Answer search");
-    }
-
-    if (response.status === 401) {
-      markSessionExpired();
-      throw makeSearchError("Search request was not authorized by the server.", 401, false);
-    }
-    if (!response.ok) {
-      throw await parseApiErrorResponse(response);
-    }
-
-    let payload: AnswerPayload;
-    try {
-      payload = await readAnswerStream(response, onProgress, onStreamActivity);
-    } catch (error) {
-      if (answerTimedOutRef.current) throw answerTimedOutError();
-      if (isAbortError(error)) throw error;
-      throw error;
-    }
-    return {
-      kind: "answer" as const,
-      query: queryText,
-      payload,
-    };
+    return requestAnswerStream({
+      queryText,
+      filters: filtersOverride,
+      queryMode: queryModeOverride,
+      selectedDocumentIds,
+      clientDemoMode,
+      authorizationHeader,
+      onProgress,
+      onEvidencePreview,
+      signal,
+      onStreamActivity,
+      timedOut: () => answerTimedOutRef.current,
+      onSessionExpired: markSessionExpired,
+      networkFailure: () => searchNetworkFailure("Answer search"),
+    });
   }
 
   async function runWithRetries<T>(
@@ -1773,6 +1755,7 @@ export function ClinicalDashboard({
     setAnswerProgress(null);
     setAnswerProgressEvents([]);
     setAnswerProgressStartedAt(null);
+    setAnswerEvidencePreview(null);
     dispatchAnswerLifecycle({ type: "cancel" });
   }
 
@@ -1933,6 +1916,10 @@ export function ClinicalDashboard({
         return [...current, { ...progress, receivedAt: Date.now() }].slice(-16);
       });
     };
+    const onAnswerEvidencePreview = (preview: VerifiedEvidencePreviewUnit | null) => {
+      if (!requestIsCurrent()) return;
+      setAnswerEvidencePreview(incrementalEvidencePreviewRenderingEnabled() ? preview : null);
+    };
     const onRetryProgress = (message: string) => {
       if (isAnswerRequest) onAnswerProgress({ stage: "retrying", message });
       else onProgress(message);
@@ -1951,6 +1938,7 @@ export function ClinicalDashboard({
     setSearchFacets(null);
     setSearchScope(null);
     setSourceGovernanceWarnings([]);
+    setAnswerEvidencePreview(null);
     setAnswerViewMode("high_yield");
     if (isAnswerRequest) {
       const startedAt = Date.now();
@@ -2029,15 +2017,18 @@ export function ClinicalDashboard({
                   abortController.signal,
                 )
               : await runWithRetries(
-                  () =>
-                    requestAnswer(
+                  () => {
+                    onAnswerEvidencePreview(null);
+                    return requestAnswer(
                       entry.query,
                       filtersOverride,
                       targetQueryMode,
                       onAnswerProgress,
+                      onAnswerEvidencePreview,
                       abortController.signal,
                       answerWatchdog.touch,
-                    ),
+                    );
+                  },
                   onRetryProgress,
                   abortController.signal,
                 );
@@ -3014,14 +3005,15 @@ export function ClinicalDashboard({
   const showDegradedNotice = !isOnline || (apiUnavailable && !canRunSearch);
   const submittedAnswerSearchActive =
     activeModeResultKind === "answer" && !answer && canRunSearch && (modeSearchSubmitted || Boolean(submittedUrlQuery));
-  // `/` is the single home page for every mode. The mode pill retargets the
-  // composer instead of navigating, so the hero must not be answer-only: picking
-  // DSM on home keeps this exact surface and only swaps the placeholder. Gated on
-  // the pathname (never on `searchMode`) per the hero-vs-dock rule in
-  // docs/search-chrome-behaviour.md — a mode pick must not flip composer reserve.
-  const isHomeRoute = pathname === "/";
-  const showSharedHome =
-    isHomeRoute && !submittedUrlRunRequested && !error && !answer && !loading && !submittedAnswerSearchActive;
+  const showSharedHome = shouldShowSharedHome({
+    pathname,
+    mode: searchParams.get("mode"),
+    submittedUrlRunRequested,
+    hasError: Boolean(error),
+    hasAnswer: Boolean(answer),
+    loading,
+    submittedAnswerSearchActive,
+  });
   const showAnswerPending =
     activeModeResultKind === "answer" && !answer && (loading || (submittedAnswerSearchActive && !error));
   const answerProgressCompleted = answerProgressEvents.at(-1)?.stage === "complete";
@@ -3065,11 +3057,10 @@ export function ClinicalDashboard({
   const desktopHomeComposerSlotId = showDesktopHomeComposer ? modeHomeDesktopComposerSlotId : undefined;
   const desktopResultComposerSlotId =
     !desktopHomeComposerSlotId && searchMode !== "answer" ? desktopPageComposerSlotId : undefined;
-  // Any mounted mode home (answer, documents, prescribing, differentials, tools,
-  // favourites) keeps the in-flow hero pill on phones ("all") per the
-  // page-ownership contract. Only result/submitted views fall back to "sm-up"
-  // so phones get the compact bottom dock.
-  const heroComposerBreakpoint = showDesktopHomeComposer ? "all" : "sm-up";
+  // Most mounted mode homes keep the in-flow hero pill on phones. Tools is the
+  // deliberate exception: its content-rich directory uses the shared compact
+  // footer on phones while retaining the hero composer from sm upward.
+  const heroComposerBreakpoint = showDesktopHomeComposer && activeModeResultKind !== "tools" ? "all" : "sm-up";
   const heroOwnsPhoneComposer = Boolean(desktopHomeComposerSlotId) && heroComposerBreakpoint === "all";
   const hasMobileBottomSearch = searchMode !== "answer" && !heroOwnsPhoneComposer;
   // Favourites and Tools are content-rich hubs: they share the centred hero but
@@ -3658,6 +3649,10 @@ export function ClinicalDashboard({
                     <SearchProgressBanner message={answerProgress} onStop={stopSearch} />
                   ) : null)}
 
+                {activeModeResultKind === "answer" && loading && answerEvidencePreview ? (
+                  <AnswerEvidencePreview preview={answerEvidencePreview} />
+                ) : null}
+
                 {showUniversalAlsoMatches &&
                 (activeModeResultKind === "tools" ||
                   activeModeResultKind === "documents" ||
diff --git a/src/components/applications-launcher-page.tsx b/src/components/applications-launcher-page.tsx
index f00c828988..80bc4344b6 100644
--- a/src/components/applications-launcher-page.tsx
+++ b/src/components/applications-launcher-page.tsx
@@ -119,6 +119,7 @@ function launcherAppsForSession(canAccessFavourites: boolean): LauncherApp[] {
 const toolsLauncherCopy = {
   heading: "Tools",
   description: "Assessment, prescribing, workflows.",
+  showAllLabel: "Show all",
   allSectionLabel: "All tools",
   countNoun: "tools",
   emptyTitle: "No tools match",
@@ -827,6 +828,19 @@ export function ApplicationsLauncherWorkspace({
           headingLevel={1}
         />
 
+        <Link
+          href="/tools"
+          aria-label="Show all tools"
+          data-testid="tools-show-all"
+          className={cn(
+            "inline-flex min-h-tap items-center justify-center gap-2 rounded-full border border-[color:var(--clinical-accent-border)] bg-[color:var(--surface)] px-3 text-xs font-semibold text-[color:var(--text-heading)] shadow-[var(--shadow-inset)] transition hover:bg-[color:var(--clinical-accent-soft)] sm:text-sm lg:min-h-9",
+            focusRing,
+          )}
+        >
+          <Grid2X2 className="h-3.5 w-3.5 text-[color:var(--clinical-accent)]" strokeWidth={1.75} aria-hidden="true" />
+          {copy.showAllLabel}
+        </Link>
+
         {desktopComposerSlotId ? (
           <DesktopComposerPortalSlot
             id={desktopComposerSlotId}
diff --git a/src/components/calculators/calculator-filters.ts b/src/components/calculators/calculator-filters.ts
new file mode 100644
index 0000000000..efdd4f77eb
--- /dev/null
+++ b/src/components/calculators/calculator-filters.ts
@@ -0,0 +1,94 @@
+import { domainLabels, type CalculatorDomain, type CalculatorFixture } from "./calculator-fixtures";
+import type { DerivedCalculator } from "./calculator-ui";
+
+export type CalculatorProgressFilter = "all" | "not-started" | "in-progress" | "completed";
+export type CalculatorTimeFilter = "all" | "quick" | "standard" | "extended";
+
+export type CalculatorFilterState = {
+  domains: ReadonlySet<CalculatorDomain>;
+  progress: CalculatorProgressFilter;
+  time: CalculatorTimeFilter;
+};
+
+export type CalculatorFilterRecord = {
+  calc: CalculatorFixture;
+  derived: DerivedCalculator;
+};
+
+export function normalizeCalculatorQuery(query: string) {
+  return query.trim().toLowerCase();
+}
+
+export function calculatorMatchesQuery(calc: CalculatorFixture, query: string) {
+  const normalized = normalizeCalculatorQuery(query);
+  if (!normalized) return true;
+  const haystack = [calc.abbrev, calc.name, calc.indication, calc.summary, domainLabels[calc.domain]]
+    .join(" ")
+    .toLowerCase();
+  return haystack.includes(normalized) || calc.items.some((item) => item.text.toLowerCase().includes(normalized));
+}
+
+export function calculatorMatchesProgress(derived: DerivedCalculator, progress: CalculatorProgressFilter) {
+  if (progress === "all") return true;
+  if (progress === "not-started") return !derived.started;
+  if (progress === "completed") return derived.complete;
+  return derived.started && !derived.complete;
+}
+
+export function calculatorMatchesTime(calc: CalculatorFixture, time: CalculatorTimeFilter) {
+  if (time === "all") return true;
+  if (time === "quick") return calc.timeEstimateMinutes.max <= 2;
+  if (time === "standard") return calc.timeEstimateMinutes.max >= 3 && calc.timeEstimateMinutes.max <= 4;
+  return calc.timeEstimateMinutes.max >= 5;
+}
+
+export function calculatorMatchesFilters(
+  record: CalculatorFilterRecord,
+  query: string,
+  filters: CalculatorFilterState,
+) {
+  return (
+    calculatorMatchesQuery(record.calc, query) &&
+    (filters.domains.size === 0 || filters.domains.has(record.calc.domain)) &&
+    calculatorMatchesProgress(record.derived, filters.progress) &&
+    calculatorMatchesTime(record.calc, filters.time)
+  );
+}
+
+export function filterCalculatorRecords(
+  records: readonly CalculatorFilterRecord[],
+  query: string,
+  filters: CalculatorFilterState,
+) {
+  return records.filter((record) => calculatorMatchesFilters(record, query, filters));
+}
+
+export function calculatorDomainCandidateCount(
+  records: readonly CalculatorFilterRecord[],
+  query: string,
+  filters: CalculatorFilterState,
+  candidate: CalculatorDomain,
+) {
+  const domains = new Set(filters.domains);
+  if (domains.has(candidate)) domains.delete(candidate);
+  else domains.add(candidate);
+  return filterCalculatorRecords(records, query, { ...filters, domains }).length;
+}
+
+export function calculatorProgressCandidateCount(
+  records: readonly CalculatorFilterRecord[],
+  query: string,
+  filters: CalculatorFilterState,
+  candidate: CalculatorProgressFilter,
+) {
+  return filterCalculatorRecords(records, query, { ...filters, progress: candidate }).length;
+}
+
+export function calculatorTimeCandidateCount(
+  records: readonly CalculatorFilterRecord[],
+  query: string,
+  filters: CalculatorFilterState,
+  candidate: CalculatorTimeFilter,
+) {
+  return filterCalculatorRecords(records, query, { ...filters, time: candidate }).length;
+}
diff --git a/src/components/calculators/calculator-fixtures.ts b/src/components/calculators/calculator-fixtures.ts
index c940c7415a..c1eb34f7f0 100644
--- a/src/components/calculators/calculator-fixtures.ts
+++ b/src/components/calculators/calculator-fixtures.ts
@@ -61,6 +61,8 @@ export type CalculatorFixture = {
   /** Question stem shown above the items. */
   stem?: string;
   timeEstimate: string;
+  /** Numeric range used by the local completion-time filter. */
+  timeEstimateMinutes: { min: number; max: number };
   minScore: number;
   maxScore: number;
   items: CalculatorItem[];
@@ -121,6 +123,7 @@ export const calculators: CalculatorFixture[] = [
     summary: "9-item depression severity score with treatment-action bands.",
     stem: "Over the last 2 weeks, how often have you been bothered by:",
     timeEstimate: "2–3 min",
+    timeEstimateMinutes: { min: 2, max: 3 },
     minScore: 0,
     maxScore: 27,
     scoringNote: "Sum of 9 items (0–3 each). Severity bands map to stepped treatment actions.",
@@ -199,6 +202,7 @@ export const calculators: CalculatorFixture[] = [
     summary: "7-item anxiety severity score; also performs well for panic and social anxiety.",
     stem: "Over the last 2 weeks, how often have you been bothered by:",
     timeEstimate: "1–2 min",
+    timeEstimateMinutes: { min: 1, max: 2 },
     minScore: 0,
     maxScore: 21,
     scoringNote: "Sum of 7 items (0–3 each). ≥10 is the usual cut-point for probable GAD.",
@@ -242,6 +246,7 @@ export const calculators: CalculatorFixture[] = [
     summary: "10-item distress measure scored 10–50, widely used across Australian primary care.",
     stem: "In the past 4 weeks, about how often did you feel:",
     timeEstimate: "2–3 min",
+    timeEstimateMinutes: { min: 2, max: 3 },
     minScore: 10,
     maxScore: 50,
     scoringNote: "Sum of 10 items (1–5 each); range 10–50. Higher scores indicate greater distress.",
@@ -293,6 +298,7 @@ export const calculators: CalculatorFixture[] = [
     summary: "13 lifetime hypomanic symptoms plus co-occurrence and impairment criteria.",
     stem: "Has there ever been a period of time when you were not your usual self and you…",
     timeEstimate: "3–4 min",
+    timeEstimateMinutes: { min: 3, max: 4 },
     minScore: 0,
     maxScore: 13,
     scoringNote:
@@ -399,6 +405,7 @@ export const calculators: CalculatorFixture[] = [
     indication: "Rapid 4-question lifetime screen for problem drinking in adults.",
     summary: "Four yes/no questions; two or more positives is a clinically significant screen.",
     timeEstimate: "under 1 min",
+    timeEstimateMinutes: { min: 0, max: 1 },
     minScore: 0,
     maxScore: 4,
     scoringNote: "1 point per “yes”. ≥2 is a positive screen; follow with AUDIT and drinking history.",
@@ -440,6 +447,7 @@ export const calculators: CalculatorFixture[] = [
     indication: "Brief consumption screen for hazardous drinking — the first three AUDIT items.",
     summary: "3 consumption questions scored 0–4 each; sex-specific positive thresholds.",
     timeEstimate: "1 min",
+    timeEstimateMinutes: { min: 1, max: 1 },
     minScore: 0,
     maxScore: 12,
     scoringNote: "Positive screen at ≥3 for women and ≥4 for men. Higher totals track hazard severity.",
@@ -509,6 +517,7 @@ export const calculators: CalculatorFixture[] = [
     indication: "Structure a rapid inventory of static suicide-risk factors as an adjunct to clinical assessment.",
     summary: "10 yes/no risk factors, one point each; supports — never replaces — clinical judgement.",
     timeEstimate: "1–2 min",
+    timeEstimateMinutes: { min: 1, max: 2 },
     minScore: 0,
     maxScore: 10,
     scoringNote: "1 point per factor present. Bands are indicative only; act on clinical concern at any score.",
@@ -566,6 +575,7 @@ export const calculators: CalculatorFixture[] = [
     indication: "Grade the severity of obsessive-compulsive symptoms and track treatment response.",
     summary: "10 severity items (0–4) across obsessions and compulsions; total 0–40.",
     timeEstimate: "5–8 min",
+    timeEstimateMinutes: { min: 5, max: 8 },
     minScore: 0,
     maxScore: 40,
     scoringNote: "Sum of 10 items. Items 1–5 grade obsessions, 6–10 compulsions; subscales can be reported separately.",
diff --git a/src/components/calculators/calculator-sheet.tsx b/src/components/calculators/calculator-sheet.tsx
index 644623daa7..80b6b7c4cb 100644
--- a/src/components/calculators/calculator-sheet.tsx
+++ b/src/components/calculators/calculator-sheet.tsx
@@ -104,7 +104,7 @@ export function CalculatorSheet({
         onClick={onClose}
         className="absolute inset-0 animate-overlay-in bg-[color:var(--neutral-950)]/55 backdrop-blur-[2px]"
       />
-      <div className="relative flex max-h-[92dvh] w-full animate-sheet-up flex-col overflow-hidden rounded-t-xl border border-[color:var(--border-strong)] bg-[color:var(--background)] shadow-[var(--shadow-lux)] sm:max-w-3xl sm:animate-dialog-rise sm:rounded-xl">
+      <div className="relative flex max-h-[calc(100dvh-max(0.75rem,var(--safe-area-top)))] w-full animate-sheet-up flex-col overflow-hidden rounded-t-xl border border-[color:var(--border-strong)] bg-[color:var(--background)] shadow-[var(--shadow-lux)] sm:max-h-[92dvh] sm:max-w-3xl sm:animate-dialog-rise sm:rounded-xl">
         <header className="modal-landscape-container grid shrink-0 grid-cols-[auto_minmax(0,1fr)_auto_auto] items-center gap-3 border-b border-[color:var(--border)] bg-[color:var(--surface)] py-3">
           <span className="grid size-9 shrink-0 place-items-center rounded-md border border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)]">
             <Icon className="size-icon-md" aria-hidden="true" />
diff --git a/src/components/calculators/home-page.tsx b/src/components/calculators/home-page.tsx
new file mode 100644
index 0000000000..3c06703e81
--- /dev/null
+++ b/src/components/calculators/home-page.tsx
@@ -0,0 +1,58 @@
+import { Calculator, CloudRain, GlassWater, Search, Zap } from "lucide-react";
+
+import { ModeHomeMain, ModeHomeTemplate, ModeHomeVerificationFooter } from "@/components/mode-home-template";
+import { appModeHomeHref } from "@/lib/app-modes";
+import { modeHomeDesktopComposerSlotId } from "@/lib/mode-home-composer";
+
+const calculatorQuickLinks = ["PHQ-9", "GAD-7", "K10", "MDQ", "AUDIT-C"] as const;
+
+function calculatorSearchHref(query: string) {
+  return appModeHomeHref("calculators", { query, run: true });
+}
+
+export function CalculatorsHomePage() {
+  return (
+    <ModeHomeMain testId="calculators-home-main" contentAlign="startOnPhone">
+      <ModeHomeTemplate
+        testId="calculators-home"
+        title="Clinical Calculators"
+        subtitle="Validated psychiatry scores with the indication, items, and next actions in one place."
+        icon={Calculator}
+        actionsLabel="Starter calculator searches"
+        desktopComposerSlotId={modeHomeDesktopComposerSlotId}
+        actions={[
+          {
+            title: "Depression severity",
+            description: "Find screening and symptom-severity scales.",
+            icon: CloudRain,
+            href: calculatorSearchHref("depression"),
+          },
+          {
+            title: "Anxiety & OCD",
+            description: "Find anxiety and obsessive-compulsive measures.",
+            icon: Zap,
+            href: calculatorSearchHref("anxiety"),
+          },
+          {
+            title: "Alcohol use",
+            description: "Find brief alcohol-use screening tools.",
+            icon: GlassWater,
+            href: calculatorSearchHref("alcohol use"),
+          },
+        ]}
+        pillsTitle="Open a calculator"
+        pills={calculatorQuickLinks.map((label) => ({
+          label,
+          href: calculatorSearchHref(label),
+          icon: Search,
+        }))}
+        footer={
+          <ModeHomeVerificationFooter
+            label="Source-cited scoring"
+            body="Scores support clinical judgement and never replace a full assessment. Nothing entered here is stored."
+          />
+        }
+      />
+    </ModeHomeMain>
+  );
+}
diff --git a/src/components/calculators/index.ts b/src/components/calculators/index.ts
index 759635cacf..c9aeaf4e59 100644
--- a/src/components/calculators/index.ts
+++ b/src/components/calculators/index.ts
@@ -2,6 +2,7 @@ export { CalculatorsBedsideSheetMockup } from "./bedside-sheet";
 export { CalculatorsClinicalConsoleMockup } from "./clinical-console";
 export { CalculatorsDirectoryGridMockup } from "./directory-grid";
 export { CalculatorsGuidedFlowMockup } from "./guided-flow";
+export { CalculatorsHomePage } from "./home-page";
 export { CalculatorsPopupSheetMockup } from "./calculator-sheet";
 export { CalculatorsSearchPage } from "./search-page";
 export { CalculatorsSearchDetailMockup } from "./search-detail";
diff --git a/src/components/calculators/search-page.tsx b/src/components/calculators/search-page.tsx
index c6bb6f4ea2..6599ba091c 100644
--- a/src/components/calculators/search-page.tsx
+++ b/src/components/calculators/search-page.tsx
@@ -1,49 +1,44 @@
 "use client";
 
-import {
-  ArrowRight,
-  Calculator,
-  Clock3,
-  History,
-  Info,
-  LayoutGrid,
-  ListChecks,
-  Plus,
-  Rows3,
-  Search,
-  Send,
-  Sigma,
-  SlidersHorizontal,
-  X,
-} from "lucide-react";
-import { useEffect, useMemo, useRef, useState } from "react";
+import { useRouter } from "next/navigation";
+import { ArrowRight, Clock3, History, Info, LayoutGrid, ListChecks, Rows3, Search, Sigma } from "lucide-react";
+import { useEffect, useId, useMemo, useState, useSyncExternalStore } from "react";
 
-import { AnswerSuggestionChips } from "@/components/clinical-dashboard/answer-suggestion-chips";
 import {
-  PhoneFooterLayerPortal,
-  usePhoneFooterLayerScrollHidden,
-} from "@/components/clinical-dashboard/phone-footer-layer-portal";
+  ResultFilterSheet,
+  ResultFilterTrigger,
+  resultFilterFacetGroup,
+  resultFilterGroup,
+} from "@/components/clinical-dashboard/result-filter-control";
+import { useSearchCommand } from "@/components/clinical-dashboard/search-command-context";
 import { SearchResultsLayout } from "@/components/clinical-dashboard/search-results-layout";
-import { useHideOnScroll, useReserveTransitionMarker } from "@/components/clinical-dashboard/use-hide-on-scroll";
-import { PrivacyInputNotice } from "@/components/privacy-input-notice";
 import {
-  chatComposerInput,
-  chatComposerShellBase,
-  chatSendButton,
-  cn,
-  eyebrowText,
-  ignoreUnavailableActivation,
-} from "@/components/ui-primitives";
+  SearchResultsEmptyState,
+  SearchResultsHeaderBand,
+  type AppliedFilterChip,
+} from "@/components/clinical-dashboard/search-results-header-band";
+import { cn, eyebrowText } from "@/components/ui-primitives";
+import { appModeHomeHref } from "@/lib/app-modes";
 
+import {
+  calculatorDomainCandidateCount,
+  calculatorProgressCandidateCount,
+  calculatorTimeCandidateCount,
+  filterCalculatorRecords,
+  normalizeCalculatorQuery,
+  type CalculatorFilterState,
+  type CalculatorProgressFilter,
+  type CalculatorTimeFilter,
+} from "./calculator-filters";
 import {
   calculators,
-  domainIcons,
   domainLabels,
   domainOrder,
   plannedCalculators,
   type CalculatorDomain,
   type CalculatorFixture,
 } from "./calculator-fixtures";
+import { CalculatorSheet } from "./calculator-sheet";
 import {
   MetaPill,
   SeverityPill,
@@ -54,12 +49,30 @@ import {
   type AnswerMap,
   type DerivedCalculator,
 } from "./calculator-ui";
-import { CalculatorSheet } from "./calculator-sheet";
 
-type DomainFilter = CalculatorDomain | "all";
 type SessionAnswers = Record<string, AnswerMap>;
 type Density = "comfortable" | "compact";
 
+const subscribeNoop = () => () => undefined;
+
+const progressOptions: ReadonlyArray<{ value: CalculatorProgressFilter; label: string }> = [
+  { value: "all", label: "Any" },
+  { value: "not-started", label: "Not started" },
+  { value: "in-progress", label: "In progress" },
+  { value: "completed", label: "Completed" },
+];
+
+const timeOptions: ReadonlyArray<{ value: CalculatorTimeFilter; label: string }> = [
+  { value: "all", label: "Any" },
+  { value: "quick", label: "2 minutes or less" },
+  { value: "standard", label: "3–4 minutes" },
+  { value: "extended", label: "5+ minutes" },
+];
+
+function optionLabel<Value extends string>(options: ReadonlyArray<{ value: Value; label: string }>, value: Value) {
+  return options.find((option) => option.value === value)?.label ?? value;
+}
+
 /** Match context: name / indication hit, or the first matching item text. */
 function matchContext(calc: CalculatorFixture, query: string): string | null {
   if (!query) return null;
@@ -67,126 +80,6 @@ function matchContext(calc: CalculatorFixture, query: string): string | null {
   return item ? item.text : null;
 }
 
-function matches(calc: CalculatorFixture, query: string): boolean {
-  if (!query) return true;
-  const haystack = [calc.abbrev, calc.name, calc.indication, calc.summary, domainLabels[calc.domain]]
-    .join(" ")
-    .toLowerCase();
-  return haystack.includes(query) || calc.items.some((item) => item.text.toLowerCase().includes(query));
-}
-
-/* ---------- universal-style search composer (top on desktop, docked bottom on phones) ---------- */
-
-// Example searches shown in the composer prompt row; each filters the list.
-const promptExamples = ["depression", "anxiety", "drinking", "bipolar", "suicide"];
-
-/**
- * The calculators search composer, matching the app's universal composer: a
- * leading "+" (new search), the query input with an inline clear, and the teal
- * send button. `variant="full"` adds the Smart-search hint, prompt chips, and
- * privacy notice (desktop header); `variant="compact"` shows the pill plus the
- * privacy line only (phone bottom dock).
- */
-function CalculatorComposer({
-  query,
-  onQuery,
-  onReset,
-  onSubmit,
-  variant,
-}: {
-  query: string;
-  onQuery: (value: string) => void;
-  onReset: () => void;
-  onSubmit: () => void;
-  variant: "full" | "compact";
-}) {
-  return (
-    <div className="grid gap-2">
-      {variant === "full" ? (
-        <div className="smart-search-rotating-text" aria-live="polite">
-          <span>Smart search</span>
-          <span aria-hidden="true">·</span>
-          <span>
-            Try <span className="smart-search-rotating-query">&ldquo;depression severity&rdquo;</span> in Calculators.
-          </span>
-        </div>
-      ) : null}
-
-      <form
-        role="search"
-        onSubmit={(event) => {
-          event.preventDefault();
-          onSubmit();
-        }}
-        className={cn(chatComposerShellBase, "answer-footer-search-pill relative z-10 w-full")}
-      >
-        <button
-          type="button"
-          onClick={onReset}
-          aria-label="New search"
-          title="New search"
-          className={cn(
-            "answer-footer-search-action grid shrink-0 place-items-center rounded-full transition hover:bg-[color:var(--surface-subtle)] hover:text-[color:var(--clinical-accent)]",
-            focusRing,
-          )}
-        >
-          <Plus className="h-5 w-5" aria-hidden="true" />
-        </button>
-
-        <label className="flex min-w-0 flex-1 items-center overflow-hidden">
-          <input
-            type="search"
-            value={query}
-            enterKeyHint="search"
-            onChange={(event) => onQuery(event.target.value)}
-            placeholder="Search calculators by scale, symptom, or indication"
-            aria-label="Search calculators"
-            className={cn(chatComposerInput, "answer-footer-search-input w-full min-w-0")}
-          />
-          {query ? (
-            <button
-              type="button"
-              onClick={() => onQuery("")}
-              aria-label="Clear search"
-              className="grid size-tap shrink-0 place-items-center rounded-full text-[color:var(--text-muted)] transition hover:bg-[color:var(--surface-subtle)] hover:text-[color:var(--text)]"
-            >
-              <X className="h-4 w-4" aria-hidden="true" />
-            </button>
-          ) : null}
-        </label>
-
-        <span className="answer-footer-search-divider" aria-hidden="true" />
-
-        <button
-          type="submit"
-          aria-label="Search calculators"
-          className={cn(chatSendButton, "answer-footer-search-send")}
-        >
-          <Send className="size-icon-lg" aria-hidden="true" />
-        </button>
-      </form>
-
-      {variant === "full" ? (
-        <AnswerSuggestionChips
-          suggestions={promptExamples}
-          onPick={onQuery}
-          label="Prompts"
-          layout="scroll"
-          className="smart-search-prompt-row"
-          testId="calculator-prompt-row"
-        />
-      ) : null}
-
-      {/* Cancel the shared notice's phone -mb-4 reclaim: this composer is a
-          fixed dock, and the overhang would clip the link's focus ring below
-          the viewport when safe-area inset is zero. */}
-      <PrivacyInputNotice className="justify-center [&_a]:mb-0" />
-    </div>
-  );
-}
-
-/* ---------- home-page-style calculator tile ---------- */
-
 function CalculatorTile({
   calc,
   derived,
@@ -262,144 +155,40 @@ function CalculatorTile({
   );
 }
 
-/* ---------- results header band (count + eyebrow + controls) ---------- */
-
-function ResultsHeaderBand({
-  count,
-  query,
-  density,
-  onDensity,
-}: {
-  count: number;
-  query: string;
-  density: Density;
-  onDensity: (next: Density) => void;
-}) {
+function DensityControl({ density, onDensity }: { density: Density; onDensity: (next: Density) => void }) {
   return (
-    <div className="overflow-hidden rounded-lg border border-[color:var(--border)] bg-[color:var(--surface)] shadow-[var(--e1)]">
-      <div className="flex items-start justify-between gap-3 bg-[color:var(--surface-chrome)] p-3 sm:p-4">
-        <div className="grid min-w-0 flex-1 grid-cols-1 items-start gap-3 sm:grid-cols-[3.25rem_minmax(0,1fr)]">
-          <span className="hidden size-12 place-items-center rounded-lg border border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)] shadow-[var(--shadow-inset)] sm:grid">
-            <span className="font-mono text-xl font-extrabold leading-none tabular-nums">{count}</span>
-          </span>
-          <div className="min-w-0">
-            <p className={cn(eyebrowText, "hidden text-[color:var(--clinical-accent)] sm:block")}>
-              Clinical calculators
-            </p>
-            <h1 className="text-2xl-minus font-extrabold leading-tight tracking-tight text-[color:var(--text-heading)] sm:mt-0.5 sm:text-3xl">
-              {count} {count === 1 ? "calculator" : "calculators"}
-            </h1>
-            <p className="mt-1 max-w-2xl text-sm font-medium leading-5 text-[color:var(--text-muted)]">
-              {query ? (
-                <>
-                  Matching “<span className="font-semibold text-[color:var(--text)]">{query}</span>”. Open one to score
-                  it and see next actions.
-                </>
-              ) : (
-                "Validated psychiatry scores. Open one to score it and see score-linked next actions."
-              )}
-            </p>
-          </div>
-        </div>
-        <div className="hidden shrink-0 items-center rounded-lg border border-[color:var(--border)] bg-[color:var(--surface)] p-0.5 shadow-[var(--shadow-inset)] sm:inline-flex">
-          {(
-            [
-              ["comfortable", LayoutGrid, "Comfortable"],
-              ["compact", Rows3, "Compact"],
-            ] as const
-          ).map(([value, DensityIcon, label]) => {
-            const active = density === value;
-            return (
-              <button
-                key={value}
-                type="button"
-                aria-pressed={active}
-                aria-label={label}
-                onClick={() => onDensity(value)}
-                className={cn(
-                  "grid size-9 place-items-center rounded-md transition",
-                  active
-                    ? "bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)]"
-                    : "text-[color:var(--text-muted)] hover:text-[color:var(--text)]",
-                  focusRing,
-                )}
-              >
-                <DensityIcon className="size-icon-md" aria-hidden="true" />
-              </button>
-            );
-          })}
-        </div>
-      </div>
+    <div
+      className="inline-flex shrink-0 items-center rounded-lg border border-[color:var(--border)] bg-[color:var(--surface)] p-0.5 shadow-[var(--shadow-inset)]"
+      aria-label="Calculator result density"
+    >
+      {(
+        [
+          ["comfortable", LayoutGrid, "Comfortable"],
+          ["compact", Rows3, "Compact"],
+        ] as const
+      ).map(([value, Icon, label]) => (
+        <button
+          key={value}
+          type="button"
+          aria-pressed={density === value}
+          aria-label={`${label} density`}
+          title={`${label} density`}
+          onClick={() => onDensity(value)}
+          className={cn(
+            "grid size-9 place-items-center rounded-md transition motion-reduce:transition-none",
+            density === value
+              ? "bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)]"
+              : "text-[color:var(--text-muted)] hover:text-[color:var(--text)]",
+            focusRing,
+          )}
+        >
+          <Icon className="size-icon-md" aria-hidden="true" />
+        </button>
+      ))}
     </div>
   );
 }
 
-/* ---------- right rail ---------- */
-
-function DomainNav({
-  domain,
-  counts,
-  onSelect,
-}: {
-  domain: DomainFilter;
-  counts: Record<string, number>;
-  onSelect: (next: DomainFilter) => void;
-}) {
-  const rows: { id: DomainFilter; label: string; icon: typeof Calculator }[] = [
-    { id: "all", label: "All calculators", icon: Calculator },
-    ...domainOrder.map((entry) => ({
-      id: entry as DomainFilter,
-      label: domainLabels[entry],
-      icon: domainIcons[entry],
-    })),
-  ];
-
-  return (
-    <section className="rounded-lg border border-[color:var(--border)] bg-[color:var(--surface)] p-3 shadow-[var(--e1)]">
-      <h2 className={cn(eyebrowText, "px-1 pb-2 text-[color:var(--text-muted)]")}>Browse by domain</h2>
-      <div className="grid gap-1">
-        {rows.map((row) => {
-          const active = domain === row.id;
-          const RowIcon = row.icon;
-          const count = row.id === "all" ? calculators.length : (counts[row.id] ?? 0);
-          return (
-            <button
-              key={row.id}
-              type="button"
-              aria-pressed={active}
-              onClick={() => onSelect(row.id)}
-              className={cn(
-                "grid min-h-tap grid-cols-[auto_minmax(0,1fr)_auto] items-center gap-2.5 rounded-lg border px-2.5 text-left transition",
-                active
-                  ? "border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)]"
-                  : "border-transparent hover:bg-[color:var(--surface-subtle)]",
-                focusRing,
-              )}
-            >
-              <RowIcon
-                className={cn(
-                  "size-icon-md",
-                  active ? "text-[color:var(--clinical-accent)]" : "text-[color:var(--text-muted)]",
-                )}
-                aria-hidden="true"
-              />
-              <span
-                className={cn(
-                  "truncate text-sm-minus font-bold",
-                  active ? "text-[color:var(--clinical-accent)]" : "text-[color:var(--text-heading)]",
-                )}
-              >
-                {row.label}
-              </span>
-              <span className="font-mono text-2xs font-bold tabular-nums text-[color:var(--text-muted)]">{count}</span>
-            </button>
-          );
-        })}
-      </div>
-    </section>
-  );
-}
-
 function ContinuePanel({
   inProgress,
   onOpen,
@@ -463,45 +252,48 @@ function AboutPanel() {
   );
 }
 
-/* ---------- page ---------- */
-
-const filterChips: { id: DomainFilter; label: string }[] = [
-  { id: "all", label: "All" },
-  ...domainOrder.map((domain) => ({ id: domain as DomainFilter, label: domainLabels[domain] })),
-];
-
-export function CalculatorsSearchPage() {
-  const [query, setQuery] = useState("");
-  const [domain, setDomain] = useState<DomainFilter>("all");
+export function CalculatorsSearchPage({ initialQuery = "" }: { initialQuery?: string }) {
+  const router = useRouter();
+  const searchCommand = useSearchCommand();
+  const hydrated = useSyncExternalStore(
+    subscribeNoop,
+    () => true,
+    () => false,
+  );
+  const query = hydrated ? (searchCommand?.query ?? initialQuery) : initialQuery;
+  const normalizedQuery = normalizeCalculatorQuery(query);
+  const filterPanelId = useId();
+  const [filterOpen, setFilterOpen] = useState(false);
+  const [selectedDomains, setSelectedDomains] = useState<ReadonlySet<CalculatorDomain>>(new Set());
+  const [progress, setProgress] = useState<CalculatorProgressFilter>("all");
+  const [time, setTime] = useState<CalculatorTimeFilter>("all");
   const [density, setDensity] = useState<Density>("comfortable");
   const [session, setSession] = useState<SessionAnswers>({});
   const [openId, setOpenId] = useState<string | null>(null);
 
-  const trimmed = query.trim().toLowerCase();
-
-  const domainCounts = useMemo(() => {
-    const counts: Record<string, number> = {};
-    for (const calc of calculators) counts[calc.domain] = (counts[calc.domain] ?? 0) + 1;
-    return counts;
-  }, []);
-
-  const results = useMemo(
+  const records = useMemo(
     () =>
-      calculators
-        .filter((calc) => (domain === "all" || calc.domain === domain) && matches(calc, trimmed))
-        .map((calc) => ({ calc, context: matchContext(calc, trimmed) })),
-    [domain, trimmed],
+      calculators.map((calc) => ({
+        calc,
+        derived: deriveCalculator(calc, session[calc.id] ?? {}),
+      })),
+    [session],
   );
-
-  const inProgress = useMemo(
+  const filters = useMemo<CalculatorFilterState>(
+    () => ({ domains: selectedDomains, progress, time }),
+    [progress, selectedDomains, time],
+  );
+  const results = useMemo(
     () =>
-      calculators
-        .map((calc) => ({ calc, derived: deriveCalculator(calc, session[calc.id] ?? {}) }))
-        .filter((entry) => entry.derived.started),
-    [session],
+      filterCalculatorRecords(records, query, filters).map((record) => ({
+        ...record,
+        context: matchContext(record.calc, normalizedQuery),
+      })),
+    [filters, normalizedQuery, query, records],
   );
-
+  const inProgress = useMemo(() => records.filter((record) => record.derived.started), [records]);
   const activeCalc = openId ? calculators.find((calc) => calc.id === openId) : undefined;
+  const activeFilterCount = selectedDomains.size + (progress === "all" ? 0 : 1) + (time === "all" ? 0 : 1);
 
   useEffect(() => {
     if (!activeCalc) return;
@@ -516,224 +308,192 @@ export function CalculatorsSearchPage() {
     };
   }, [activeCalc]);
 
-  // The viewport frame owns the authoritative hide decision for its header and
-  // every portaled footer. Reuse that signal so slower hydration/RAF scheduling
-  // cannot let independently evaluated header and calculator reporters split.
-  // Keep local reporters only for the shell-less fallback used by isolated
-  // renders; browser phones scroll the document while standalone mode scrolls
-  // #main-content.
-  const frameScrollHidden = usePhoneFooterLayerScrollHidden();
-  const useLocalScrollFallback = frameScrollHidden === undefined;
-  const scrollContainerRef = useRef<HTMLElement | null>(null);
-  useEffect(() => {
-    scrollContainerRef.current = document.querySelector<HTMLElement>("#main-content");
-  }, []);
-  const innerFooterHidden = useHideOnScroll({
-    containerRef: scrollContainerRef,
-    disabled: !useLocalScrollFallback,
+  function toggleDomain(domain: CalculatorDomain) {
+    setSelectedDomains((current) => {
+      const next = new Set(current);
+      if (next.has(domain)) next.delete(domain);
+      else next.add(domain);
+      return next;
+    });
+  }
+
+  function clearFilters() {
+    setSelectedDomains(new Set());
+    setProgress("all");
+    setTime("all");
+  }
+
+  const domainGroup = resultFilterFacetGroup({
+    id: "clinical-domain",
+    label: "Clinical domain",
+    selected: selectedDomains,
+    options: domainOrder.map((domain) => {
+      const count = calculatorDomainCandidateCount(records, query, filters, domain);
+      return {
+        value: domain,
+        label: domainLabels[domain],
+        hint: String(count),
+        disabled: count === 0 && !selectedDomains.has(domain),
+      };
+    }),
+    onToggle: toggleDomain,
   });
-  const documentFooterHidden = useHideOnScroll({
-    documentCollapseRootRef: scrollContainerRef,
-    disabled: !useLocalScrollFallback,
+  const progressGroup = resultFilterGroup({
+    id: "session-progress",
+    label: "Session progress",
+    value: progress,
+    options: progressOptions.map((option) => {
+      const count = calculatorProgressCandidateCount(records, query, filters, option.value);
+      return {
+        ...option,
+        hint: String(count),
+        disabled: count === 0 && progress !== option.value,
+      };
+    }),
+    onChange: setProgress,
+    note: "one only",
+  });
+  const timeGroup = resultFilterGroup({
+    id: "completion-time",
+    label: "Completion time",
+    value: time,
+    options: timeOptions.map((option) => {
+      const count = calculatorTimeCandidateCount(records, query, filters, option.value);
+      return {
+        ...option,
+        hint: String(count),
+        disabled: count === 0 && time !== option.value,
+      };
+    }),
+    onChange: setTime,
+    note: "one only",
   });
-  const footerHidden = frameScrollHidden ?? (innerFooterHidden || documentFooterHidden);
-  // Keep the phone dock visible while focused so scroll-hide cannot slide a
-  // focused input off-screen or mark it aria-hidden while still tabbable.
-  const [dockFocused, setDockFocused] = useState(false);
-  const dockHidden = footerHidden && !dockFocused;
-  const reserveTransitioning = useReserveTransitionMarker(dockHidden, activeCalc);
-  useEffect(() => {
-    if (!activeCalc) return;
-    // Submitting a focused dock input unmounts the dock before React is
-    // guaranteed to dispatch blur. Clear the latch after teardown so the dock
-    // can resume hide-on-scroll when the calculator sheet closes. This reset
-    // must survive a fast close: cancelling the microtask during effect cleanup
-    // can otherwise leave the remounted dock permanently focus-pinned.
-    queueMicrotask(() => {
-      setDockFocused(false);
-    });
-  }, [activeCalc]);
-
-  const compact = density === "compact";
-
-  const submitSearch = () => {
-    if (results.length === 1) setOpenId(results[0].calc.id);
-  };
 
-  const resetSearch = () => {
-    setQuery("");
-    setDomain("all");
-  };
+  const appliedFilters: AppliedFilterChip[] = [
+    ...domainOrder
+      .filter((domain) => selectedDomains.has(domain))
+      .map((domain) => ({
+        id: `domain-${domain}`,
+        label: `Clinical domain: ${domainLabels[domain]}`,
+        onRemove: () => toggleDomain(domain),
+      })),
+    ...(progress === "all"
+      ? []
+      : [
+          {
+            id: `progress-${progress}`,
+            label: `Session progress: ${optionLabel(progressOptions, progress)}`,
+            onRemove: () => setProgress("all"),
+          },
+        ]),
+    ...(time === "all"
+      ? []
+      : [
+          {
+            id: `time-${time}`,
+            label: `Completion time: ${optionLabel(timeOptions, time)}`,
+            onRemove: () => setTime("all"),
+          },
+        ]),
+  ];
 
   return (
     <>
       <SearchResultsLayout
         testId="calculators-search-page"
-        resultsLabel="Calculators"
-        reserveOwner="calculator"
-        reserveHiddenPad="0rem"
-        reserveTransitioning={reserveTransitioning}
-        // Page-owned phone dock: shell composer is hidden, so clear space here.
-        // Collapse with the dock on scroll-hide so content reaches the viewport edge.
-        className={cn(
-          !dockHidden &&
-            !activeCalc &&
-            "max-sm:pb-[calc(5.5rem+var(--safe-area-bottom))] max-sm:[--phone-focus-bottom-clearance:calc(9rem+var(--safe-area-bottom))]",
-          dockHidden && "max-sm:pb-0",
-        )}
+        resultsLabel="Calculator results"
         header={
-          <div className="grid min-w-0 grid-cols-[minmax(0,1fr)] gap-3">
-            {/* Desktop: universal-style composer at the top, matching the site-wide
-                search header. Phones get the docked bottom composer below. */}
-            <div className="hidden sm:block">
-              <CalculatorComposer
-                query={query}
-                onQuery={setQuery}
-                onReset={resetSearch}
-                onSubmit={submitSearch}
-                variant="full"
-              />
-            </div>
-
-            <div className="flex items-center gap-2">
-              <div
-                className="flex min-w-0 flex-1 gap-2 overflow-x-auto pb-1 [-ms-overflow-style:none] [scrollbar-width:none] [&::-webkit-scrollbar]:hidden"
-                aria-label="Filter by domain"
-              >
-                {filterChips.map((chip) => {
-                  const active = domain === chip.id;
-                  return (
-                    <button
-                      key={chip.id}
-                      type="button"
-                      aria-pressed={active}
-                      onClick={() => setDomain(chip.id)}
-                      className={cn(
-                        "inline-flex min-h-9 shrink-0 items-center rounded-full border px-3 text-xs font-bold transition",
-                        active
-                          ? "border-[color:var(--clinical-accent)] bg-[color:var(--clinical-accent)] text-[color:var(--clinical-accent-contrast)] shadow-[var(--e1)]"
-                          : "border-[color:var(--border)] bg-[color:var(--surface)] text-[color:var(--text-muted)] hover:bg-[color:var(--surface-subtle)]",
-                        focusRing,
-                      )}
-                    >
-                      {chip.label}
-                    </button>
-                  );
-                })}
-              </div>
-              <button
-                type="button"
-                aria-disabled="true"
-                onClick={ignoreUnavailableActivation}
-                aria-describedby="calculators-filters-unavailable"
-                title="Advanced filters — coming soon"
-                aria-label="Filters"
-                className="inline-flex min-h-9 shrink-0 cursor-not-allowed items-center gap-2 rounded-lg border border-[color:var(--border)] bg-[color:var(--surface)] px-3 text-xs font-bold text-[color:var(--text-muted)] opacity-60 shadow-[var(--shadow-inset)]"
-              >
-                <SlidersHorizontal className="size-icon-sm" aria-hidden="true" />
-                <span className="hidden sm:inline">Filters</span>
-              </button>
-              <span id="calculators-filters-unavailable" className="sr-only">
-                Advanced filters are coming soon.
-              </span>
-            </div>
-          </div>
-        }
-        summary={
-          <ResultsHeaderBand count={results.length} query={query.trim()} density={density} onDensity={setDensity} />
+          <>
+            <SearchResultsHeaderBand
+              modeId="calculators"
+              query={query}
+              matchCount={results.length}
+              headingLevel={1}
+              filterLabel="Filter calculator results"
+              appliedFilters={appliedFilters}
+              onClearFilters={activeFilterCount > 0 ? clearFilters : undefined}
+              mobileControlsPlacement="inline"
+              mobileControls={
+                <ResultFilterTrigger
+                  panelId={filterPanelId}
+                  testId="calculators-filter-trigger-phone"
+                  title="Filter calculators"
+                  open={filterOpen}
+                  activeCount={activeFilterCount}
+                  onToggle={() => setFilterOpen((current) => !current)}
+                />
+              }
+              utilityControls={
+                <span className="hidden items-center gap-2 sm:inline-flex">
+                  <ResultFilterTrigger
+                    panelId={filterPanelId}
+                    testId="calculators-filter-trigger-desktop"
+                    title="Filter calculators"
+                    open={filterOpen}
+                    activeCount={activeFilterCount}
+                    onToggle={() => setFilterOpen((current) => !current)}
+                  />
+                  <DensityControl density={density} onDensity={setDensity} />
+                </span>
+              }
+            />
+            <ResultFilterSheet
+              open={filterOpen}
+              onClose={() => setFilterOpen(false)}
+              panelId={filterPanelId}
+              testId="calculators-filter-sheet"
+              title="Filter calculators"
+              description="Choose any clinical domains, then narrow by session progress and completion time."
+              groups={[domainGroup, progressGroup, timeGroup]}
+              onClearAll={activeFilterCount > 0 ? clearFilters : undefined}
+              footerNote={`${results.length} showing`}
+              chromeResetKey={query}
+            />
+          </>
         }
         sidebar={
           <>
-            <DomainNav domain={domain} counts={domainCounts} onSelect={setDomain} />
             <ContinuePanel inProgress={inProgress} onOpen={setOpenId} />
             <AboutPanel />
           </>
         }
         sidebarMobile={
-          <div className="xl:hidden">
+          <div className="grid gap-4 xl:hidden">
+            <ContinuePanel inProgress={inProgress} onOpen={setOpenId} />
             <AboutPanel />
           </div>
         }
       >
         {results.length ? (
-          <div className={cn("grid gap-3", compact ? "sm:grid-cols-2 xl:grid-cols-3" : "md:grid-cols-2")}>
-            {results.map(({ calc, context }) => (
+          <div className={cn("grid gap-3", density === "compact" ? "sm:grid-cols-2 xl:grid-cols-3" : "md:grid-cols-2")}>
+            {results.map(({ calc, derived, context }) => (
               <CalculatorTile
                 key={calc.id}
                 calc={calc}
-                derived={deriveCalculator(calc, session[calc.id] ?? {})}
+                derived={derived}
                 context={context}
-                compact={compact}
+                compact={density === "compact"}
                 onOpen={() => setOpenId(calc.id)}
               />
             ))}
           </div>
         ) : (
-          <div className="grid justify-items-center gap-2 rounded-lg border border-[color:var(--border)] bg-[color:var(--surface-subtle)] p-8 text-center">
-            <span className="grid size-tap place-items-center rounded-lg border border-[color:var(--border)] bg-[color:var(--surface)] text-[color:var(--decoration-soft)]">
-              <Search className="size-icon-lg" aria-hidden="true" />
-            </span>
-            <p className="text-base font-bold text-[color:var(--text-heading)]">
-              No calculators match “{query.trim()}”.
-            </p>
-            <p className="max-w-sm text-sm-minus font-medium text-[color:var(--text-muted)]">
-              Try a symptom (“hopeless”, “drinking”, “worry”) or clear the filters.
-            </p>
-            <button
-              type="button"
-              onClick={() => {
-                setQuery("");
-                setDomain("all");
-              }}
-              className={cn(
-                "mt-1 inline-flex min-h-10 items-center gap-2 rounded-lg bg-[color:var(--clinical-accent)] px-4 text-sm-minus font-bold text-[color:var(--clinical-accent-contrast)] shadow-[var(--e1)] hover:bg-[color:var(--clinical-accent-hover)]",
-                focusRing,
-              )}
-            >
-              Reset search
-            </button>
-          </div>
+          <SearchResultsEmptyState
+            modeId="calculators"
+            query={query}
+            appliedFilters={appliedFilters}
+            onClearFilters={activeFilterCount > 0 ? clearFilters : undefined}
+            onClearSearch={() => router.push(appModeHomeHref("calculators", { focus: true }))}
+            onTryExample={(example) => router.push(appModeHomeHref("calculators", { query: example, run: true }))}
+          />
         )}
       </SearchResultsLayout>
 
-      {/* Phones: composer docks at the bottom, matching the site-wide composer
-          placement, and slides away on scroll-down in lockstep with the header.
-          Hidden while a calculator sheet is open. */}
-      {activeCalc ? null : (
-        <PhoneFooterLayerPortal>
-          <div
-            data-testid="calculators-phone-dock"
-            data-scroll-hidden={dockHidden ? "true" : undefined}
-            onFocusCapture={() => setDockFocused(true)}
-            onBlurCapture={(event) => {
-              if (!event.currentTarget.contains(event.relatedTarget as Node | null)) setDockFocused(false);
-            }}
-            className={cn(
-              "phone-footer-layer answer-footer-search-dock answer-footer-search-edge inset-x-0 bottom-0 z-40 px-3 pb-[calc(0.75rem+var(--safe-area-bottom))] pt-3 transition-[transform,opacity] motion-reduce:transition-none sm:hidden",
-              dockHidden
-                ? "pointer-events-none duration-[var(--duration-slow)] ease-[var(--ease-chrome-hide)]"
-                : "duration-[var(--duration-moderate)] ease-[var(--ease-chrome-reveal)]",
-            )}
-            aria-hidden={dockHidden}
-            inert={dockHidden || undefined}
-          >
-            <div className="answer-footer-search-backdrop" aria-hidden="true" />
-            <CalculatorComposer
-              query={query}
-              onQuery={setQuery}
-              onReset={resetSearch}
-              onSubmit={submitSearch}
-              variant="compact"
-            />
-          </div>
-        </PhoneFooterLayerPortal>
-      )}
-
       {activeCalc ? (
         <CalculatorSheet
           calc={activeCalc}
           answers={session[activeCalc.id] ?? {}}
-          onAnswersChange={(next) => setSession((prev) => ({ ...prev, [activeCalc.id]: next }))}
+          onAnswersChange={(next) => setSession((current) => ({ ...current, [activeCalc.id]: next }))}
           onClose={() => setOpenId(null)}
           onOpenCalculator={setOpenId}
         />
diff --git a/src/components/clinical-dashboard/ClinicalSidebar.tsx b/src/components/clinical-dashboard/ClinicalSidebar.tsx
index e5d2012b36..ae8cdfd3a0 100644
--- a/src/components/clinical-dashboard/ClinicalSidebar.tsx
+++ b/src/components/clinical-dashboard/ClinicalSidebar.tsx
@@ -84,6 +84,7 @@ const sidebarMoreModeIds = [
   "dsm",
   "specifiers",
   "formulation",
+  "calculators",
   "therapy-compass",
 ] as const satisfies readonly AppModeId[];
 
@@ -183,6 +184,7 @@ function MoreModesMenu({
         returnFocusRef={triggerRef}
         mobilePlacement="bottom"
         mobileSize="content"
+        mobileHeaderSafeArea="padding"
         testId="sidebar-more-modes-sheet"
         contentClassName="max-h-[calc(100dvh-0.5rem)] sm:max-w-md"
         bodyClassName="p-2"
diff --git a/src/components/clinical-dashboard/account-setup-dialog.tsx b/src/components/clinical-dashboard/account-setup-dialog.tsx
index 0a176c50e9..bd3ddac0ac 100644
--- a/src/components/clinical-dashboard/account-setup-dialog.tsx
+++ b/src/components/clinical-dashboard/account-setup-dialog.tsx
@@ -104,6 +104,7 @@ export function AccountSetupDialog({
       onClose={onClose}
       title="Account setup"
       closeLabel="Close account setup"
+      mobileHeaderSafeArea="offset"
       headerClassName="absolute right-3 top-3 z-30 w-auto border-0 bg-transparent p-0 sm:right-4 sm:top-4 sm:p-0"
       titleClassName="sr-only"
       bodyClassName="bg-[color:var(--surface)] p-0 sm:p-0"
@@ -172,7 +173,7 @@ export function AccountSetupDialog({
             busyLabel="Sending link…"
             disabled={actionBusy || !email.trim()}
             idleIcon={<LockKeyhole aria-hidden="true" className="h-4 w-4" />}
-            className={cn(primaryControl, "min-h-tap w-full")}
+            className={cn(primaryControl, "min-h-12 w-full")}
           >
             Continue securely
           </AsyncButton>
@@ -197,19 +198,22 @@ function AccountOrientationPanel() {
     <section
       aria-labelledby="account-workspace-benefits"
       data-testid="account-storage-summary"
-      className="relative isolate flex min-h-0 flex-col overflow-hidden bg-[color:var(--clinical-accent-soft)] px-5 pb-5 pt-6 sm:px-8 sm:py-8 lg:min-h-[36rem] lg:px-10 lg:py-10"
+      className="relative isolate flex min-h-0 flex-col overflow-hidden bg-[color:var(--clinical-accent-soft)] px-5 pb-5 pt-[max(1.5rem,var(--safe-area-top))] sm:px-8 sm:py-8 lg:min-h-[36rem] lg:px-10 lg:py-10"
     >
       <span
         aria-hidden="true"
-        className="pointer-events-none absolute -bottom-32 -left-24 -z-10 h-80 w-[34rem] rounded-[50%] border border-white/50 bg-white/20 forced-colors:hidden"
+        className="pointer-events-none absolute -bottom-32 -left-24 z-0 h-80 w-[34rem] rounded-full border border-[color:var(--border-lux)]/50 bg-[color:var(--surface)]/20 forced-colors:hidden"
       />
       <span
         aria-hidden="true"
-        className="pointer-events-none absolute -bottom-48 -left-12 -z-10 h-80 w-[38rem] rounded-[50%] border border-white/40 bg-white/15 forced-colors:hidden"
+        className="pointer-events-none absolute -bottom-48 -left-12 z-0 h-80 w-[38rem] rounded-full border border-[color:var(--border-lux)]/40 bg-[color:var(--surface)]/15 forced-colors:hidden"
       />
 
-      <div className="pr-12">
-        <span className="grid h-11 w-11 place-items-center rounded-xl border border-[color:var(--border-lux)] bg-[color:var(--surface)] shadow-[var(--shadow-soft),var(--shadow-inset)]">
+      <div className="relative z-10 pr-12">
+        <span
+          data-testid="account-workspace-mark"
+          className="grid size-tap place-items-center rounded-xl border border-[color:var(--border-lux)] bg-[color:var(--surface)] shadow-[var(--e2),var(--shadow-inset)]"
+        >
           <BrandMark className="h-8 w-8" />
         </span>
         <h3
@@ -220,13 +224,13 @@ function AccountOrientationPanel() {
         </h3>
       </div>
 
-      <ul className="mt-5 grid grid-cols-3 gap-2 sm:gap-3 lg:mt-8 lg:grid-cols-1 lg:gap-5">
+      <ul className="relative z-10 mt-5 grid grid-cols-3 gap-2 sm:gap-3 lg:mt-8 lg:grid-cols-1 lg:gap-5">
         {workspaceBenefits.map((benefit) => (
           <WorkspaceBenefitRow key={benefit.label} benefit={benefit} />
         ))}
       </ul>
 
-      <PrivacyFooter className="mt-auto hidden pt-8 lg:flex" />
+      <PrivacyFooter className="relative z-10 mt-auto hidden pt-8 lg:flex" />
     </section>
   );
 }
@@ -236,7 +240,7 @@ function WorkspaceBenefitRow({ benefit }: { benefit: WorkspaceBenefit }) {
 
   return (
     <li className="flex min-w-0 flex-col items-center gap-2 rounded-xl border border-[color:var(--border-lux)] bg-[color:var(--surface)]/55 p-2.5 text-center shadow-[var(--shadow-inset)] sm:p-3 lg:flex-row lg:items-start lg:gap-3 lg:border-0 lg:bg-transparent lg:p-0 lg:text-left lg:shadow-none">
-      <span className="grid h-9 w-9 shrink-0 place-items-center rounded-lg border border-[color:var(--border-lux)] bg-[color:var(--surface)] text-[color:var(--clinical-accent)] shadow-[var(--shadow-soft),var(--shadow-inset)] lg:h-10 lg:w-10">
+      <span className="grid h-9 w-9 shrink-0 place-items-center rounded-lg border border-[color:var(--border-lux)] bg-[color:var(--surface)] text-[color:var(--clinical-accent)] shadow-[var(--e2),var(--shadow-inset)] lg:h-10 lg:w-10">
         <Icon aria-hidden="true" className="h-4 w-4 lg:h-[1.125rem] lg:w-[1.125rem]" />
       </span>
       <span className="min-w-0">
@@ -294,7 +298,7 @@ function ProviderButton({
       data-provider={provider.toLowerCase()}
       className={cn(
         floatingControl,
-        "min-h-tap w-full min-w-0 justify-center gap-2.5 bg-[color:var(--surface-lux)] px-3 shadow-[var(--shadow-inset)]",
+        "min-h-12 w-full min-w-0 justify-center gap-2.5 bg-[color:var(--surface-lux)] px-3 shadow-[var(--shadow-inset)]",
       )}
     >
       {pending ? (
diff --git a/src/components/clinical-dashboard/answer-evidence-preview.tsx b/src/components/clinical-dashboard/answer-evidence-preview.tsx
new file mode 100644
index 0000000000..a576db6794
--- /dev/null
+++ b/src/components/clinical-dashboard/answer-evidence-preview.tsx
@@ -0,0 +1,67 @@
+"use client";
+
+import Link from "next/link";
+import { FileText, ShieldCheck } from "lucide-react";
+
+import { cleanDisplayTitle, compactSourceSnippet } from "@/components/clinical-dashboard/display-text";
+import { sourceResultHref } from "@/components/clinical-dashboard/source-actions";
+import { cn, panelSubtle, textMuted } from "@/components/ui-primitives";
+import type { VerifiedEvidencePreviewUnit } from "@/lib/answer-stream-contract";
+
+const visiblePreviewSourceLimit = 3;
+
+export function AnswerEvidencePreview({ preview }: { preview: VerifiedEvidencePreviewUnit }) {
+  const visibleSources = preview.sources.slice(0, visiblePreviewSourceLimit);
+
+  return (
+    <section
+      aria-labelledby="answer-evidence-preview-title"
+      data-testid="answer-evidence-preview"
+      className={cn(panelSubtle, "overflow-hidden")}
+    >
+      <div className="border-b border-[color:var(--border)] bg-[color:var(--surface-subtle)] px-3 py-3 sm:px-4">
+        <div className="flex items-start gap-2.5">
+          <span className="grid h-8 w-8 shrink-0 place-items-center rounded-lg bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)]">
+            <ShieldCheck aria-hidden="true" className="h-4 w-4" />
+          </span>
+          <div className="min-w-0">
+            <h2 id="answer-evidence-preview-title" className="text-sm font-semibold text-[color:var(--text-heading)]">
+              Selected evidence — answer still being verified
+            </h2>
+            <p className={cn("mt-0.5 text-xs leading-5", textMuted)}>
+              {preview.selectedContextCount} source passage{preview.selectedContextCount === 1 ? "" : "s"} selected. The
+              final answer and source list remain authoritative.
+            </p>
+          </div>
+        </div>
+      </div>
+
+      <div className="grid gap-2 p-3 sm:grid-cols-3 sm:p-4">
+        {visibleSources.map((source, index) => {
+          const title = cleanDisplayTitle(source.title);
+          const snippet = compactSourceSnippet(source.content, { dropTitle: title });
+          return (
+            <Link
+              key={`${source.document_id}:${source.id}`}
+              href={sourceResultHref(source)}
+              aria-label={`Open selected evidence ${index + 1}: ${title}`}
+              className="min-w-0 rounded-lg border border-[color:var(--border)] bg-[color:var(--surface)] p-3 transition hover:border-[color:var(--border-strong)] focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)]"
+            >
+              <div className="flex items-start gap-2">
+                <FileText aria-hidden="true" className="mt-0.5 h-4 w-4 shrink-0 text-[color:var(--clinical-accent)]" />
+                <div className="min-w-0">
+                  <p className="line-clamp-2 text-sm font-semibold text-[color:var(--text-heading)]">{title}</p>
+                  <p className={cn("mt-0.5 text-xs", textMuted)}>
+                    p.{source.page_number ?? "n/a"}
+                    {source.section_heading ? ` · ${cleanDisplayTitle(source.section_heading)}` : ""}
+                  </p>
+                </div>
+              </div>
+              {snippet ? <p className={cn("mt-2 line-clamp-2 text-xs leading-5", textMuted)}>{snippet}</p> : null}
+            </Link>
+          );
+        })}
+      </div>
+    </section>
+  );
+}
diff --git a/src/components/clinical-dashboard/answer-progress.ts b/src/components/clinical-dashboard/answer-progress.ts
index 94858661a7..2bfd194dbd 100644
--- a/src/components/clinical-dashboard/answer-progress.ts
+++ b/src/components/clinical-dashboard/answer-progress.ts
@@ -1,4 +1,5 @@
 import type { PublicAnswerProgressEvent, PublicAnswerProgressStage } from "@/lib/answer-progress-public";
+import { isDeliverableVerifiedUnit } from "@/lib/answer-stream-contract";
 
 export type AnswerProgressUpdate = PublicAnswerProgressEvent;
 export type TimedAnswerProgressUpdate = AnswerProgressUpdate & { receivedAt: number };
@@ -41,7 +42,10 @@ function finiteCount(value: unknown) {
   return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.floor(value) : undefined;
 }
 
-export function normalizeAnswerProgressEvent(data: unknown): AnswerProgressUpdate | null {
+export function normalizeAnswerProgressEvent(
+  data: unknown,
+  lastVerifiedUnitSequence: number | null = null,
+): AnswerProgressUpdate | null {
   if (typeof data === "string" && data.trim()) {
     const message = data.trim();
     return { stage: inferLegacyStage(message), message };
@@ -55,10 +59,14 @@ export function normalizeAnswerProgressEvent(data: unknown): AnswerProgressUpdat
     typeof value.stage === "string" && answerProgressStages.has(value.stage as PublicAnswerProgressStage)
       ? (value.stage as PublicAnswerProgressStage)
       : inferLegacyStage(message);
+  const verifiedUnit = isDeliverableVerifiedUnit(value.verifiedUnit, lastVerifiedUnitSequence)
+    ? value.verifiedUnit
+    : undefined;
 
   return {
     stage,
     message,
+    ...(verifiedUnit === undefined ? {} : { verifiedUnit }),
     resultCount: finiteCount(value.resultCount),
     selectedContextCount: finiteCount(value.selectedContextCount),
     australianSourceCount: finiteCount(value.australianSourceCount),
diff --git a/src/components/clinical-dashboard/answer-request.ts b/src/components/clinical-dashboard/answer-request.ts
new file mode 100644
index 0000000000..7452d1483e
--- /dev/null
+++ b/src/components/clinical-dashboard/answer-request.ts
@@ -0,0 +1,94 @@
+import type { AnswerProgressUpdate } from "@/components/clinical-dashboard/answer-progress";
+import {
+  answerTimedOutError,
+  compactScopeFilters,
+  isAbortError,
+} from "@/components/clinical-dashboard/clinical-dashboard-helpers";
+import { makeSearchError, readAnswerStream } from "@/components/clinical-dashboard/search-utils";
+import { parseApiErrorResponse } from "@/lib/api-client-error";
+import type { VerifiedEvidencePreviewUnit } from "@/lib/answer-stream-contract";
+import type { SearchScopeFilters } from "@/lib/search-scope";
+import type { ClinicalQueryMode } from "@/lib/types";
+
+type AnswerRequestOptions = {
+  queryText: string;
+  filters: SearchScopeFilters;
+  queryMode: ClinicalQueryMode;
+  selectedDocumentIds: string[];
+  clientDemoMode: boolean;
+  authorizationHeader: Record<string, string>;
+  onProgress: (progress: AnswerProgressUpdate) => void;
+  onEvidencePreview: (preview: VerifiedEvidencePreviewUnit | null) => void;
+  signal?: AbortSignal;
+  onStreamActivity?: () => void;
+  timedOut: () => boolean;
+  onSessionExpired: () => void;
+  networkFailure: () => Error;
+};
+
+/** Execute the dashboard answer-stream HTTP contract without growing the dashboard component. */
+export async function requestAnswerStream({
+  queryText,
+  filters,
+  queryMode,
+  selectedDocumentIds,
+  clientDemoMode,
+  authorizationHeader,
+  onProgress,
+  onEvidencePreview,
+  signal,
+  onStreamActivity,
+  timedOut,
+  onSessionExpired,
+  networkFailure,
+}: AnswerRequestOptions) {
+  let response: Response;
+  try {
+    response = await fetch("/api/answer/stream", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        ...(clientDemoMode ? {} : authorizationHeader),
+      },
+      body: JSON.stringify({
+        query: queryText,
+        documentIds: selectedDocumentIds.length > 0 ? selectedDocumentIds : undefined,
+        filters: compactScopeFilters(filters),
+        queryMode,
+      }),
+      signal,
+    });
+  } catch (error) {
+    if (timedOut()) throw answerTimedOutError();
+    if (isAbortError(error)) throw error;
+    throw networkFailure();
+  }
+
+  if (response.status === 401) {
+    onSessionExpired();
+    throw makeSearchError("Search request was not authorized by the server.", 401, false);
+  }
+  if (!response.ok) {
+    throw await parseApiErrorResponse(response);
+  }
+
+  try {
+    const payload = await readAnswerStream(
+      response,
+      onProgress,
+      undefined,
+      undefined,
+      onStreamActivity,
+      onEvidencePreview,
+    );
+    return {
+      kind: "answer" as const,
+      query: queryText,
+      payload,
+    };
+  } catch (error) {
+    if (timedOut()) throw answerTimedOutError();
+    if (isAbortError(error)) throw error;
+    throw error;
+  }
+}
diff --git a/src/components/clinical-dashboard/answer-status.tsx b/src/components/clinical-dashboard/answer-status.tsx
index 6f7ef60bb1..d6e207ec42 100644
--- a/src/components/clinical-dashboard/answer-status.tsx
+++ b/src/components/clinical-dashboard/answer-status.tsx
@@ -197,7 +197,7 @@ function AnswerActivityTrace({ density }: { density: AnswerProgressDensity }) {
     <div
       data-testid="answer-activity-trace"
       data-density={density}
-      className={cn("answer-activity-trace w-full overflow-hidden", compact ? "h-5" : "h-10 sm:h-12")}
+      className={cn("answer-activity-trace relative w-full overflow-hidden", compact ? "h-5" : "h-10 sm:h-12")}
     >
       <svg
         aria-hidden="true"
@@ -218,20 +218,26 @@ function AnswerActivityTrace({ density }: { density: AnswerProgressDensity }) {
           vectorEffect="non-scaling-stroke"
           className="text-[color:var(--clinical-accent)] opacity-25 forced-colors:text-[CanvasText] forced-colors:opacity-100"
         />
-        <path
-          data-slot="answer-activity-trace-sweep"
-          d={answerActivityPath}
-          pathLength="320"
-          fill="none"
-          stroke="currentColor"
-          strokeWidth={compact ? 1.75 : 2}
-          strokeLinecap="round"
-          strokeLinejoin="round"
-          strokeDasharray="36 284"
-          vectorEffect="non-scaling-stroke"
-          className="answer-activity-trace__sweep text-[color:var(--clinical-accent)] forced-colors:text-[Highlight]"
-        />
       </svg>
+      <span
+        aria-hidden="true"
+        data-slot="answer-activity-trace-sweep"
+        className="answer-activity-trace__sweep pointer-events-none absolute inset-0 block"
+      >
+        <svg focusable="false" viewBox="0 0 320 44" preserveAspectRatio="none" className="block size-full">
+          <path
+            d={answerActivityPath}
+            pathLength="320"
+            fill="none"
+            stroke="currentColor"
+            strokeWidth={compact ? 1.75 : 2}
+            strokeLinecap="round"
+            strokeLinejoin="round"
+            vectorEffect="non-scaling-stroke"
+            className="text-[color:var(--clinical-accent)] forced-colors:text-[Highlight]"
+          />
+        </svg>
+      </span>
     </div>
   );
 }
diff --git a/src/components/clinical-dashboard/clinical-dashboard-helpers.ts b/src/components/clinical-dashboard/clinical-dashboard-helpers.ts
index 6feb13cafb..2fbccf95d6 100644
--- a/src/components/clinical-dashboard/clinical-dashboard-helpers.ts
+++ b/src/components/clinical-dashboard/clinical-dashboard-helpers.ts
@@ -16,6 +16,35 @@ import type { ClinicalQueryMode } from "@/lib/clinical-query-mode";
 // `normalizedPollDelay`. Shared with the dashboard's polling loop.
 export const setupRecheckPollMs = 60_000;
 
+/** Keep the retained `/?mode=tools` launcher separate from every other idle mode home. */
+export function shouldShowSharedHome({
+  pathname,
+  mode,
+  submittedUrlRunRequested,
+  hasError,
+  hasAnswer,
+  loading,
+  submittedAnswerSearchActive,
+}: {
+  pathname: string;
+  mode: string | null;
+  submittedUrlRunRequested: boolean;
+  hasError: boolean;
+  hasAnswer: boolean;
+  loading: boolean;
+  submittedAnswerSearchActive: boolean;
+}) {
+  return (
+    pathname === "/" &&
+    mode !== "tools" &&
+    !submittedUrlRunRequested &&
+    !hasError &&
+    !hasAnswer &&
+    !loading &&
+    !submittedAnswerSearchActive
+  );
+}
+
 /**
  * Re-run a Documents search against a relaxed server-side scope.
  *
diff --git a/src/components/clinical-dashboard/dashboard-nav.tsx b/src/components/clinical-dashboard/dashboard-nav.tsx
index 74016390c4..cb2a829e6b 100644
--- a/src/components/clinical-dashboard/dashboard-nav.tsx
+++ b/src/components/clinical-dashboard/dashboard-nav.tsx
@@ -11,8 +11,8 @@ import { type AppModeId, appModeSearchConfig } from "@/lib/app-modes";
 
 const ApplicationsLauncherWorkspace = dynamic(
   () => import("@/components/applications-launcher-page").then((module) => module.ApplicationsLauncherWorkspace),
-  // ssr: false renders nothing server-side, so /tools would otherwise be blank
-  // until this chunk executes.
+  // The retained `/?mode=tools` dashboard alias owns this legacy client-only
+  // launcher. Canonical `/tools` is rendered by ToolsSearchResultsPage.
   { ssr: false, loading: () => <LoadingPanel variant="skeleton" lines={6} label="Loading tools" /> },
 );
 
diff --git a/src/components/clinical-dashboard/differentials-home.tsx b/src/components/clinical-dashboard/differentials-home.tsx
index 48cfd30637..cd6bea2a9c 100644
--- a/src/components/clinical-dashboard/differentials-home.tsx
+++ b/src/components/clinical-dashboard/differentials-home.tsx
@@ -77,6 +77,8 @@ type DifferentialResult = {
   selected: boolean;
   matchLabel: string;
   tags: string[];
+  clinicalCues: string[];
+  nextSteps: string[];
   icon: LucideIcon;
   safety?: string;
 };
@@ -222,6 +224,8 @@ function toDifferentialResult(item: DifferentialSearchResultItem, query: string)
     selected: false,
     matchLabel: item.matchLabel,
     tags: item.tags.map(tagText),
+    clinicalCues: item.clinicalCues.map(tagText),
+    nextSteps: item.nextSteps,
     icon: resultIcon(item.kind, item.slug),
     safety: item.safety,
   };
@@ -248,8 +252,9 @@ function StatusBadge({ status, className }: { status: DifferentialRecord["status
 type KindFilter = "all" | "presentation" | "diagnosis";
 
 function MatchBadge({ label }: { label: string }) {
-  // Match quality is a relevance signal, not a safety one — keep it in the
-  // accent family so red stays reserved for the emergent status badges.
+  // Match quality is a relevance signal, not a source-verification or safety
+  // signal. Keep it in the accent family while red remains reserved for
+  // emergent clinical status.
   const tone =
     label === "Best match" || label === "High match"
       ? "text-[color:var(--clinical-accent)]"
@@ -307,13 +312,11 @@ function SelectionCheckbox({ selected, onChange, label }: { selected: boolean; o
 function DesktopResultRow({
   result,
   index,
-  isBest,
   selected,
   onToggle,
 }: {
   result: DifferentialResult;
   index: number;
-  isBest: boolean;
   selected: boolean;
   onToggle?: () => void;
 }) {
@@ -321,31 +324,13 @@ function DesktopResultRow({
 
   return (
     <article
-      className={cn(
-        "group grid min-h-[5.75rem] grid-cols-[2.75rem_4.25rem_minmax(0,1fr)_7rem_var(--spacing-tap)] items-center gap-3 rounded-lg border bg-[color:var(--surface)] px-3.5 py-3 shadow-[var(--shadow-inset)] transition",
-        isBest
-          ? "border-[color:var(--danger-border)] bg-[color:var(--danger-soft)]/40 shadow-[var(--e1)]"
-          : "border-[color:var(--border)] hover:border-[color:var(--clinical-accent-border)] hover:shadow-[var(--shadow-soft)]",
-      )}
+      data-testid="differential-compact-result"
+      className="group grid min-h-[5.75rem] grid-cols-[2.75rem_4.25rem_minmax(0,1fr)_7rem_var(--spacing-tap)] items-center gap-3 rounded-lg border border-[color:var(--border)] bg-[color:var(--surface)] px-3.5 py-3 shadow-[var(--shadow-inset)] transition hover:border-[color:var(--clinical-accent-border)] hover:shadow-[var(--shadow-soft)]"
     >
-      <span
-        className={cn(
-          "grid h-8 w-8 place-items-center rounded-md border text-sm font-extrabold",
-          isBest
-            ? "border-[color:var(--danger-border)] bg-[color:var(--danger-soft)] text-[color:var(--danger)]"
-            : "border-[color:var(--border)] bg-[color:var(--surface-subtle)] text-[color:var(--text-muted)]",
-        )}
-      >
+      <span className="grid h-8 w-8 place-items-center rounded-md border border-[color:var(--border)] bg-[color:var(--surface-subtle)] text-sm font-extrabold text-[color:var(--text-muted)]">
         {index + 1}
       </span>
-      <span
-        className={cn(
-          "grid h-14 w-14 place-items-center rounded-lg border transition group-hover:border-[color:var(--clinical-accent-border)]",
-          isBest
-            ? "border-[color:var(--danger-border)] bg-[color:var(--surface)] text-[color:var(--danger)]"
-            : "border-[color:var(--border)] bg-[color:var(--surface-raised)] text-[color:var(--text-muted)]",
-        )}
-      >
+      <span className="grid h-14 w-14 place-items-center rounded-lg border border-[color:var(--border)] bg-[color:var(--surface-raised)] text-[color:var(--text-muted)] transition group-hover:border-[color:var(--clinical-accent-border)]">
         <Icon className="h-7 w-7 stroke-[1.75]" aria-hidden />
       </span>
       <div className="min-w-0">
@@ -367,11 +352,14 @@ function DesktopResultRow({
             {result.subtitle}
           </p>
         </Link>
-        <div className="mt-2 flex max-w-full flex-wrap gap-1.5">
-          {result.tags.slice(0, 4).map((tag) => (
-            <Chip key={`${result.id}-${tag}`}>{tag}</Chip>
+        <p className="mt-2 text-2xs font-extrabold uppercase tracking-eyebrow text-[color:var(--text-muted)]">
+          Clinical cues
+        </p>
+        <div className="mt-1 flex max-w-full flex-wrap gap-1.5">
+          {result.clinicalCues.slice(0, 4).map((tag, cueIndex) => (
+            <Chip key={`${result.id}-cue-${cueIndex}-${tag}`}>{tag}</Chip>
           ))}
-          {result.tags.length > 4 ? <Chip>{`+${result.tags.length - 4}`}</Chip> : null}
+          {result.clinicalCues.length > 4 ? <Chip>{`+${result.clinicalCues.length - 4}`}</Chip> : null}
         </div>
       </div>
       <div className="grid min-h-10 place-items-center border-l border-[color:var(--border)] pl-3">
@@ -426,79 +414,137 @@ function MobileResultCard({
         ) : null}
       </Link>
       {onToggle ? <SelectionCheckbox selected={selected} onChange={onToggle} label={result.title} /> : <span />}
-      <div className="col-span-2 col-start-2 flex min-w-0 max-w-full flex-wrap gap-1.5">
-        {result.tags.slice(0, 2).map((tag) => (
-          <Chip key={`${result.id}-${tag}`}>{tag}</Chip>
-        ))}
-        {result.tags.length > 2 ? <Chip fixed>{`+${result.tags.length - 2}`}</Chip> : null}
+      <div className="col-span-2 col-start-2 min-w-0">
+        <p className="text-2xs font-extrabold uppercase tracking-eyebrow text-[color:var(--text-muted)]">
+          Clinical cues
+        </p>
+        <div className="mt-1 flex min-w-0 max-w-full flex-wrap gap-1.5">
+          {result.clinicalCues.slice(0, 2).map((tag, cueIndex) => (
+            <Chip key={`${result.id}-cue-${cueIndex}-${tag}`}>{tag}</Chip>
+          ))}
+          {result.clinicalCues.length > 2 ? <Chip fixed>{`+${result.clinicalCues.length - 2}`}</Chip> : null}
+        </div>
       </div>
     </article>
   );
 }
 
+function conciseCueText(cues: string[]) {
+  return cues
+    .map((cue) => cue.trim())
+    .filter(Boolean)
+    .reduce<string[]>((visible, cue) => {
+      const normalizedCue = cue.toLowerCase();
+      if (visible.some((existing) => existing.toLowerCase().includes(normalizedCue))) return visible;
+      return [...visible.filter((existing) => !normalizedCue.includes(existing.toLowerCase())), cue];
+    }, [])
+    .join(" · ");
+}
+
+function BestMatchReasoningPanel({ result, compact }: { result: DifferentialResult; compact: boolean }) {
+  const sections = [
+    { label: "Why considered", value: result.subtitle, icon: Check },
+    { label: "Look for", value: conciseCueText(result.clinicalCues), icon: Activity },
+    { label: "Check next", value: result.nextSteps.join(" · "), icon: FlaskConical },
+  ].filter((section) => section.value.trim());
+
+  if (sections.length === 0) return null;
+
+  return (
+    <div
+      data-testid="differential-best-match-panel"
+      className={cn(
+        "overflow-hidden rounded-lg border bg-[color:var(--surface)]/85",
+        "border-[color:var(--clinical-accent-border)]",
+        compact
+          ? "divide-y divide-[color:var(--clinical-accent-border)]"
+          : "grid divide-x divide-[color:var(--clinical-accent-border)]",
+      )}
+      style={!compact ? { gridTemplateColumns: `repeat(${sections.length}, minmax(0, 1fr))` } : undefined}
+    >
+      {sections.map((section) => {
+        const Icon = section.icon;
+        return (
+          <div key={section.label} className="grid grid-cols-[1.75rem_minmax(0,1fr)] gap-2.5 px-3 py-3">
+            <span className="grid h-7 w-7 place-items-center rounded-full bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)]">
+              <Icon className="size-icon-sm stroke-[2.25]" aria-hidden />
+            </span>
+            <div className="min-w-0">
+              <p className="text-2xs font-extrabold uppercase tracking-eyebrow text-[color:var(--clinical-accent)]">
+                {section.label}
+              </p>
+              <p className="mt-1 text-xs font-semibold leading-5 text-[color:var(--text-heading)]">{section.value}</p>
+            </div>
+          </div>
+        );
+      })}
+    </div>
+  );
+}
+
 function BestAnswerCard({
   best,
   selected,
   onToggle,
   compact = false,
+  rank = 1,
 }: {
   best: DifferentialResult;
   selected?: boolean;
   onToggle?: () => void;
   compact?: boolean;
+  rank?: number;
 }) {
   const Icon = best.icon;
-  const tagLimit = compact ? 2 : best.tags.length;
-  const visibleTags = best.tags.slice(0, tagLimit);
-  const hiddenTagCount = best.tags.length - visibleTags.length;
-
-  // Use danger styling for emergent, accent styling for routine results
-  const isEmergent = best.status === "emergent";
-  const cardBorderColor = isEmergent ? "var(--danger-border)" : "var(--clinical-accent-border)";
-  const cardBgColor = isEmergent ? "var(--danger-soft)" : "var(--clinical-accent-soft)";
-  const iconBorderColor = isEmergent ? "var(--danger-border)" : "var(--clinical-accent-border)";
-  const iconColor = isEmergent ? "var(--danger)" : "var(--clinical-accent)";
 
   return (
     <section
-      data-testid={compact ? "differential-best-answer" : undefined}
+      data-testid={compact ? "differential-best-answer" : "differential-best-match-card"}
+      aria-label="Best differential match"
       className={cn(
-        "grid items-start gap-x-2.5 gap-y-2 rounded-lg border shadow-[var(--shadow-inset)]",
+        "grid items-start gap-x-2.5 gap-y-3 rounded-lg border shadow-[var(--e1)]",
+        "border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)]/45",
         compact
-          ? "grid-cols-[2.5rem_minmax(0,1fr)_var(--spacing-tap)] p-3"
-          : "grid-cols-[3rem_minmax(0,1fr)_var(--spacing-tap)] p-4",
+          ? "grid-cols-[2rem_minmax(0,1fr)_var(--spacing-tap)] p-3"
+          : "grid-cols-[2.75rem_4.25rem_minmax(0,1fr)_7rem_var(--spacing-tap)] p-3.5",
       )}
-      style={{
-        borderColor: `color-mix(in srgb, ${cardBorderColor}, transparent)`,
-        backgroundColor: `color-mix(in srgb, ${cardBgColor}, transparent 45%)`,
-      }}
     >
       <span
+        data-testid={!compact ? "differential-best-match-rank" : undefined}
         className={cn(
-          "grid shrink-0 place-items-center rounded-lg border bg-[color:var(--surface)]",
-          compact ? "h-10 w-10" : "h-12 w-12",
+          "grid h-8 w-8 shrink-0 place-items-center rounded-md border bg-[color:var(--surface)] text-sm font-extrabold",
+          "border-[color:var(--clinical-accent-border)] text-[color:var(--clinical-accent)]",
+          !compact && "self-center",
         )}
-        style={{
-          borderColor: `color-mix(in srgb, ${iconBorderColor}, transparent)`,
-          color: `color-mix(in srgb, ${iconColor}, transparent)`,
-        }}
       >
-        <Icon className={cn("stroke-[1.8]", compact ? "size-icon-lg" : "size-icon-xl")} aria-hidden />
+        {rank}
       </span>
-      <Link
-        href={best.href}
-        className="block min-w-0 rounded-md focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)]"
-      >
-        <p className="text-2xs font-extrabold uppercase text-[color:var(--text-muted)]">Best answer</p>
-        <h2
+      {!compact ? (
+        <span
           className={cn(
-            "mt-0.5 font-extrabold leading-6 text-[color:var(--text-heading)] transition hover:text-[color:var(--clinical-accent)]",
-            compact ? "text-base" : "text-lg",
+            "grid h-14 w-14 place-items-center self-center rounded-lg border bg-[color:var(--surface)]",
+            "border-[color:var(--clinical-accent-border)] text-[color:var(--clinical-accent)]",
           )}
         >
-          <span className={cn(compact && "line-clamp-2")}>{best.title}</span>
-        </h2>
-        <div className="mt-1.5 flex flex-wrap items-center gap-1.5">
+          <Icon className="h-7 w-7 stroke-[1.75]" aria-hidden />
+        </span>
+      ) : null}
+      <Link
+        href={best.href}
+        className={cn(
+          "block min-w-0 self-center rounded-md focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)]",
+          compact && "self-start",
+        )}
+      >
+        <div className="flex min-w-0 flex-wrap items-center gap-2">
+          <h2
+            className={cn(
+              "font-extrabold leading-6 text-[color:var(--text-heading)]",
+              compact ? "text-base" : "text-lg",
+            )}
+          >
+            <span className={cn(compact && "line-clamp-2")}>{best.title}</span>
+          </h2>
           <DesignChip
             size="compact"
             appearance={{ kind: "information", tone: best.kind === "presentation" ? "accent" : "inset" }}
@@ -507,21 +553,20 @@ function BestAnswerCard({
           </DesignChip>
           <StatusBadge status={best.status} />
         </div>
-        <p
-          className={cn(
-            "min-w-0 text-sm font-medium text-[color:var(--text-muted)]",
-            compact ? "mt-2 line-clamp-2 leading-5" : "mt-2.5 leading-6",
-          )}
-        >
-          {best.subtitle}
-        </p>
       </Link>
+      {!compact ? (
+        <div className="grid min-h-10 place-items-center self-center border-l border-[color:var(--clinical-accent-border)] pl-3">
+          <MatchBadge label="Best match" />
+        </div>
+      ) : null}
       {onToggle ? <SelectionCheckbox selected={Boolean(selected)} onChange={onToggle} label={best.title} /> : <span />}
-      <div className="col-span-2 col-start-2 flex min-w-0 max-w-full flex-wrap gap-1.5">
-        {visibleTags.map((tag) => (
-          <Chip key={tag}>{tag}</Chip>
-        ))}
-        {hiddenTagCount > 0 ? <Chip fixed={compact}>{`+${hiddenTagCount}`}</Chip> : null}
+      {compact ? (
+        <div className="col-span-2 col-start-2 flex items-center gap-1.5">
+          <MatchBadge label="Best match" />
+        </div>
+      ) : null}
+      <div className={cn(compact ? "col-span-2 col-start-2" : "col-start-3 col-end-6")}>
+        <BestMatchReasoningPanel result={best} compact={compact} />
       </div>
     </section>
   );
@@ -702,7 +747,6 @@ function InterpretationRail({
         Interpretation
         <Info className="h-4 w-4" aria-hidden />
       </h2>
-      <BestAnswerCard best={best} />
       {safetyLead.safety ? <SafetyCard safety={safetyLead.safety} query={query} /> : null}
       {best.kind === "presentation" ? <LikelyPresentationCard lead={best} /> : null}
       <UrgencyCard results={results} />
@@ -713,9 +757,6 @@ function InterpretationRail({
         sourcesChecked={sourcesChecked}
         onRunSourceSearch={onRunSourceSearch}
       />
-      <p className="px-1 text-xs font-medium leading-5 text-[color:var(--text-muted)]">
-        Clinical decision support only. Review before use. No patient data stored.
-      </p>
     </aside>
   );
 }
@@ -1140,24 +1181,34 @@ function SearchResultsView({
                 // Best-match styling remains tied to relevance while the row
                 // number follows the user's chosen presentation order.
                 const isBest = result.kind === best.kind && result.id === best.id;
-                // Phone list hides the best-answer duplicate, so ranks must
-                // skip that row or the first visible card starts at 2/3.
-                const mobileIndex = visibleResults
+                // The featured card owns rank 1 on phones. Continue the
+                // remaining visible sequence at 2 without leaving a gap when
+                // the best match moves under A-Z presentation order.
+                const precedingNonBestResults = visibleResults
                   .slice(0, displayIndex)
-                  .filter((candidate) => !(candidate.kind === best.kind && candidate.id === best.id)).length;
+                  .filter((candidate) => candidate.kind !== best.kind || candidate.id !== best.id);
+                const mobileIndex = precedingNonBestResults.length + 1;
                 return (
                   // The best answer is already featured above the phone list,
                   // so its ranked duplicate only renders from the desktop
                   // breakpoint (hiding the wrapper keeps the grid gap clean).
                   <div key={`${result.kind}-${result.id}`} className={cn(isBest && "max-lg:hidden")}>
                     <div className="hidden lg:block">
-                      <DesktopResultRow
-                        result={result}
-                        index={displayIndex}
-                        isBest={isBest}
-                        selected={selectedIds.has(result.id)}
-                        onToggle={result.kind === "diagnosis" ? () => toggleSelected(result.id) : undefined}
-                      />
+                      {isBest ? (
+                        <BestAnswerCard
+                          best={result}
+                          rank={displayIndex + 1}
+                          selected={selectedIds.has(result.id)}
+                          onToggle={result.kind === "diagnosis" ? () => toggleSelected(result.id) : undefined}
+                        />
+                      ) : (
+                        <DesktopResultRow
+                          result={result}
+                          index={displayIndex}
+                          selected={selectedIds.has(result.id)}
+                          onToggle={result.kind === "diagnosis" ? () => toggleSelected(result.id) : undefined}
+                        />
+                      )}
                     </div>
                     {!isBest ? (
                       <div className="lg:hidden">
@@ -1220,10 +1271,6 @@ function SearchResultsView({
       ) : null}
 
       <UniversalSearchAlsoMatches modeId="differentials" query={query} />
-
-      <p className="pb-3 text-center text-xs font-medium text-[color:var(--text-muted)] lg:hidden">
-        Clinical decision support only. Review before use.
-      </p>
     </div>
   );
 }
diff --git a/src/components/clinical-dashboard/favourites-command-library-page.tsx b/src/components/clinical-dashboard/favourites-command-library-page.tsx
index 517d1f57d2..bb7c10199c 100644
--- a/src/components/clinical-dashboard/favourites-command-library-page.tsx
+++ b/src/components/clinical-dashboard/favourites-command-library-page.tsx
@@ -5,10 +5,12 @@ import { useRouter } from "next/navigation";
 import {
   ChevronDown,
   ChevronsRight,
+  Clock,
   Copy,
   ExternalLink,
   FileText,
   Folder,
+  FolderPlus,
   Heart,
   MoreVertical,
   Pill,
@@ -20,15 +22,9 @@ import {
   X,
   type LucideIcon,
 } from "lucide-react";
-import { useMemo, useRef, useState } from "react";
+import { useMemo, useRef, useState, useSyncExternalStore } from "react";
 
-import {
-  FavouritesMobileBrowseRail,
-  FavouritesMobileQuickViews,
-  FavouritesSidebar,
-  useFavouritesNavCollapsed,
-  type FavouritesViewMode,
-} from "@/components/clinical-dashboard/favourites-library-nav";
+import { useSearchCommand } from "@/components/clinical-dashboard/search-command-context";
 import { AccountSetupDialog } from "@/components/clinical-dashboard/account-setup-dialog";
 import { useDismissableLayer } from "@/components/use-dismissable-layer";
 import { cn, EmptyState, ignoreUnavailableActivation } from "@/components/ui-primitives";
@@ -53,7 +49,9 @@ import { useAuthSession } from "@/lib/supabase/client";
 
 type FavouriteType =
   "Medication" | "Document" | "Table" | "Saved search" | "Source" | "Service" | "Form" | "Differential";
-type ViewMode = FavouritesViewMode;
+// Previously imported from `favourites-library-nav`, which this redesign
+// retired along with the sidebar and the two phone rails it exported.
+type ViewMode = "all" | "source-backed" | "pinned" | "recent";
 type SortMode = "last-used" | "title" | "type";
 
 type FavouriteItem = {
@@ -81,6 +79,15 @@ type FavouriteSet = {
 const focusRing =
   "focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)]";
 
+// How many rows the Recent card shows before "View all" takes over. Small on
+// purpose: this is a glance surface sitting above the real table, not a second
+// copy of it.
+const recentPreviewLimit = 3;
+
+function subscribeNoop() {
+  return () => {};
+}
+
 const typeAppearance: Record<FavouriteType, ChipAppearance> = {
   Medication: { kind: "information", tone: "accent" },
   Document: { kind: "category", tone: "document" },
@@ -601,11 +608,252 @@ function FavouritesEmptyMatches() {
   );
 }
 
+/**
+ * One horizontal rail replacing three separate navigation surfaces: the
+ * desktop `FavouritesSidebar`, the phone `FavouritesMobileQuickViews`, and the
+ * phone `FavouritesMobileBrowseRail`. Direction B (ledger #164) collapses sets,
+ * quick views and types into a single row of chips, so the same control reads
+ * identically at every width instead of three components disagreeing about
+ * what "browse" means.
+ *
+ * Each chip toggles its own dimension, so a set and a type still compose the
+ * way the sidebar allowed. "All" is the only chip that clears every dimension,
+ * and it reads as pressed exactly when nothing else is.
+ */
+function FavouritesFilterRail({
+  items,
+  sets,
+  selectedSetId,
+  selectedTypeId,
+  viewMode,
+  onSelectSet,
+  onSelectType,
+  onSelectViewMode,
+  onClearAll,
+}: {
+  items: FavouriteItem[];
+  sets: FavouriteSet[];
+  selectedSetId: string | null;
+  selectedTypeId: string;
+  viewMode: ViewMode;
+  onSelectSet: (id: string | null) => void;
+  onSelectType: (id: string) => void;
+  onSelectViewMode: (mode: ViewMode) => void;
+  onClearAll: () => void;
+}) {
+  const typeChips = favouriteTabs
+    .filter((tab) => tab.id !== "all" && tab.id !== "sets")
+    .map((tab) => ({ id: tab.id, label: tab.label, count: items.filter((item) => item.tabId === tab.id).length }))
+    .filter((tab) => tab.count > 0);
+  const pinnedCount = items.filter((item) => item.pinned === true).length;
+  const sourceBackedCount = items.filter((item) => isSourceBacked(item)).length;
+  const nothingActive = selectedSetId === null && selectedTypeId === "all" && viewMode === "all";
+
+  return (
+    <nav
+      aria-label="Filter favourites"
+      data-testid="favourites-filter-rail"
+      className="-mx-1 flex min-w-0 max-w-full snap-x items-center gap-2 overflow-x-auto px-1 pb-1"
+    >
+      <FilterRailChip label="All" count={null} pressed={nothingActive} onClick={onClearAll} />
+      {sets.map((set) => (
+        <FilterRailChip
+          key={`set-${set.id}`}
+          label={set.title}
+          count={set.count}
+          pressed={selectedSetId === set.id}
+          onClick={() => onSelectSet(selectedSetId === set.id ? null : set.id)}
+        />
+      ))}
+      {pinnedCount > 0 ? (
+        <FilterRailChip
+          label="Pinned"
+          count={pinnedCount}
+          pressed={viewMode === "pinned"}
+          onClick={() => onSelectViewMode(viewMode === "pinned" ? "all" : "pinned")}
+        />
+      ) : null}
+      {sourceBackedCount > 0 ? (
+        <FilterRailChip
+          label="Source-backed"
+          count={sourceBackedCount}
+          pressed={viewMode === "source-backed"}
+          onClick={() => onSelectViewMode(viewMode === "source-backed" ? "all" : "source-backed")}
+        />
+      ) : null}
+      {typeChips.map((tab) => (
+        <FilterRailChip
+          key={`type-${tab.id}`}
+          label={tab.label}
+          count={tab.count}
+          pressed={selectedTypeId === tab.id}
+          onClick={() => onSelectType(selectedTypeId === tab.id ? "all" : tab.id)}
+        />
+      ))}
+    </nav>
+  );
+}
+
+function FilterRailChip({
+  label,
+  count,
+  pressed,
+  onClick,
+}: {
+  label: string;
+  count: number | null;
+  pressed: boolean;
+  onClick: () => void;
+}) {
+  return (
+    <button
+      type="button"
+      onClick={onClick}
+      aria-pressed={pressed}
+      className={cn(
+        "inline-flex min-h-tap shrink-0 snap-start items-center gap-1.5 whitespace-nowrap rounded-full border px-3 text-xs font-bold transition sm:min-h-9",
+        focusRing,
+        pressed
+          ? "border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)]"
+          : "border-[color:var(--border)] bg-[color:var(--surface)] text-[color:var(--text-muted)] hover:bg-[color:var(--surface-subtle)]",
+      )}
+    >
+      {label}
+      {count === null ? null : (
+        <span
+          className={cn(
+            "nums rounded-full px-1.5 text-2xs font-bold",
+            pressed
+              ? "bg-[color:var(--clinical-accent)] text-[color:var(--clinical-accent-contrast)]"
+              : "bg-[color:var(--surface-subtle)] text-[color:var(--text-muted)]",
+          )}
+        >
+          {count}
+        </span>
+      )}
+    </button>
+  );
+}
+
+/**
+ * The empty-query dashboard band. Both cards read from the same derived data
+ * the table does — no separate store — so they cannot drift from it.
+ */
+function FavouritesDashboardBand({
+  recentItems,
+  sets,
+  onSelectSet,
+  onShowRecent,
+}: {
+  recentItems: FavouriteItem[];
+  sets: FavouriteSet[];
+  onSelectSet: (id: string) => void;
+  onShowRecent: () => void;
+}) {
+  return (
+    <div className="grid min-w-0 gap-3 lg:grid-cols-2">
+      <section
+        data-testid="favourites-recent-card"
+        aria-labelledby="favourites-recent-heading"
+        className="min-w-0 rounded-xl border border-[color:var(--border)] bg-[color:var(--surface)] shadow-[var(--e2)]"
+      >
+        <div className="flex items-center justify-between gap-2 border-b border-[color:var(--border)] px-3.5 py-2.5">
+          <h2
+            id="favourites-recent-heading"
+            className="inline-flex items-center gap-1.5 text-2xs font-semibold uppercase tracking-label text-[color:var(--text-muted)]"
+          >
+            <Clock className="h-3.5 w-3.5 text-[color:var(--clinical-accent)]" aria-hidden />
+            Recent
+          </h2>
+          <button
+            type="button"
+            onClick={onShowRecent}
+            className={cn(
+              "inline-flex min-h-tap items-center rounded-lg px-2 text-xs font-bold text-[color:var(--clinical-accent)] hover:bg-[color:var(--surface-subtle)] sm:min-h-9",
+              focusRing,
+            )}
+          >
+            View all
+          </button>
+        </div>
+        <ul className="divide-y divide-[color:var(--border)]">
+          {recentItems.map((item) => (
+            <li key={item.id} className="flex min-w-0 items-center gap-2.5 px-3.5 py-2.5">
+              <Chip size="compact" appearance={typeAppearance[item.type]}>
+                {item.type}
+              </Chip>
+              <span className="flex min-w-0 flex-1 flex-col">
+                <span className="truncate text-sm font-bold text-[color:var(--text-heading)]">{item.title}</span>
+                <span className="truncate text-2xs font-medium text-[color:var(--text-muted)]">
+                  {item.set} · {item.lastUsed}
+                </span>
+              </span>
+              <Link
+                href={item.href}
+                aria-label={`Open ${item.title}`}
+                className={cn(
+                  "inline-flex min-h-tap shrink-0 items-center rounded-lg border border-[color:var(--border)] px-2.5 text-xs font-bold text-[color:var(--text)] hover:bg-[color:var(--surface-subtle)] sm:min-h-9",
+                  focusRing,
+                )}
+              >
+                Open
+              </Link>
+            </li>
+          ))}
+        </ul>
+      </section>
+
+      <section
+        data-testid="favourites-sets-card"
+        aria-labelledby="favourites-sets-heading"
+        className="min-w-0 rounded-xl border border-[color:var(--border)] bg-[color:var(--surface)] shadow-[var(--e2)]"
+      >
+        <div className="flex items-center justify-between gap-2 border-b border-[color:var(--border)] px-3.5 py-2.5">
+          <h2
+            id="favourites-sets-heading"
+            className="inline-flex items-center gap-1.5 text-2xs font-semibold uppercase tracking-label text-[color:var(--text-muted)]"
+          >
+            <FolderPlus className="h-3.5 w-3.5 text-[color:var(--clinical-accent)]" aria-hidden />
+            Your sets
+          </h2>
+        </div>
+        {sets.length === 0 ? (
+          <p className="px-3.5 py-4 text-xs font-medium text-[color:var(--text-muted)]">
+            Saved items group into sets as you add them.
+          </p>
+        ) : (
+          <ul className="grid gap-2 p-3 sm:grid-cols-2 xl:grid-cols-3">
+            {sets.map((set) => (
+              <li key={set.id} className="min-w-0">
+                <button
+                  type="button"
+                  onClick={() => onSelectSet(set.id)}
+                  className={cn(
+                    "flex min-h-tap w-full min-w-0 flex-col items-start gap-1 rounded-lg border border-[color:var(--border)] bg-[color:var(--surface-subtle)] px-3 py-2.5 text-left hover:bg-[color:var(--surface)]",
+                    focusRing,
+                  )}
+                >
+                  <span className="flex min-w-0 max-w-full items-center gap-1.5">
+                    <Folder className="h-3.5 w-3.5 shrink-0 text-[color:var(--text-muted)]" aria-hidden />
+                    <span className="truncate text-xs font-bold text-[color:var(--text-heading)]">{set.title}</span>
+                  </span>
+                  <span className="nums text-2xs font-medium text-[color:var(--text-muted)]">
+                    {set.count} {set.count === 1 ? "item" : "items"}
+                  </span>
+                </button>
+              </li>
+            ))}
+          </ul>
+        )}
+      </section>
+    </div>
+  );
+}
+
 function FavouritesTable({
   items,
+  rows: tableRows,
   searchTerm,
-  selectedTypeId,
-  selectedSet,
   viewMode,
   sortMode,
   selectedItemId,
@@ -613,26 +861,18 @@ function FavouritesTable({
   onSelectItem,
 }: {
   items: FavouriteItem[];
+  // The filtered/sorted rows are computed once by the page and passed in.
+  // They used to be derived here as well, from the same inputs, so the band's
+  // match count and the table's own count were two independent answers to one
+  // question — the redundant half of the "dual search" ledger #164 names.
+  rows: FavouriteItem[];
   searchTerm: string;
-  selectedTypeId: string;
-  selectedSet: FavouriteSet | null;
   viewMode: ViewMode;
   sortMode: SortMode;
   selectedItemId: string | null;
   onSortModeChange: (value: SortMode) => void;
   onSelectItem: (id: string) => void;
 }) {
-  const tableRows = useMemo(() => {
-    const rows = filterAndSortItems(items, {
-      searchTerm,
-      selectedTypeId,
-      selectedSet,
-      viewMode,
-      sortMode,
-    });
-    return rows;
-  }, [items, searchTerm, selectedSet, selectedTypeId, viewMode, sortMode]);
-
   // With the item workspace open (only at 2xl), the middle column narrows sharply.
   // Drop the leading icon and the secondary Evidence column there so titles keep
   // room instead of collapsing to a couple of characters.
@@ -644,11 +884,24 @@ function FavouritesTable({
   return (
     <section className="min-w-0 max-w-full overflow-hidden rounded-xl border border-[color:var(--border)] bg-[color:var(--surface)] shadow-[var(--shadow-soft)]">
       <div className="flex flex-wrap items-center justify-between gap-3 border-b border-[color:var(--border)] bg-[color:var(--surface-wash)] px-3.5 py-2.5">
-        <p className="inline-flex items-center gap-1.5 text-2xs font-semibold uppercase tracking-label text-[color:var(--text-muted)]">
-          <Heart className="h-3.5 w-3.5 text-[color:var(--clinical-accent)]" aria-hidden />
-          <span className="nums font-bold text-[color:var(--text-heading)]">{tableRows.length}</span>
-          {tableRows.length === 1 ? "item" : "items"}
-          {tableRows.length !== items.length ? ` of ${items.length}` : ""}
+        <p className="inline-flex min-w-0 items-center gap-1.5 text-2xs font-semibold uppercase tracking-label text-[color:var(--text-muted)]">
+          {searchTerm.trim() ? (
+            <>
+              <Search className="h-3.5 w-3.5 text-[color:var(--clinical-accent)]" aria-hidden />
+              <span className="nums font-bold text-[color:var(--text-heading)]">{tableRows.length}</span>
+              {tableRows.length === 1 ? "match for" : "matches for"}
+              <span className="truncate font-bold normal-case text-[color:var(--text-heading)]">
+                “{searchTerm.trim()}”
+              </span>
+            </>
+          ) : (
+            <>
+              <Heart className="h-3.5 w-3.5 text-[color:var(--clinical-accent)]" aria-hidden />
+              <span className="nums font-bold text-[color:var(--text-heading)]">{tableRows.length}</span>
+              {tableRows.length === 1 ? "item" : "items"}
+              {tableRows.length !== items.length ? ` of ${items.length}` : ""}
+            </>
+          )}
         </p>
         <div className="flex flex-wrap items-center gap-2">
           <label className="relative block min-w-[9.5rem]">
@@ -1003,6 +1256,19 @@ function ItemWorkspace({ item, onClose }: { item: FavouriteItem; onClose: () =>
 export function FavouritesCommandLibraryPage({ query = "", demoMode }: { query?: string; demoMode: boolean }) {
   const router = useRouter();
   const auth = useAuthSession();
+  const searchCommand = useSearchCommand();
+  const hydrated = useSyncExternalStore(
+    subscribeNoop,
+    () => true,
+    () => false,
+  );
+  // The route's submitted `?q=` server-renders the exact list on a hard load;
+  // after hydration the shared composer's live draft owns it. That is what
+  // makes the typed query filter this page in place — no navigation, no second
+  // input, and no ModeHome to bounce through (ledger #164). The composer is
+  // still the one and only composer on the route, so the one-composer contract
+  // in docs/search-chrome-behaviour.md is untouched.
+  const activeQuery = hydrated ? (searchCommand?.query ?? query) : query;
   const favouritesAccessible = canAccessFavouritesMode({
     authenticated: auth.status === "authenticated",
     demoMode,
@@ -1010,7 +1276,6 @@ export function FavouritesCommandLibraryPage({ query = "", demoMode }: { query?:
   const authSettled = auth.status !== "loading";
   const [accountSetupDismissed, setAccountSetupDismissed] = useState(false);
   const accountSetupOpen = authSettled && !favouritesAccessible && !accountSetupDismissed;
-  const [navCollapsed, setNavCollapsed] = useFavouritesNavCollapsed();
   const {
     items: savedRegistryFavourites,
     status: favouritesHookStatus,
@@ -1040,20 +1305,31 @@ export function FavouritesCommandLibraryPage({ query = "", demoMode }: { query?:
   const effectiveSelectedSetId = selectedSetId && sets.some((set) => set.id === selectedSetId) ? selectedSetId : null;
   const selectedSet = effectiveSelectedSetId ? (sets.find((set) => set.id === effectiveSelectedSetId) ?? null) : null;
 
+  // Single source of truth for "what is in the list right now". The band's
+  // match count, the Continue gate, the empty-state branch and the table all
+  // read this one value.
   const filteredItems = useMemo(
     () =>
       filterAndSortItems(items, {
-        searchTerm: query,
+        searchTerm: activeQuery,
         selectedTypeId,
         selectedSet,
         viewMode,
         sortMode,
       }),
-    [items, query, selectedTypeId, selectedSet, viewMode, sortMode],
+    [items, activeQuery, selectedTypeId, selectedSet, viewMode, sortMode],
   );
   const continueItem = useMemo(() => getMostRecentlyUsedItem(items), [items]);
   const showContinueStrip =
     continueItem !== null && filteredItems.some((item) => item.id === continueItem.id) && filteredItems.length > 0;
+  const recentItems = useMemo(
+    () =>
+      [...items]
+        .sort((first, second) => lastUsedScore(second.lastUsed) - lastUsedScore(first.lastUsed))
+        .slice(0, recentPreviewLimit),
+    [items],
+  );
+  const searching = activeQuery.trim().length > 0;
 
   const selectedItem = selectedItemId ? (items.find((item) => item.id === selectedItemId) ?? null) : null;
 
@@ -1061,30 +1337,26 @@ export function FavouritesCommandLibraryPage({ query = "", demoMode }: { query?:
     router.push("/favourites");
   }
 
+  function clearAllFilters() {
+    setSelectedSetId(null);
+    setSelectedTypeId("all");
+    setViewMode("all");
+  }
+
   if (!favouritesAccessible) {
     return (
       <main
         data-testid="favourites-hub"
         className="min-h-0 overflow-x-clip bg-[color:var(--background)] pb-4 text-[color:var(--text)] sm:min-h-[calc(100dvh-var(--shell-header-h))] sm:pb-32 md:pb-0"
       >
-        <span data-testid="favourites-command-library" className="sr-only">
-          Favourites command library
-        </span>
         <div className="mx-auto grid min-w-0 max-w-[40rem] gap-4 px-4 py-8 sm:px-6">
-          <header>
-            <div className="flex min-w-0 items-start gap-3">
-              <span className="mt-1 grid h-8 w-8 shrink-0 place-items-center rounded-lg border border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)]">
-                <Heart className="size-icon-lg" aria-hidden />
-              </span>
-              <div className="min-w-0 flex-1">
-                <h1 className="text-balance text-2xl-minus font-bold leading-tight tracking-tight text-[color:var(--text-heading)] sm:text-2xl">
-                  Favourites command library
-                </h1>
-                <p className="mt-1 text-pretty text-sm-minus font-medium leading-6 text-[color:var(--text-muted)]">
-                  Sign up to save favourites and access them across devices.
-                </p>
-              </div>
-            </div>
+          <header data-testid="favourites-command-library" className="flex min-w-0 flex-wrap items-baseline gap-x-3">
+            <h1 className="text-balance text-2xl-minus font-bold leading-tight tracking-tight text-[color:var(--text-heading)] sm:text-2xl">
+              Favourites
+            </h1>
+            <p className="text-pretty text-sm-minus font-medium leading-6 text-[color:var(--text-muted)]">
+              Sign up to save favourites and access them across devices.
+            </p>
           </header>
           <div
             role="status"
@@ -1121,47 +1393,29 @@ export function FavouritesCommandLibraryPage({ query = "", demoMode }: { query?:
       data-testid="favourites-hub"
       className="min-h-0 overflow-x-clip bg-[color:var(--background)] pb-4 text-[color:var(--text)] sm:min-h-[calc(100dvh-var(--shell-header-h))] sm:pb-32 md:pb-0"
     >
-      <span data-testid="favourites-command-library" className="sr-only">
-        Favourites command library
-      </span>
       <div
         className={cn(
           "grid min-h-0 min-w-0 overflow-x-clip sm:min-h-[calc(100dvh-var(--shell-header-h))]",
-          navCollapsed ? "lg:grid-cols-[5.25rem_minmax(0,1fr)]" : "lg:grid-cols-[17.5rem_minmax(0,1fr)]",
-          selectedItem &&
-            (navCollapsed
-              ? "xl:grid-cols-[5.25rem_minmax(0,1fr)_23rem]"
-              : "xl:grid-cols-[17.5rem_minmax(0,1fr)_23rem]"),
+          // The left library rail is gone — sets, quick views and types are one
+          // chip rail now (ledger #164), so the workspace is a single column
+          // that only splits when the item workspace opens.
+          selectedItem && "xl:grid-cols-[minmax(0,1fr)_23rem]",
         )}
       >
-        <FavouritesSidebar
-          sets={sets}
-          items={items}
-          selectedSetId={effectiveSelectedSetId}
-          selectedTypeId={selectedTypeId}
-          viewMode={viewMode}
-          collapsed={navCollapsed}
-          onCollapsedChange={setNavCollapsed}
-          onSelectSet={setSelectedSetId}
-          onSelectType={setSelectedTypeId}
-          onSelectViewMode={setViewMode}
-        />
         <div className="min-w-0 overflow-x-hidden px-4 py-5 sm:px-6 lg:px-7">
           <div className="mx-auto grid min-w-0 max-w-[66rem] gap-3 2xl:max-w-[72rem]">
-            <header>
-              <div className="flex min-w-0 items-start gap-3">
-                <span className="mt-1 grid h-8 w-8 shrink-0 place-items-center rounded-lg border border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)]">
-                  <Heart className="size-icon-lg" aria-hidden />
-                </span>
-                <div className="min-w-0 flex-1">
-                  <h1 className="text-balance text-2xl-minus font-bold leading-tight tracking-tight text-[color:var(--text-heading)] sm:text-2xl">
-                    Favourites command library
-                  </h1>
-                  <p className="mt-1 text-pretty text-sm-minus font-medium leading-6 text-[color:var(--text-muted)]">
-                    Your saved clinical knowledge, sets and searches - action-ready and source-backed.
-                  </p>
-                </div>
-              </div>
+            {/* The marketing lockup is retired (ledger #164): an icon tile, a
+                "command library" title and a sentence explaining the page to
+                someone already standing on it cost the fold about 90px and
+                said nothing the nav had not. The count is the only thing worth
+                saying here, and it is not a heading. */}
+            <header data-testid="favourites-command-library" className="flex min-w-0 flex-wrap items-baseline gap-x-3">
+              <h1 className="text-balance text-2xl-minus font-bold leading-tight tracking-tight text-[color:var(--text-heading)] sm:text-2xl">
+                Favourites
+              </h1>
+              <p className="nums text-sm font-medium text-[color:var(--text-muted)]">
+                {items.length} {items.length === 1 ? "item" : "items"}
+              </p>
             </header>
 
             {!demoMode && auth.status !== "authenticated" && auth.status !== "loading" ? (
@@ -1180,7 +1434,7 @@ export function FavouritesCommandLibraryPage({ query = "", demoMode }: { query?:
 
             <SearchResultsHeaderBand
               modeId="favourites"
-              query={query}
+              query={activeQuery}
               matchCount={filteredItems.length}
               // Without this a failed registry read renders as "0 matches", which
               // reads as "you have no saved favourites" rather than "we could not
@@ -1197,7 +1451,7 @@ export function FavouritesCommandLibraryPage({ query = "", demoMode }: { query?:
               filterControls={
                 selectedTypeId !== "all" || selectedSet || viewMode !== "all" ? (
                   <ActiveFilterChips
-                    searchTerm={query}
+                    searchTerm={activeQuery}
                     selectedTypeId={selectedTypeId}
                     selectedSet={selectedSet}
                     viewMode={viewMode}
@@ -1211,37 +1465,43 @@ export function FavouritesCommandLibraryPage({ query = "", demoMode }: { query?:
               }
             />
 
-            <FavouritesMobileQuickViews
+            <FavouritesFilterRail
               items={items}
+              sets={sets}
               selectedSetId={effectiveSelectedSetId}
               selectedTypeId={selectedTypeId}
               viewMode={viewMode}
               onSelectSet={setSelectedSetId}
               onSelectType={setSelectedTypeId}
               onSelectViewMode={setViewMode}
-            />
-
-            <FavouritesMobileBrowseRail
-              sets={sets}
-              selectedSetId={effectiveSelectedSetId}
-              viewMode={viewMode}
-              onSelectSet={setSelectedSetId}
-              onSelectViewMode={setViewMode}
+              onClearAll={clearAllFilters}
             />
 
             {showContinueStrip && continueItem ? <ContinueStrip item={continueItem} /> : null}
 
+            {/* Empty query is a dashboard; a typed query is a filtered table.
+                Typing does not swap surfaces or navigate — the dashboard band
+                demotes to a collapsed disclosure and the table filters in
+                place beneath it (ledger #164). */}
+            {items.length > 0 && !searching ? (
+              <FavouritesDashboardBand
+                recentItems={recentItems}
+                sets={sets}
+                onSelectSet={setSelectedSetId}
+                onShowRecent={() => setViewMode("recent")}
+              />
+            ) : null}
+
             {/* Only a successful read can say "no matches". While loading or
                 faulted an empty list means we could not look, not that the
                 library is empty; the band's fault panel reports that. */}
-            {query.trim() && filteredItems.length === 0 && favouritesRegistryStatus === "ready" ? (
-              <SearchResultsEmptyState modeId="favourites" query={query} />
+            {searching && filteredItems.length === 0 && favouritesRegistryStatus === "ready" ? (
+              <SearchResultsEmptyState modeId="favourites" query={activeQuery} />
             ) : (
               <FavouritesTable
                 items={items}
-                searchTerm={query}
-                selectedTypeId={selectedTypeId}
-                selectedSet={selectedSet}
+                rows={filteredItems}
+                searchTerm={activeQuery}
                 viewMode={viewMode}
                 sortMode={sortMode}
                 selectedItemId={selectedItemId}
@@ -1249,7 +1509,49 @@ export function FavouritesCommandLibraryPage({ query = "", demoMode }: { query?:
                 onSelectItem={setSelectedItemId}
               />
             )}
-            <UniversalSearchAlsoMatches modeId="favourites" query={query} />
+
+            {items.length > 0 && searching ? (
+              <details
+                data-testid="favourites-recent-disclosure"
+                className="min-w-0 rounded-xl border border-[color:var(--border)] bg-[color:var(--surface)]"
+              >
+                <summary
+                  className={cn(
+                    "flex min-h-tap cursor-pointer list-none items-center gap-1.5 px-3.5 text-2xs font-semibold uppercase tracking-label text-[color:var(--text-muted)]",
+                    focusRing,
+                  )}
+                >
+                  <Clock className="h-3.5 w-3.5 text-[color:var(--clinical-accent)]" aria-hidden />
+                  Recent
+                </summary>
+                <ul className="divide-y divide-[color:var(--border)] border-t border-[color:var(--border)]">
+                  {recentItems.map((item) => (
+                    <li key={item.id} className="flex min-w-0 items-center gap-2.5 px-3.5 py-2.5">
+                      <span className="flex min-w-0 flex-1 flex-col">
+                        <span className="truncate text-sm font-bold text-[color:var(--text-heading)]">
+                          {item.title}
+                        </span>
+                        <span className="truncate text-2xs font-medium text-[color:var(--text-muted)]">
+                          {item.set} · {item.lastUsed}
+                        </span>
+                      </span>
+                      <Link
+                        href={item.href}
+                        aria-label={`Open ${item.title}`}
+                        className={cn(
+                          "inline-flex min-h-tap shrink-0 items-center rounded-lg border border-[color:var(--border)] px-2.5 text-xs font-bold text-[color:var(--text)] hover:bg-[color:var(--surface-subtle)] sm:min-h-9",
+                          focusRing,
+                        )}
+                      >
+                        Open
+                      </Link>
+                    </li>
+                  ))}
+                </ul>
+              </details>
+            ) : null}
+
+            <UniversalSearchAlsoMatches modeId="favourites" query={activeQuery} />
           </div>
         </div>
         {selectedItem ? (
diff --git a/src/components/clinical-dashboard/favourites-library-nav.tsx b/src/components/clinical-dashboard/favourites-library-nav.tsx
deleted file mode 100644
index 4847ff4160..0000000000
--- a/src/components/clinical-dashboard/favourites-library-nav.tsx
+++ /dev/null
@@ -1,529 +0,0 @@
-"use client";
-
-import {
-  Folder,
-  Heart,
-  LayoutGrid,
-  PanelLeftClose,
-  PanelLeftOpen,
-  Pin,
-  Search,
-  ShieldCheck,
-  type LucideIcon,
-} from "lucide-react";
-import { useCallback, useSyncExternalStore } from "react";
-
-import { favouriteTabs } from "@/components/clinical-dashboard/favourites-prototype-data";
-import { cn } from "@/components/ui-primitives";
-
-export type FavouritesViewMode = "all" | "source-backed" | "pinned" | "recent";
-
-export type FavouritesNavItem = {
-  id: string;
-  tabId: string;
-  evidence: string;
-  pinned?: boolean;
-};
-
-export type FavouritesNavSet = {
-  id: string;
-  title: string;
-  count: number;
-  meta?: string;
-};
-
-export type FavouritesNavProps = {
-  sets: FavouritesNavSet[];
-  items: FavouritesNavItem[];
-  selectedSetId: string | null;
-  selectedTypeId: string;
-  viewMode: FavouritesViewMode;
-  onSelectSet: (setId: string | null) => void;
-  onSelectType: (typeId: string) => void;
-  onSelectViewMode: (mode: FavouritesViewMode) => void;
-};
-
-const focusRing =
-  "focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)]";
-
-const favouritesNavCollapsedKey = "clinical-kb-favourites-nav-collapsed";
-const favouritesNavCollapsedEvent = "clinical-kb-favourites-nav-collapsed-change";
-
-// Calm, single clinical accent for saved-set cards. Avoids decorative multi-hue
-// gradients (and semantic colours like --warning) so the carousel stays quiet and
-// scan-first, consistent with the card's own --clinical-accent selected/hover states.
-const setAccentBar = "bg-[color:var(--clinical-accent)]";
-
-function isSourceBacked(item: FavouritesNavItem): boolean {
-  return Boolean(item.evidence && item.evidence !== "Run" && item.evidence !== "Saved query");
-}
-
-export function useFavouritesNavCollapsed() {
-  const collapsed = useSyncExternalStore(
-    (onStoreChange) => {
-      window.addEventListener(favouritesNavCollapsedEvent, onStoreChange);
-      return () => window.removeEventListener(favouritesNavCollapsedEvent, onStoreChange);
-    },
-    () => {
-      try {
-        return window.localStorage.getItem(favouritesNavCollapsedKey) === "1";
-      } catch {
-        return false;
-      }
-    },
-    () => false,
-  );
-  const setCollapsed = useCallback((next: boolean) => {
-    try {
-      window.localStorage.setItem(favouritesNavCollapsedKey, next ? "1" : "0");
-    } catch {
-      // Ignore storage failures.
-    }
-    window.dispatchEvent(new Event(favouritesNavCollapsedEvent));
-  }, []);
-  return [collapsed, setCollapsed] as const;
-}
-
-type SidebarEntry = {
-  id: string;
-  icon: LucideIcon;
-  label: string;
-  count: number;
-  active: boolean;
-  onClick: () => void;
-};
-
-function buildSidebarSections({
-  sets,
-  items,
-  selectedSetId,
-  selectedTypeId,
-  viewMode,
-  onSelectSet,
-  onSelectType,
-  onSelectViewMode,
-}: FavouritesNavProps): { id: string; title: string; entries: SidebarEntry[] }[] {
-  const sourceBackedCount = items.filter(isSourceBacked).length;
-  const pinnedCount = items.filter((item) => item.pinned).length;
-  const allActive = !selectedSetId && viewMode === "all" && selectedTypeId === "all";
-
-  return [
-    {
-      id: "sets",
-      title: "Sets",
-      entries: [
-        {
-          id: "all",
-          icon: LayoutGrid,
-          label: "All favourites",
-          count: items.length,
-          active: allActive,
-          onClick: () => {
-            onSelectViewMode("all");
-            onSelectSet(null);
-            onSelectType("all");
-          },
-        },
-        ...sets.map((set) => ({
-          id: set.id,
-          icon: Folder,
-          label: set.title,
-          count: set.count,
-          active: selectedSetId === set.id && viewMode === "all",
-          onClick: () => {
-            onSelectViewMode("all");
-            onSelectSet(selectedSetId === set.id ? null : set.id);
-          },
-        })),
-      ],
-    },
-    {
-      id: "views",
-      title: "Quick views",
-      entries: [
-        {
-          id: "source-backed",
-          icon: ShieldCheck,
-          label: "Source-backed",
-          count: sourceBackedCount,
-          active: viewMode === "source-backed",
-          onClick: () => {
-            onSelectSet(null);
-            onSelectViewMode(viewMode === "source-backed" ? "all" : "source-backed");
-          },
-        },
-        {
-          id: "pinned",
-          icon: Pin,
-          label: "Pinned",
-          count: pinnedCount,
-          active: viewMode === "pinned",
-          onClick: () => {
-            onSelectSet(null);
-            onSelectViewMode(viewMode === "pinned" ? "all" : "pinned");
-          },
-        },
-        {
-          id: "recent",
-          icon: Search,
-          label: "Recently used",
-          count: items.length,
-          active: viewMode === "recent",
-          onClick: () => {
-            onSelectSet(null);
-            onSelectViewMode(viewMode === "recent" ? "all" : "recent");
-          },
-        },
-      ],
-    },
-    {
-      id: "types",
-      title: "By type",
-      entries: favouriteTabs
-        .filter((tab) => tab.id !== "all" && tab.id !== "sets")
-        .map((tab) => ({
-          id: tab.id,
-          icon: tab.icon,
-          label: tab.label,
-          count: items.filter((item) => item.tabId === tab.id).length,
-          active: selectedTypeId === tab.id && viewMode === "all",
-          onClick: () => {
-            onSelectViewMode("all");
-            onSelectType(selectedTypeId === tab.id ? "all" : tab.id);
-          },
-        })),
-    },
-  ];
-}
-
-function SidebarRow({ entry }: { entry: SidebarEntry }) {
-  const Icon = entry.icon;
-  return (
-    <button
-      type="button"
-      aria-pressed={entry.active}
-      onClick={entry.onClick}
-      className={cn(
-        "flex min-h-tap w-full items-center gap-2.5 rounded-lg border px-2.5 text-left text-sm-minus font-semibold transition",
-        entry.active
-          ? "border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)] shadow-[var(--shadow-rail-active)]"
-          : "border-transparent text-[color:var(--text-muted)] hover:bg-[color:var(--surface-subtle)] hover:text-[color:var(--text)]",
-        focusRing,
-      )}
-    >
-      <Icon className="h-4 w-4 shrink-0" aria-hidden />
-      <span className="min-w-0 flex-1 truncate">{entry.label}</span>
-      <span className="nums shrink-0 text-2xs font-bold opacity-75">{entry.count}</span>
-    </button>
-  );
-}
-
-/**
- * Renders the favourites library navigation sidebar in expanded or compact mode.
- *
- * @param collapsed - Whether to display the compact sidebar layout.
- * @param onCollapsedChange - Called when the user requests a different sidebar layout.
- */
-export function FavouritesSidebar({
-  collapsed,
-  onCollapsedChange,
-  ...navProps
-}: FavouritesNavProps & {
-  collapsed: boolean;
-  onCollapsedChange: (collapsed: boolean) => void;
-}) {
-  const sections = buildSidebarSections(navProps);
-
-  if (collapsed) {
-    return (
-      <aside
-        aria-label="Favourites library filters"
-        data-testid="favourites-sidebar-compact"
-        className="hidden min-w-0 border-r border-[color:var(--border)] bg-[color:var(--surface-lux)] py-4 shadow-[var(--shadow-soft)] lg:flex lg:w-[5.25rem] lg:flex-col lg:items-center"
-      >
-        <button
-          type="button"
-          onClick={() => onCollapsedChange(false)}
-          className={cn(
-            "group mb-3 grid h-tap w-tap place-items-center rounded-lg border border-transparent text-[color:var(--text-muted)] transition hover:border-[color:var(--border)] hover:bg-[color:var(--surface)] hover:text-[color:var(--text)]",
-            focusRing,
-          )}
-          aria-label="Expand library sidebar"
-          title="Expand library sidebar"
-        >
-          <Heart className="h-4 w-4 group-hover:hidden group-focus-visible:hidden" aria-hidden />
-          <PanelLeftOpen className="hidden h-4 w-4 group-hover:block group-focus-visible:block" aria-hidden />
-        </button>
-        <nav
-          aria-label="Favourites library"
-          className="flex min-h-0 flex-1 flex-col items-center gap-1 overflow-y-auto px-2 pb-2"
-        >
-          {sections.map((section, sectionIndex) => (
-            <span key={section.id} className="contents">
-              {sectionIndex > 0 ? <span className="my-1 h-px w-8 bg-[color:var(--border)]" aria-hidden /> : null}
-              {section.entries.map((entry) => {
-                const Icon = entry.icon;
-                return (
-                  <button
-                    key={entry.id}
-                    type="button"
-                    aria-pressed={entry.active}
-                    aria-label={entry.label}
-                    title={entry.label}
-                    onClick={entry.onClick}
-                    className={cn(
-                      "relative grid h-tap w-tap place-items-center rounded-lg border transition",
-                      entry.active
-                        ? "border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)] shadow-[var(--shadow-rail-active)]"
-                        : "border-transparent text-[color:var(--text-muted)] hover:border-[color:var(--border)] hover:bg-[color:var(--surface)] hover:text-[color:var(--text)]",
-                      focusRing,
-                    )}
-                  >
-                    <Icon className="h-4 w-4" aria-hidden />
-                    <span className="nums absolute -right-0.5 -top-0.5 grid min-h-4 min-w-4 place-items-center rounded-full border border-[color:var(--surface)] bg-[color:var(--command)] px-1 text-2xs font-bold leading-none text-[color:var(--command-contrast)]">
-                      {entry.count}
-                    </span>
-                  </button>
-                );
-              })}
-            </span>
-          ))}
-        </nav>
-      </aside>
-    );
-  }
-
-  return (
-    <aside
-      aria-label="Favourites library filters"
-      data-testid="favourites-sidebar-expanded"
-      className="hidden min-w-0 overflow-y-auto border-r border-[color:var(--border)] bg-[color:var(--surface-lux)] px-4 py-5 shadow-[var(--shadow-soft)] lg:block lg:w-[17.5rem]"
-    >
-      <div className="mb-4 flex items-center justify-between gap-2">
-        <h2 className="truncate text-sm-minus font-semibold text-[color:var(--text-heading)]">Library</h2>
-        <button
-          type="button"
-          onClick={() => onCollapsedChange(true)}
-          className={cn(
-            "grid h-tap w-tap shrink-0 place-items-center rounded-lg border border-transparent text-[color:var(--text-muted)] transition hover:border-[color:var(--border)] hover:bg-[color:var(--surface)] hover:text-[color:var(--text)]",
-            focusRing,
-          )}
-          aria-label="Compact library sidebar"
-          title="Compact library sidebar"
-        >
-          <PanelLeftClose className="h-4 w-4" aria-hidden />
-        </button>
-      </div>
-      <nav aria-label="Favourites sections" className="grid gap-5">
-        {sections.map((section) => (
-          <section key={section.id}>
-            <h3 className="mb-2 text-2xs font-semibold uppercase tracking-eyebrow text-[color:var(--text-muted)]">
-              {section.title}
-            </h3>
-            <div className="grid gap-1">
-              {section.entries.map((entry) => (
-                <SidebarRow key={entry.id} entry={entry} />
-              ))}
-            </div>
-          </section>
-        ))}
-      </nav>
-    </aside>
-  );
-}
-
-function SetBrowseCard({
-  set,
-  accentClass,
-  active = false,
-  onClick,
-}: {
-  set: FavouritesNavSet;
-  accentClass: string;
-  active?: boolean;
-  onClick: () => void;
-}) {
-  return (
-    <button
-      type="button"
-      onClick={onClick}
-      aria-pressed={active}
-      className={cn(
-        "relative min-w-[8.75rem] max-w-[9.75rem] shrink-0 overflow-hidden rounded-xl border p-2.5 text-left shadow-[var(--e1)] transition hover:-translate-y-px hover:shadow-[var(--shadow-soft)] sm:min-w-[9.5rem] sm:max-w-[10.5rem]",
-        active
-          ? "border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)]/40 ring-2 ring-[color:var(--clinical-accent)]/20"
-          : "border-[color:var(--border)] bg-[color:var(--surface)] hover:border-[color:var(--clinical-accent-border)]",
-        focusRing,
-      )}
-    >
-      <span className={cn("absolute inset-x-0 top-0 h-1", accentClass)} aria-hidden />
-      <div className="flex items-start justify-between gap-2">
-        <span
-          className={cn(
-            "grid h-8 w-8 place-items-center rounded-lg border",
-            active
-              ? "border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)]"
-              : "border-[color:var(--border)] bg-[color:var(--surface-subtle)] text-[color:var(--text-muted)]",
-          )}
-        >
-          <Folder className="h-4 w-4" aria-hidden />
-        </span>
-        <span className="nums rounded-md border border-[color:var(--border)] bg-[color:var(--surface-wash)] px-2 py-0.5 text-2xs font-bold text-[color:var(--text-heading)]">
-          {set.count}
-        </span>
-      </div>
-      <p className="mt-2 truncate text-sm-minus font-bold text-[color:var(--text-heading)]">{set.title}</p>
-    </button>
-  );
-}
-
-/**
- * Surfaces the sidebar's primary quick views (All / Source-backed / Pinned /
- * Recently used) as a horizontally scrollable chip rail below `lg`, where the
- * full sidebar is hidden. Keeps small-screen navigation at parity with desktop.
- */
-export function FavouritesMobileQuickViews({
-  items,
-  selectedSetId,
-  selectedTypeId,
-  viewMode,
-  onSelectSet,
-  onSelectType,
-  onSelectViewMode,
-}: Pick<
-  FavouritesNavProps,
-  "items" | "selectedSetId" | "selectedTypeId" | "viewMode" | "onSelectSet" | "onSelectType" | "onSelectViewMode"
->) {
-  const sourceBackedCount = items.filter(isSourceBacked).length;
-  const pinnedCount = items.filter((item) => item.pinned).length;
-  const allActive = !selectedSetId && viewMode === "all" && selectedTypeId === "all";
-
-  const chips: Array<{
-    id: string;
-    icon: LucideIcon;
-    label: string;
-    count: number;
-    active: boolean;
-    onClick: () => void;
-  }> = [
-    {
-      id: "all",
-      icon: LayoutGrid,
-      label: "All",
-      count: items.length,
-      active: allActive,
-      onClick: () => {
-        onSelectViewMode("all");
-        onSelectSet(null);
-        onSelectType("all");
-      },
-    },
-    {
-      id: "source-backed",
-      icon: ShieldCheck,
-      label: "Source-backed",
-      count: sourceBackedCount,
-      active: viewMode === "source-backed",
-      onClick: () => {
-        onSelectSet(null);
-        onSelectViewMode(viewMode === "source-backed" ? "all" : "source-backed");
-      },
-    },
-    {
-      id: "pinned",
-      icon: Pin,
-      label: "Pinned",
-      count: pinnedCount,
-      active: viewMode === "pinned",
-      onClick: () => {
-        onSelectSet(null);
-        onSelectViewMode(viewMode === "pinned" ? "all" : "pinned");
-      },
-    },
-    {
-      id: "recent",
-      icon: Search,
-      label: "Recently used",
-      count: items.length,
-      active: viewMode === "recent",
-      onClick: () => {
-        onSelectSet(null);
-        onSelectViewMode(viewMode === "recent" ? "all" : "recent");
-      },
-    },
-  ];
-
-  return (
-    <section className="min-w-0 max-w-full lg:hidden" data-testid="favourites-quick-views" aria-label="Quick views">
-      <div className="-mx-4 overflow-x-auto overscroll-x-contain px-4 pb-1 [scrollbar-width:none] sm:-mx-6 sm:px-6">
-        <div className="flex w-max max-w-none gap-2 pr-1">
-          {chips.map((chip) => {
-            const Icon = chip.icon;
-            return (
-              <button
-                key={chip.id}
-                type="button"
-                aria-pressed={chip.active}
-                onClick={chip.onClick}
-                className={cn(
-                  "inline-flex h-tap shrink-0 items-center gap-1.5 rounded-full border px-3.5 text-sm-minus font-semibold transition",
-                  chip.active
-                    ? "border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)] shadow-[var(--e1)]"
-                    : "border-[color:var(--border)] bg-[color:var(--surface)] text-[color:var(--text-muted)] hover:border-[color:var(--border-strong)] hover:text-[color:var(--text)]",
-                  focusRing,
-                )}
-              >
-                <Icon className="h-4 w-4 shrink-0" aria-hidden />
-                <span className="whitespace-nowrap">{chip.label}</span>
-                <span
-                  className={cn(
-                    "nums rounded-full px-1.5 text-2xs font-bold leading-none",
-                    chip.active
-                      ? "bg-[color:var(--clinical-accent)]/12 text-[color:var(--clinical-accent)]"
-                      : "bg-[color:var(--surface-subtle)] text-[color:var(--text-muted)]",
-                  )}
-                >
-                  {chip.count}
-                </span>
-              </button>
-            );
-          })}
-        </div>
-      </div>
-    </section>
-  );
-}
-
-export function FavouritesMobileBrowseRail({
-  sets,
-  selectedSetId,
-  viewMode,
-  onSelectSet,
-  onSelectViewMode,
-}: Pick<FavouritesNavProps, "sets" | "selectedSetId" | "viewMode" | "onSelectSet" | "onSelectViewMode">) {
-  if (sets.length === 0) return null;
-
-  return (
-    <section className="min-w-0 max-w-full lg:hidden" data-testid="favourites-set-carousel" aria-label="Saved sets">
-      <h2 className="mb-2 text-2xs font-semibold uppercase tracking-eyebrow text-[color:var(--text-muted)]">
-        Browse sets
-      </h2>
-      <div className="-mx-4 overflow-x-auto overscroll-x-contain px-4 pb-1 [scrollbar-width:thin] sm:-mx-6 sm:px-6">
-        <div className="flex w-max max-w-none gap-2.5 pr-1">
-          {sets.map((set) => (
-            <SetBrowseCard
-              key={set.id}
-              set={set}
-              accentClass={setAccentBar}
-              active={selectedSetId === set.id && viewMode === "all"}
-              onClick={() => {
-                onSelectViewMode("all");
-                onSelectSet(selectedSetId === set.id ? null : set.id);
-              }}
-            />
-          ))}
-        </div>
-      </div>
-    </section>
-  );
-}
diff --git a/src/components/clinical-dashboard/global-search-shell.tsx b/src/components/clinical-dashboard/global-search-shell.tsx
index 888704d626..ab549142ab 100644
--- a/src/components/clinical-dashboard/global-search-shell.tsx
+++ b/src/components/clinical-dashboard/global-search-shell.tsx
@@ -108,6 +108,8 @@ type GlobalSearchShellProps = {
   initialMode?: AppModeId;
   availableModeIds?: readonly AppModeId[];
   desktopSearchPlacement?: "default" | "hero";
+  /** Override the phone placement for a standalone mode home's shared composer. */
+  mobileHomeComposerPlacement?: "hero" | "footer";
   /** Hide the shared search composer on routes that provide their own search surface. */
   searchComposerVisible?: boolean;
   /** Keep the global header/search while allowing a route to use the full desktop canvas. */
@@ -311,6 +313,7 @@ function GlobalStandaloneSearchShellBody({
   initialMode = "answer",
   availableModeIds,
   desktopSearchPlacement = "default",
+  mobileHomeComposerPlacement = "hero",
   searchComposerVisible = true,
   hideDesktopSidebar = false,
   chromeVisible = true,
@@ -444,9 +447,14 @@ function GlobalStandaloneSearchShellBody({
     searchComposerVisible &&
     !isDifferentialPresentationWorkflow &&
     (!isInfoPage || isToolDetailWithFooterSearch(pathname));
+  const heroOwnsPhoneComposer = isStandaloneModeHome && mobileHomeComposerPlacement === "hero";
+  // This flag controls sm+ padding, where every standalone home (including
+  // Tools) keeps its composer in flow. Phone clearance is resolved separately
+  // from heroOwnsPhoneComposer below.
   const reservesFloatingComposer = shouldShowSearchComposer && !isStandaloneModeHome;
-  // Standalone mode homes keep the in-flow hero pill at every width (no phone
-  // dock reserve). Document viewer routes own their own floating composer, so
+  // Most standalone mode homes keep the in-flow hero pill at every width. Tools
+  // deliberately uses the shared footer on phones. Document viewer routes own
+  // their own floating composer, so
   // the shell keeps only a small pad and lets DocumentViewer manage clearance.
   // Release the large bottom reserve only when the phone bottom composer is
   // actually hidden (MasterSearchHeader's bottomComposerHidden). Header-only
@@ -461,7 +469,7 @@ function GlobalStandaloneSearchShellBody({
     resolveShellVisibleMobileComposerReserve({
       shouldShowSearchComposer,
       pageOwnedComposerRoute: isPageOwnedComposerRoute(pathname),
-      isStandaloneModeHome,
+      heroOwnsPhoneComposer,
       searchMode,
       differentialsCompareAddonActive,
     }),
@@ -638,8 +646,8 @@ function GlobalStandaloneSearchShellBody({
     router.push(appModeHomeHref(mode, nextOptions));
   }
 
-  function submitSearch() {
-    const trimmedQuery = query.trim();
+  function submitSearch(queryOverride?: string) {
+    const trimmedQuery = (queryOverride ?? query).trim();
     navigateToMode(searchMode, {
       query: trimmedQuery || undefined,
       run: Boolean(trimmedQuery),
@@ -856,7 +864,9 @@ function GlobalStandaloneSearchShellBody({
             onAsk={submitSearch}
             onClearQuery={() => {
               setQuery("");
-              if (isStandaloneModeHome) navigateToMode(searchMode, { focus: true });
+              if (isStandaloneModeHome || searchMode === "calculators") {
+                navigateToMode(searchMode, { focus: true });
+              }
             }}
             onClearScope={() => undefined}
             onQueryModeChange={setQueryMode}
@@ -890,11 +900,10 @@ function GlobalStandaloneSearchShellBody({
             desktopPageComposerSlotId={
               shouldShowSearchComposer && !isStandaloneModeHome ? desktopPageComposerSlotId : undefined
             }
-            // Standalone mode homes keep the in-flow hero pill at every width,
-            // phones included — the composer sits in the middle of the hero and
-            // scrolls with the content, matching the answer home rather than
-            // docking to the bottom edge.
-            heroComposerBreakpoint="all"
+            // Most standalone homes keep the in-flow hero pill at every width.
+            // Tools keeps that placement from sm up but uses the same global
+            // footer dock as submitted views on phones.
+            heroComposerBreakpoint={mobileHomeComposerPlacement === "footer" ? "sm-up" : "all"}
             // Phones: #main-content owns vertical scroll, so hide-on-scroll
             // collapses the top bar to hand space back to content.
             // Tablet and desktop portal search into normal page flow. The outer
@@ -934,7 +943,7 @@ function GlobalStandaloneSearchShellBody({
           data-chrome-transitioning={chromeTransitioning ? "true" : undefined}
           data-phone-scroll-owner={activeScrollOwner}
           data-phone-footer-owner={
-            isStandaloneModeHome
+            heroOwnsPhoneComposer
               ? "hero"
               : isPageOwnedComposerRoute(pathname)
                 ? "page"
diff --git a/src/components/clinical-dashboard/guide-dialog.tsx b/src/components/clinical-dashboard/guide-dialog.tsx
index e87d9064e5..f13df3d1f1 100644
--- a/src/components/clinical-dashboard/guide-dialog.tsx
+++ b/src/components/clinical-dashboard/guide-dialog.tsx
@@ -23,7 +23,7 @@ import {
   X,
   type LucideIcon,
 } from "lucide-react";
-import { useMemo, useRef, useState } from "react";
+import { useMemo, useRef, useState, useSyncExternalStore, type UIEvent } from "react";
 
 import {
   guideQuickTasks,
@@ -57,6 +57,23 @@ import {
 } from "@/components/ui-primitives";
 
 const guideAccessibleNameId = "clinical-kb-guide-accessible-name";
+const phoneMediaQuery = "(max-width: 639px)";
+
+function subscribeToPhoneMedia(callback: () => void) {
+  if (typeof window === "undefined" || typeof window.matchMedia !== "function") return () => undefined;
+  const media = window.matchMedia(phoneMediaQuery);
+  media.addEventListener("change", callback);
+  return () => media.removeEventListener("change", callback);
+}
+
+function getPhoneMediaSnapshot() {
+  if (typeof window === "undefined" || typeof window.matchMedia !== "function") return false;
+  return window.matchMedia(phoneMediaQuery).matches;
+}
+
+function usePhoneViewport() {
+  return useSyncExternalStore(subscribeToPhoneMedia, getPhoneMediaSnapshot, () => false);
+}
 
 const topicIcons: Record<GuideTopicId, LucideIcon> = {
   "getting-started": BookOpen,
@@ -270,34 +287,45 @@ function VerificationDemo({ onOpenSourceGuide }: { onOpenSourceGuide: () => void
         Follow each claim to the source before using it in practice.
       </p>
 
-      <div className="mt-5 grid gap-3 sm:grid-cols-[8rem_minmax(0,1fr)]">
-        <ol className="space-y-3" aria-label="Verification steps">
+      <div className="mt-5 grid gap-4 md:grid-cols-[11rem_minmax(0,1fr)]">
+        <ol className="grid grid-cols-3 gap-2 md:grid-cols-1 md:gap-3" aria-label="Verification steps">
           {["Check the claim", "Open the citation", "Read the source passage"].map((label, index) => (
-            <li key={label} className="flex items-start gap-2 text-sm font-medium text-[color:var(--text-heading)]">
+            <li
+              key={label}
+              className="flex min-w-0 flex-col items-center gap-1.5 text-center text-xs font-medium text-[color:var(--text-heading)] md:flex-row md:items-start md:gap-2 md:text-left md:text-sm"
+            >
               <span className="grid size-7 shrink-0 place-items-center rounded-full bg-[color:var(--clinical-accent)] text-xs font-bold text-[color:var(--clinical-accent-contrast)]">
                 {index + 1}
               </span>
-              <span className="pt-1">{label}</span>
+              <span className="leading-4 md:pt-1 md:leading-5">{label}</span>
             </li>
           ))}
         </ol>
 
         <div className="space-y-3">
           <article className="rounded-xl border border-[color:var(--border)] bg-[color:var(--surface-raised)] p-4 shadow-[var(--shadow-inset)]">
-            <h3 className="text-base font-semibold text-[color:var(--text-heading)]">Answer preview</h3>
-            <div className="mt-3 space-y-3" aria-label="Neutral illustrative answer">
-              <div className="flex items-center gap-2">
-                <span className="h-2.5 flex-1 rounded-full bg-[color:var(--surface-subtle)]" />
-                <span className="rounded-md border border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)] px-2 py-1 font-mono text-xs font-semibold text-[color:var(--clinical-accent)]">
+            <p className={cn(eyebrowText, "text-[color:var(--clinical-accent)]")}>Illustrative answer</p>
+            <h3 className="mt-1 text-base font-semibold text-[color:var(--text-heading)]">
+              Check each claim, not just the summary
+            </h3>
+            <div
+              className="mt-3 space-y-3 text-sm leading-6 text-[color:var(--text)]"
+              aria-label="Neutral illustrative answer"
+            >
+              <p>
+                The answer should state a focused claim and place its citation beside the words it supports{" "}
+                <span className="inline-flex rounded-md border border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)] px-1.5 py-0.5 font-mono text-xs font-semibold text-[color:var(--clinical-accent)]">
                   [1]
                 </span>
-              </div>
-              <div className="flex items-center gap-2">
-                <span className="h-2.5 w-4/5 rounded-full bg-[color:var(--surface-subtle)]" />
-                <span className="rounded-md border border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)] px-2 py-1 font-mono text-xs font-semibold text-[color:var(--clinical-accent)]">
+                .
+              </p>
+              <p className="border-l-2 border-[color:var(--clinical-accent)] pl-3 text-[color:var(--text-muted)]">
+                Open the citation and compare the source passage with the wording, population, and limits of the claim{" "}
+                <span className="inline-flex rounded-md border border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)] px-1.5 py-0.5 font-mono text-xs font-semibold text-[color:var(--clinical-accent)]">
                   [2]
                 </span>
-              </div>
+                .
+              </p>
             </div>
           </article>
 
@@ -652,14 +680,35 @@ function GuideDialogSession({ onClose }: { onClose: () => void }) {
   const [tourStepIndex, setTourStepIndex] = useState(0);
   const [tourComplete, setTourComplete] = useState(false);
   const contentStartRef = useRef<HTMLDivElement | null>(null);
+  const scrollBodyRef = useRef<HTMLDivElement | null>(null);
+  const lastScrollTopRef = useRef(0);
+  const [mobileFooterHidden, setMobileFooterHidden] = useState(false);
+  const isPhoneViewport = usePhoneViewport();
+  const footerHidden = isPhoneViewport && mobileFooterHidden;
 
   function focusPageStart() {
     window.requestAnimationFrame(() => {
-      contentStartRef.current?.scrollIntoView({ block: "start" });
+      if (scrollBodyRef.current) scrollBodyRef.current.scrollTop = 0;
+      lastScrollTopRef.current = 0;
+      setMobileFooterHidden(false);
       contentStartRef.current?.querySelector<HTMLElement>("[data-guide-page-heading]")?.focus({ preventScroll: true });
     });
   }
 
+  function handleBodyScroll(event: UIEvent<HTMLDivElement>) {
+    const nextScrollTop = event.currentTarget.scrollTop;
+    if (!isPhoneViewport) {
+      lastScrollTopRef.current = nextScrollTop;
+      setMobileFooterHidden(false);
+      return;
+    }
+    const delta = nextScrollTop - lastScrollTopRef.current;
+    if (nextScrollTop <= 12) setMobileFooterHidden(false);
+    else if (delta > 6) setMobileFooterHidden(true);
+    else if (delta < -6) setMobileFooterHidden(false);
+    lastScrollTopRef.current = nextScrollTop;
+  }
+
   function navigate(nextView: GuideView) {
     setQuery("");
     if (nextView === "tour") {
@@ -713,11 +762,16 @@ function GuideDialogSession({ onClose }: { onClose: () => void }) {
         ? "Review guided tour"
         : "Resume guided tour";
   const footer = (
-    <div className="flex min-w-0 items-center justify-between gap-3">
+    <div
+      data-guide-mobile-footer
+      aria-hidden={footerHidden}
+      inert={footerHidden || undefined}
+      className="flex min-w-0 items-center justify-center gap-3 sm:justify-between"
+    >
       <p className={cn("hidden min-w-0 items-center gap-2 text-xs sm:flex", textMuted)}>
         <ShieldCheck aria-hidden="true" className="size-icon-md shrink-0" /> Demo content only · Do not enter PHI
       </p>
-      <div className="ml-auto flex min-w-0 items-center justify-end gap-2">
+      <div className="flex min-w-0 items-center justify-center gap-2 sm:ml-auto sm:justify-end">
         {view === "tour" && !tourComplete ? (
           <>
             <button
@@ -798,10 +852,18 @@ function GuideDialogSession({ onClose }: { onClose: () => void }) {
           <BookOpen aria-hidden="true" className="size-6" />
         </span>
       }
-      contentClassName="font-sans sm:max-w-none lg:h-[min(56rem,calc(100dvh-3rem))] lg:max-w-[min(94vw,90rem)]"
+      contentClassName="relative font-sans sm:max-w-none lg:h-[min(56rem,calc(100dvh-3rem))] lg:max-w-[min(94vw,90rem)]"
       bodyClassName="p-0 sm:p-0"
+      bodyRef={scrollBodyRef}
+      onBodyScroll={handleBodyScroll}
+      headerClassName="pt-[max(1rem,env(safe-area-inset-top))] sm:pt-5"
       mobilePlacement="fullscreen"
       footer={footer}
+      footerClassName={cn(
+        "absolute inset-x-0 bottom-0 z-30 pl-[max(0.75rem,env(safe-area-inset-left))] pr-[max(0.75rem,env(safe-area-inset-right))] pb-[max(0.75rem,env(safe-area-inset-bottom))] pt-3 transition-[transform,opacity] duration-[var(--duration-quick)] sm:static sm:p-4",
+        footerHidden &&
+          "pointer-events-none translate-y-full opacity-0 sm:pointer-events-auto sm:translate-y-0 sm:opacity-100",
+      )}
       testId="clinical-kb-guide-centre"
       closeButtonClassName="grid size-tap shrink-0 place-items-center rounded-full border border-[color:var(--clinical-accent-border)] text-[color:var(--text-muted)] transition hover:bg-[color:var(--clinical-accent-soft)] hover:text-[color:var(--clinical-accent)] focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)]"
     >
@@ -812,7 +874,11 @@ function GuideDialogSession({ onClose }: { onClose: () => void }) {
         <GuideSearch query={query} onQueryChange={setQuery} />
       </div>
       <GuideTopNavigation view={view} onNavigate={navigate} />
-      <div ref={contentStartRef} className="space-y-4 p-3 sm:p-5">
+      <div
+        ref={contentStartRef}
+        data-guide-content
+        className={cn("space-y-4 p-3 sm:p-5", footerHidden ? "pb-0" : "pb-28")}
+      >
         {hasSearch ? (
           <SearchResults query={query} onSelect={openTopic} />
         ) : (
diff --git a/src/components/clinical-dashboard/master-search-header.tsx b/src/components/clinical-dashboard/master-search-header.tsx
index 471929f013..f1926ccd00 100644
--- a/src/components/clinical-dashboard/master-search-header.tsx
+++ b/src/components/clinical-dashboard/master-search-header.tsx
@@ -37,6 +37,7 @@ import { PrivacyInputNotice } from "@/components/privacy-input-notice";
 import { restoreFocusUnlessMoved, useDismissableLayer } from "@/components/use-dismissable-layer";
 import { useHideOnScroll } from "@/components/clinical-dashboard/use-hide-on-scroll";
 import { useEventCallback } from "@/components/clinical-dashboard/use-event-callback";
+import { useLastAppMode } from "@/components/clinical-dashboard/use-last-app-mode";
 import { BrandMark } from "@/components/clinical-dashboard/brand";
 import { PhoneFooterLayerPortal } from "@/components/clinical-dashboard/phone-footer-layer-portal";
 import { AnswerFollowUpSuggestions } from "@/components/clinical-dashboard/answer-follow-up-suggestions";
@@ -113,8 +114,8 @@ const phoneModeGroups = [
   {
     id: "care",
     label: "Care",
-    hint: "Medication, tools, therapy",
-    modeIds: ["prescribing", "tools", "therapy-compass", "factsheets"],
+    hint: "Medication, calculators, tools, therapy",
+    modeIds: ["prescribing", "calculators", "tools", "therapy-compass", "factsheets"],
   },
 ] as const satisfies ReadonlyArray<{
   id: string;
@@ -246,7 +247,7 @@ export function MasterSearchHeader({
   realDataReady: boolean;
   onQueryChange: (query: string) => void;
   onSearchModeChange: (mode: AppModeId) => void;
-  onAsk: () => void;
+  onAsk: (query?: string) => void;
   onClearQuery: () => void;
   onClearScope: () => void;
   onQueryModeChange: (mode: ClinicalQueryMode) => void;
@@ -354,6 +355,7 @@ export function MasterSearchHeader({
   // Hosts pass the precomputed session decision in canAccessFavourites (auth || demo).
   // Do not OR demoMode again here — that would reopen Favourites when props diverge.
   const router = useRouter();
+  const [, setLastAppMode] = useLastAppMode();
   const visibleAppModeOptions = visibleAppModeDefinitionsForSession({
     authenticated: canAccessFavourites,
     demoMode: false,
@@ -374,6 +376,7 @@ export function MasterSearchHeader({
     selectedSearch.kind === "forms" ||
     selectedSearch.kind === "services" ||
     selectedSearch.kind === "tools" ||
+    selectedSearch.kind === "calculators" ||
     selectedSearch.kind === "favourites" ||
     selectedSearch.kind === "specifiers" ||
     selectedSearch.kind === "formulation" ||
@@ -657,9 +660,11 @@ export function MasterSearchHeader({
                       ? "formulation"
                       : searchMode === "tools"
                         ? "tools"
-                        : searchMode === "factsheets"
-                          ? "factsheets"
-                          : "answer";
+                        : searchMode === "calculators"
+                          ? "calculators"
+                          : searchMode === "factsheets"
+                            ? "factsheets"
+                            : "answer";
   const actionMenuItems = modeActionItemsFor(actionMenuSetId);
   const actionMenuButtonLabel = `Open ${selectedAppMode.label.toLowerCase()} options`;
 
@@ -814,6 +819,10 @@ export function MasterSearchHeader({
       onSearchModeChange("tools");
       return;
     }
+    if (actionId === "calculators-browse") {
+      router.push("/calculators");
+      return;
+    }
     if (actionId === "differentials-build") {
       onSearchModeChange("differentials");
       onQueryChange(trimmedQuery || "acute confusion differential diagnosis");
@@ -883,6 +892,30 @@ export function MasterSearchHeader({
 
   function selectAppMode(mode: (typeof appModeDefinitions)[number]) {
     setModeMenuOpen(false);
+    if (mode.id === "tools" && "href" in mode && mode.href) {
+      // Tools is a browse-first directory: selecting it opens the canonical
+      // all-tools page instead of retargeting the shared-home composer.
+      // Persist the selection here rather than via onSearchModeChange: that
+      // callback owns shared-home navigation and would race this canonical push.
+      setLastAppMode(mode.id);
+      pendingModeSelectionFocusRef.current = mode.id;
+      router.push(mode.href);
+      if (mode.id === searchMode) {
+        const restoreSameModeFocus = () => {
+          if (pendingModeSelectionFocusRef.current !== mode.id) return;
+          if (document.getElementById("app-mode-menu")) {
+            window.setTimeout(restoreSameModeFocus, 50);
+            return;
+          }
+          restoreFocusUnlessMoved(modeButtonRef.current);
+          pendingModeSelectionFocusRef.current = null;
+        };
+        window.requestAnimationFrame(() => {
+          window.requestAnimationFrame(restoreSameModeFocus);
+        });
+      }
+      return;
+    }
     if (isSearchableAppMode(mode.id)) {
       // Wait until the URL-owned mode prop settles before returning focus. The
       // trigger's accessible name changes with that prop; focusing in the click
@@ -987,11 +1020,11 @@ export function MasterSearchHeader({
   // Prefetch only the mode the user is about to choose — the highlighted option
   // on open, then whichever option receives focus/pointer while scanning.
   //
-  // A pick always returns to the shared home; warm that exact URL rather than a
-  // mode-owned home or search route the user has not asked to open.
+  // Most picks return to the shared home. Tools is browse-first and opens its
+  // canonical all-results directory, so warm that route instead.
   function prefetchModeSelection(modeId: AppModeId) {
     if (modeId === searchMode) return;
-    const href = appModeSelectionHref(modeId);
+    const href = modeId === "tools" ? "/tools" : appModeSelectionHref(modeId);
     if (prefetchedModeHrefsRef.current.has(href)) return;
     prefetchedModeHrefsRef.current.add(href);
     router.prefetch(href, {
@@ -2368,6 +2401,7 @@ export function MasterSearchHeader({
           portal
           mobilePlacement="bottom"
           mobileSize="content"
+          mobileHeaderSafeArea="padding"
           testId="app-mode-menu-sheet"
           contentClassName="max-h-[calc(100dvh-0.75rem)] rounded-t-3xl bg-[color:var(--surface-lux)] sm:max-w-md sm:rounded-2xl"
           bodyClassName="bg-[color:var(--surface-lux)] px-2.5 pb-2 pt-0.5"
diff --git a/src/components/clinical-dashboard/medication-nav-header.tsx b/src/components/clinical-dashboard/medication-nav-header.tsx
index 359427d656..14781d6bfc 100644
--- a/src/components/clinical-dashboard/medication-nav-header.tsx
+++ b/src/components/clinical-dashboard/medication-nav-header.tsx
@@ -170,6 +170,7 @@ export function MedicationNavHeader({
   return (
     <InPageNavHeader
       {...shared}
+      className="sm:border-b-[color:var(--border-lux)] sm:bg-[color:var(--surface-lux)] sm:py-3 sm:shadow-[var(--e1)]"
       sections={buildMedicationNavSections(record)}
       activeId={activeTab}
       onSelectSection={(id) => {
diff --git a/src/components/clinical-dashboard/medication-prescribing-workspace.tsx b/src/components/clinical-dashboard/medication-prescribing-workspace.tsx
index 4dc05878f6..1167367eca 100644
--- a/src/components/clinical-dashboard/medication-prescribing-workspace.tsx
+++ b/src/components/clinical-dashboard/medication-prescribing-workspace.tsx
@@ -385,13 +385,13 @@ function HighlightedName({ text, term }: { text: string; term: string }) {
   );
 }
 
-function DoseCeiling({ value }: { value: string }) {
+function MaximumDose({ value }: { value: string }) {
   return (
-    <span className="inline-flex min-h-6 w-fit items-center gap-1.5 text-2xs font-semibold text-[color:var(--text-muted)]">
+    <span className="inline-grid min-h-6 min-w-0 max-w-full grid-cols-[auto_minmax(0,1fr)] items-center gap-x-2 gap-y-1 text-2xs font-semibold text-[color:var(--text-muted)]">
       <span className="rounded border border-[color:var(--border)] bg-[color:var(--surface-subtle)] px-1.5 py-0.5 text-2xs uppercase tracking-label text-[color:var(--text-muted)]">
-        Ceiling
+        Max
       </span>
-      <span className="nums break-words text-[color:var(--text-heading)] md:whitespace-nowrap">{value}</span>
+      <span className="nums min-w-0 break-words leading-5 text-[color:var(--text-heading)]">{value}</span>
     </span>
   );
 }
@@ -601,11 +601,11 @@ function MedicationResults({
       ) : null}
 
       {!initialCatalogLoading && !catalog.error && resultCount > 0 ? (
-        <div className="hidden overflow-hidden rounded-lg border border-[color:var(--border)] bg-[color:var(--surface-raised)] shadow-[var(--shadow-soft)] lg:block">
-          <div className="grid grid-cols-[minmax(16rem,1.15fr)_minmax(6.5rem,0.42fr)_minmax(8rem,0.48fr)_minmax(16rem,1fr)_2rem] border-b border-[color:var(--border)] bg-[color:var(--surface-subtle)] px-4 py-2 text-2xs font-semibold uppercase tracking-eyebrow text-[color:var(--text-muted)]">
+        <div className="hidden overflow-hidden rounded-xl border border-[color:var(--border)] bg-[color:var(--surface-raised)] shadow-[var(--shadow-soft)] lg:block">
+          <div className="grid grid-cols-[minmax(12rem,1.12fr)_minmax(5.5rem,0.46fr)_minmax(7rem,0.66fr)_minmax(12rem,1.15fr)_1.5rem] gap-3 border-b border-[color:var(--border)] bg-[color:var(--surface-subtle)] px-4 py-2.5 text-2xs font-semibold uppercase tracking-eyebrow text-[color:var(--text-muted)]">
             <span>Medication</span>
-            <span>Dose</span>
-            <span>Ceiling</span>
+            <span>Usual dose</span>
+            <span>Max dose</span>
             <span>Prescribing action</span>
             <span className="sr-only">Open</span>
           </div>
@@ -618,7 +618,7 @@ function MedicationResults({
               // outranks "this is the top hit".
               const verdictRing = row.verdict ? medicationVerdictRingClass(row.verdict.tone) : null;
               const rowClassName = cn(
-                "group grid w-full grid-cols-[minmax(16rem,1.15fr)_minmax(6.5rem,0.42fr)_minmax(8rem,0.48fr)_minmax(16rem,1fr)_2rem] items-center gap-2.5 px-4 py-2.5 text-left transition focus-visible:outline focus-visible:outline-2 focus-visible:outline-inset focus-visible:outline-[color:var(--focus)]",
+                "group grid w-full grid-cols-[minmax(12rem,1.12fr)_minmax(5.5rem,0.46fr)_minmax(7rem,0.66fr)_minmax(12rem,1.15fr)_1.5rem] items-start gap-3 px-4 py-3.5 text-left transition focus-visible:outline focus-visible:outline-2 focus-visible:outline-inset focus-visible:outline-[color:var(--focus)]",
                 selected
                   ? cn(
                       "bg-[color:var(--clinical-accent-soft)]/35 shadow-[var(--shadow-rail-active)]",
@@ -631,17 +631,17 @@ function MedicationResults({
               );
               const rowContent = (
                 <>
-                  <div className="flex min-w-0 items-center gap-2.5">
+                  <div className="flex min-w-0 items-start gap-3">
                     <ResultToneIcon result={result} accent={row.accent} />
                     <div className="min-w-0">
-                      <span className="block break-words text-base-minus font-semibold text-[color:var(--text-heading)]">
+                      <span className="block break-words text-base-minus font-semibold leading-5 text-[color:var(--text-heading)]">
                         <HighlightedName text={result.name} term={query} />
                       </span>
-                      <span className="line-clamp-1 break-words text-xs font-medium text-[color:var(--text-muted)]">
+                      <span className="mt-0.5 line-clamp-1 break-words text-xs font-medium leading-4 text-[color:var(--text-muted)]">
                         {result.indication}
                       </span>
                       {showMatchBadge || result.match !== "Exact clinical fit" || row.badges.length > 0 ? (
-                        <div className="mt-1 flex min-w-0 flex-wrap items-center gap-1">
+                        <div className="mt-1.5 flex min-w-0 flex-wrap items-center gap-1.5">
                           {showMatchBadge || result.match !== "Exact clinical fit" ? (
                             <ResultMatchBadge result={result} />
                           ) : null}
@@ -650,12 +650,17 @@ function MedicationResults({
                       ) : null}
                     </div>
                   </div>
-                  <span className="nums line-clamp-2 text-sm-minus font-semibold text-[color:var(--text-heading)]">
+                  <span className="nums line-clamp-2 min-w-0 break-words pt-0.5 text-sm-minus font-semibold leading-5 text-[color:var(--text-heading)]">
                     {result.dose}
                   </span>
-                  <DoseCeiling value={result.ceiling} />
-                  <span className="flex min-w-0 items-start gap-1.5 text-sm-minus font-medium leading-snug text-[color:var(--text-heading)]">
-                    <ActionToneIcon tone={result.actionTone} className="mt-0.5 h-3.5 w-3.5" />
+                  <div data-medication-cell="ceiling" className="min-w-0 pt-0.5">
+                    <MaximumDose value={result.ceiling} />
+                  </div>
+                  <span
+                    data-medication-cell="action"
+                    className="flex min-w-0 items-start gap-2 pt-0.5 text-sm-minus font-medium leading-5 text-[color:var(--text-heading)]"
+                  >
+                    <ActionToneIcon tone={result.actionTone} className="mt-[0.1875rem] h-3.5 w-3.5" />
                     <span className="line-clamp-2 min-w-0 break-words">{result.action}</span>
                   </span>
                   {result.href ? (
@@ -732,7 +737,7 @@ function MedicationResults({
                 ) : null}
                 <div className="flex max-w-full flex-wrap items-center gap-1.5 text-sm-minus font-semibold text-[color:var(--text-heading)]">
                   <span className="nums line-clamp-2 break-words">{result.dose}</span>
-                  <DoseCeiling value={result.ceiling} />
+                  <MaximumDose value={result.ceiling} />
                 </div>
                 <p className="line-clamp-2 break-words text-pretty text-xs leading-normal text-[color:var(--text-muted)]">
                   <ActionToneIcon tone={result.actionTone} className="mr-1 inline-block h-3.5 w-3.5 align-[-0.15em]" />
diff --git a/src/components/clinical-dashboard/medication-record-page.tsx b/src/components/clinical-dashboard/medication-record-page.tsx
index e65b32b8b1..4f08c683cf 100644
--- a/src/components/clinical-dashboard/medication-record-page.tsx
+++ b/src/components/clinical-dashboard/medication-record-page.tsx
@@ -185,7 +185,10 @@ function SectionCard({ section }: { section: MedicationSection }) {
   return (
     <details
       className="group scroll-mt-16 border-b border-[color:var(--border)] last:border-b-0"
-      open={section.type === "summary" || section.type === "dose"}
+      // The category switcher already limits how much content is on screen.
+      // Open every card on arrival so switching category reveals its complete
+      // reference at once; native details still lets readers fold a card back.
+      open
     >
       <summary className="flex min-h-12 cursor-pointer list-none items-center justify-between gap-3 px-3 text-left [&::-webkit-details-marker]:hidden">
         <span className="flex min-w-0 items-center gap-2.5">
diff --git a/src/components/clinical-dashboard/mobile-composer-reserve.ts b/src/components/clinical-dashboard/mobile-composer-reserve.ts
index 037b21780a..8c1bb6aa2e 100644
--- a/src/components/clinical-dashboard/mobile-composer-reserve.ts
+++ b/src/components/clinical-dashboard/mobile-composer-reserve.ts
@@ -63,14 +63,9 @@ export function isDocumentViewerOwnedRoute(pathname: string): boolean {
   return pathname !== "/documents/search";
 }
 
-/** Calculators owns its desktop top + phone bottom search composer. */
-export function isCalculatorsOwnedRoute(pathname: string): boolean {
-  return pathname === "/calculators" || pathname.startsWith("/calculators/");
-}
-
 /** Routes that own a floating/page composer so the shell keeps only a zero pad. */
 export function isPageOwnedComposerRoute(pathname: string): boolean {
-  return isDocumentViewerOwnedRoute(pathname) || isCalculatorsOwnedRoute(pathname);
+  return isDocumentViewerOwnedRoute(pathname);
 }
 
 /*
@@ -118,22 +113,23 @@ export function resolveShellVisibleMobileComposerReserve(input: {
   /** @deprecated Prefer pageOwnedComposerRoute */
   documentViewerOwnedRoute?: boolean;
   pageOwnedComposerRoute?: boolean;
-  isStandaloneModeHome: boolean;
+  /** The standalone hero owns the phone composer instead of the shared footer dock. */
+  heroOwnsPhoneComposer: boolean;
   searchMode: string;
   differentialsCompareAddonActive: boolean;
   patientDetailsAddonActive?: boolean;
 }): string {
   if (!input.shouldShowSearchComposer) {
-    // Page-owned composers (DocumentViewer, Calculators) manage their own dock
+    // Page-owned composers (DocumentViewer) manage their own dock
     // clearance; the shell keeps only the hidden-size pad.
     const pageOwned = input.pageOwnedComposerRoute ?? input.documentViewerOwnedRoute ?? false;
     return pageOwned ? mobileComposerHiddenReserve : mobileComposerIdleReserve;
   }
-  // Standalone mode homes keep the in-flow hero pill at every width (phones
-  // included), so the composer sits in the content flow rather than docking to
-  // the bottom edge. Reserve only the idle content pad — matching the answer
-  // home hero — so no empty band opens below the pill.
-  if (input.isStandaloneModeHome) return mobileComposerIdleReserve;
+  // An all-width hero composer sits in content flow rather than docking to the
+  // bottom edge. Reserve only the idle content pad so no empty band opens below
+  // the pill. Standalone homes whose phone placement is the shared footer use
+  // the normal shell dock reserve below.
+  if (input.heroOwnsPhoneComposer) return mobileComposerIdleReserve;
   if (input.searchMode === "answer") return mobileComposerVisibleReserve.shellAnswer;
   if (input.differentialsCompareAddonActive) return mobileComposerVisibleReserve.differentialsCompare;
   if (input.patientDetailsAddonActive) return mobileComposerVisibleReserve.patientDetails;
diff --git a/src/components/clinical-dashboard/mode-action-popup.tsx b/src/components/clinical-dashboard/mode-action-popup.tsx
index 0da42b6f85..dbe4a78a7b 100644
--- a/src/components/clinical-dashboard/mode-action-popup.tsx
+++ b/src/components/clinical-dashboard/mode-action-popup.tsx
@@ -19,6 +19,7 @@ import {
   BookOpenText,
   TriangleAlert,
   CalendarDays,
+  Calculator,
   Check,
   ChevronDown,
   ChevronRight,
@@ -57,6 +58,7 @@ export type ModeActionSetId =
   | "forms"
   | "favourites"
   | "tools"
+  | "calculators"
   | "differentials"
   | "dsm"
   | "specifiers"
@@ -123,6 +125,7 @@ export type ModeActionId =
   | "medication-access"
   | "tools-browse"
   | "tools-new"
+  | "calculators-browse"
   | "differentials-build"
   | "differentials-criteria"
   | "differentials-documents"
@@ -227,6 +230,15 @@ const modeActionSets = {
     },
     { id: "tools-new", label: "New answer", description: "Clear the current thread", icon: Sparkles },
   ],
+  calculators: [
+    {
+      id: "calculators-browse",
+      label: "Browse calculators",
+      description: "Open the calculator catalogue",
+      icon: Calculator,
+      primary: true,
+    },
+  ],
   differentials: [
     {
       id: "differentials-build",
diff --git a/src/components/clinical-dashboard/search-utils.ts b/src/components/clinical-dashboard/search-utils.ts
index 083081dd5e..494d3c3207 100644
--- a/src/components/clinical-dashboard/search-utils.ts
+++ b/src/components/clinical-dashboard/search-utils.ts
@@ -2,12 +2,22 @@ import {
   normalizeAnswerProgressEvent,
   type AnswerProgressUpdate,
 } from "@/components/clinical-dashboard/answer-progress";
+import { isAnswerStreamEventName, type VerifiedEvidencePreviewUnit } from "@/lib/answer-stream-contract";
 import type { RagAnswer } from "@/lib/types";
 
 export { keywordQueryFromNaturalLanguage } from "@/lib/keyword-query";
 
 export type AnswerPayload = RagAnswer & { demoMode?: boolean };
 
+export function evidencePreviewReconcilesWithFinal(preview: VerifiedEvidencePreviewUnit, finalPayload: AnswerPayload) {
+  const finalSourcesByIdentity = new Map(
+    finalPayload.sources.map((source) => [`${source.document_id}:${source.id}`, JSON.stringify(source)]),
+  );
+  return preview.sources.every(
+    (source) => finalSourcesByIdentity.get(`${source.document_id}:${source.id}`) === JSON.stringify(source),
+  );
+}
+
 const answerConfidenceValues = new Set<AnswerPayload["confidence"]>(["high", "medium", "low", "unsupported"]);
 
 export function isAnswerPayload(value: unknown): value is AnswerPayload {
@@ -59,9 +69,10 @@ function findSseSeparator(buffer: string) {
 export async function readAnswerStream(
   response: Response,
   onProgress: (progress: AnswerProgressUpdate) => void,
-  onToken?: (delta: string) => void,
+  _onToken?: (delta: string) => void,
   onRevising?: () => void,
   onActivity?: () => void,
+  onEvidencePreview?: (preview: VerifiedEvidencePreviewUnit | null) => void,
 ): Promise<AnswerPayload> {
   if (!response.body) throw makeSearchError("Answer stream could not be opened.", undefined, true);
 
@@ -69,6 +80,14 @@ export async function readAnswerStream(
   const decoder = new TextDecoder();
   let buffer = "";
   let pendingCompletion: AnswerProgressUpdate | null = null;
+  let lastVerifiedUnitSequence: number | null = null;
+  let evidencePreview: VerifiedEvidencePreviewUnit | null = null;
+
+  function clearEvidencePreview() {
+    if (evidencePreview === null) return;
+    evidencePreview = null;
+    onEvidencePreview?.(null);
+  }
 
   function processEvent(block: string) {
     const lines = block.split(/\r?\n/);
@@ -83,29 +102,36 @@ export async function readAnswerStream(
     if (dataLines.length === 0) return null;
     const data = parseSseData(dataLines);
     if (data === null) return null;
+    if (!isAnswerStreamEventName(event)) return null;
     if (event === "progress") {
-      const progress = normalizeAnswerProgressEvent(data);
+      const verifiedUnitWasProvided =
+        typeof data === "object" &&
+        data !== null &&
+        !Array.isArray(data) &&
+        Object.prototype.hasOwnProperty.call(data, "verifiedUnit");
+      const progress = normalizeAnswerProgressEvent(data, lastVerifiedUnitSequence);
+      if (verifiedUnitWasProvided && !progress?.verifiedUnit) clearEvidencePreview();
       if (progress) {
+        const { verifiedUnit, ...publicProgress } = progress;
+        if (verifiedUnit) {
+          lastVerifiedUnitSequence = verifiedUnit.sequence;
+          if (verifiedUnit.kind === "evidence_preview") {
+            evidencePreview = verifiedUnit;
+            onEvidencePreview?.(verifiedUnit);
+          }
+        }
         if (progress.stage === "complete") {
-          pendingCompletion = progress;
+          pendingCompletion = publicProgress;
         } else {
-          onProgress(progress);
+          onProgress(publicProgress);
           if (progress.stage === "fallback") onRevising?.();
         }
       }
       return null;
     }
-    if (event === "token") {
-      const delta = data && typeof data === "object" ? (data as { delta?: unknown }).delta : null;
-      if (typeof delta === "string" && delta) onToken?.(delta);
-      return null;
-    }
-    if (event === "revising") {
-      onRevising?.();
-      return null;
-    }
     if (event === "error") {
       pendingCompletion = null;
+      clearEvidencePreview();
       const message = data && typeof data === "object" ? (data as { error?: unknown }).error : null;
       const details =
         data && typeof data === "object" ? (data as { details?: { message?: unknown } | unknown }).details : null;
@@ -130,8 +156,16 @@ export async function readAnswerStream(
     if (event === "final") {
       if (!isAnswerPayload(data)) {
         pendingCompletion = null;
+        clearEvidencePreview();
         throw makeSearchError("Answer stream returned an invalid final payload.", 502, true);
       }
+      if (evidencePreview) {
+        // The final payload is authoritative in both outcomes. Reconciliation is
+        // deliberately evaluated before the preview is discarded so client tests
+        // guard the byte-identical subset contract without ever withholding final.
+        evidencePreviewReconcilesWithFinal(evidencePreview, data);
+      }
+      clearEvidencePreview();
       if (pendingCompletion) {
         onProgress(pendingCompletion);
         pendingCompletion = null;
@@ -142,30 +176,36 @@ export async function readAnswerStream(
     return null;
   }
 
-  while (true) {
-    const { value, done } = await reader.read();
-    if (value && value.length > 0) onActivity?.();
-    buffer += decoder.decode(value, { stream: !done });
-
-    let separator = findSseSeparator(buffer);
-    while (separator) {
-      const block = buffer.slice(0, separator.index).trim();
-      buffer = buffer.slice(separator.index + separator.length);
-      const finalPayload = block ? processEvent(block) : null;
-      if (finalPayload) {
-        await reader.cancel().catch(() => undefined);
-        return finalPayload;
+  try {
+    while (true) {
+      const { value, done } = await reader.read();
+      if (value && value.length > 0) onActivity?.();
+      buffer += decoder.decode(value, { stream: !done });
+
+      let separator = findSseSeparator(buffer);
+      while (separator) {
+        const block = buffer.slice(0, separator.index).trim();
+        buffer = buffer.slice(separator.index + separator.length);
+        const finalPayload = block ? processEvent(block) : null;
+        if (finalPayload) {
+          await reader.cancel().catch(() => undefined);
+          return finalPayload;
+        }
+        separator = findSseSeparator(buffer);
       }
-      separator = findSseSeparator(buffer);
+
+      if (done) break;
     }
 
-    if (done) break;
+    const finalPayload = buffer.trim() ? processEvent(buffer.trim()) : null;
+    if (finalPayload) return finalPayload;
+    pendingCompletion = null;
+    clearEvidencePreview();
+    throw makeSearchError("Answer stream ended before a final answer was received.", undefined, true);
+  } catch (error) {
+    clearEvidencePreview();
+    throw error;
   }
-
-  const finalPayload = buffer.trim() ? processEvent(buffer.trim()) : null;
-  if (finalPayload) return finalPayload;
-  pendingCompletion = null;
-  throw makeSearchError("Answer stream ended before a final answer was received.", undefined, true);
 }
 
 export function isRetryableStatus(status: number) {
diff --git a/src/components/clinical-dashboard/universal-search-command-surface.tsx b/src/components/clinical-dashboard/universal-search-command-surface.tsx
index 86c05f0fd6..8c778bfdb9 100644
--- a/src/components/clinical-dashboard/universal-search-command-surface.tsx
+++ b/src/components/clinical-dashboard/universal-search-command-surface.tsx
@@ -32,6 +32,7 @@ import {
   commandDropdownCanDisplay,
   commandDropdownMinimumWidthMediaQuery,
   commandDropdownPointerMediaQuery,
+  commandSurfaceRemoteSearchEnabled,
   differentialRedFlagTerms,
   filteredSuggestions,
   isFormCodeQuery,
@@ -441,7 +442,7 @@ export function UniversalSearchCommandSurface({
   dropdownOpen: boolean;
   onDropdownOpenChange: (open: boolean) => void;
   onQueryChange: (query: string) => void;
-  onSearch: () => void;
+  onSearch: (query?: string) => void;
   onPickRecent: (query: string) => void;
   onCrossMode: (modeId: AppModeId, query: string) => void;
   onRunModeAction?: (actionId: ModeActionId) => void;
@@ -489,7 +490,7 @@ export function UniversalSearchCommandSurface({
   // the palette surfaces every entity type, ordered by the server's intent-aware domainOrder.
   const universal = useUniversalSearch({
     query: trimmedQuery,
-    enabled: dropdownOpen && dropdownDisplayable && Boolean(config),
+    enabled: dropdownOpen && dropdownDisplayable && commandSurfaceRemoteSearchEnabled(modeId),
     contextMode: modeId,
   });
   const savedRegistryFavourites = useSavedRegistryFavourites().items;
@@ -697,7 +698,7 @@ export function UniversalSearchCommandSurface({
             onSelect: () => {
               onDropdownOpenChange(false);
               onQueryChange(suggestion.text);
-              onSearch();
+              onSearch(suggestion.text);
             },
             render: (active) => (
               <OptionShell active={active} hint="Search">
diff --git a/src/components/forms/form-detail-page.tsx b/src/components/forms/form-detail-page.tsx
index 35e057ad48..f98a06840e 100644
--- a/src/components/forms/form-detail-page.tsx
+++ b/src/components/forms/form-detail-page.tsx
@@ -1122,7 +1122,7 @@ export function FormDetailPage({ form }: { form: FormRecord }) {
             </section>
 
             <section id="form-information" aria-label="Form information" className={cn(inPageAnchor, "grid gap-2")}>
-              <DisclosureGroup items={formInformationItems(detailRows)} headingLevel={3} />
+              <DisclosureGroup className="min-w-0" items={formInformationItems(detailRows)} headingLevel={3} />
             </section>
 
             {/* The `-mobile`/`-desktop` id pairs below are the section anchors
diff --git a/src/components/in-page-nav/in-page-section-rail.tsx b/src/components/in-page-nav/in-page-section-rail.tsx
index c82b7eae30..16f81ffc25 100644
--- a/src/components/in-page-nav/in-page-section-rail.tsx
+++ b/src/components/in-page-nav/in-page-section-rail.tsx
@@ -71,7 +71,7 @@ export function InPageSectionRail({
     <nav
       aria-label={label}
       data-testid={`${testIdPrefix}-section-rail`}
-      className="border-t border-[color:var(--border)]"
+      className="border-t border-[color:var(--border)] sm:mt-2 sm:rounded-xl sm:border sm:border-[color:var(--border-lux)] sm:bg-[color:var(--surface-raised)] sm:px-1 sm:shadow-[var(--shadow-inset)]"
     >
       <div className="mode-nav" data-density-profile="extended">
         <ul className="mode-nav__bar h-12 items-stretch px-1">
@@ -89,7 +89,11 @@ export function InPageSectionRail({
                   type="button"
                   onClick={() => onSelect(section.id)}
                   aria-current={selected ? "true" : undefined}
-                  className={cn("flex h-full w-full items-center justify-center rounded-lg", focusRing)}
+                  className={cn(
+                    "flex h-full w-full items-center justify-center rounded-lg transition-colors motion-reduce:transition-none sm:hover:bg-[color:var(--surface-subtle)]",
+                    selected && "sm:bg-[color:var(--clinical-accent-soft)] sm:shadow-[var(--shadow-inset)]",
+                    focusRing,
+                  )}
                 >
                   <ModeNavSlotInk
                     icon={section.icon}
diff --git a/src/components/pwa-lifecycle.tsx b/src/components/pwa-lifecycle.tsx
index 5e8f57ae6b..0b6db9bc95 100644
--- a/src/components/pwa-lifecycle.tsx
+++ b/src/components/pwa-lifecycle.tsx
@@ -1,7 +1,20 @@
 "use client";
 
-import { RefreshCw, Share, SquarePlus, Wifi, WifiOff, X, type LucideIcon } from "lucide-react";
+import {
+  Download,
+  LayoutGrid,
+  RefreshCw,
+  Share,
+  Smartphone,
+  SquarePlus,
+  Wifi,
+  WifiOff,
+  X,
+  Zap,
+  type LucideIcon,
+} from "lucide-react";
 import { useEffect, useRef, useState } from "react";
+import { BrandMark } from "@/components/clinical-dashboard/brand";
 import { createBrowserStore } from "@/lib/client-store-factory";
 
 const SERVICE_WORKER_URL = "/sw.js";
@@ -100,12 +113,11 @@ async function teardownLocalPwa() {
   }
 }
 
-const cardClassName =
-  "pwa-notice-card pointer-events-auto relative rounded-2xl border border-[color:var(--border-lux)] bg-[color:var(--surface-lux)] p-4 text-[color:var(--text)] shadow-[var(--shadow-lux)] ring-1 ring-[color:var(--ring-glass)] backdrop-blur-md";
+const cardClassName = "pwa-notice-card pointer-events-auto relative text-[color:var(--text)]";
 const primaryButtonClassName =
-  "inline-flex min-h-tap items-center justify-center rounded-lg bg-[color:var(--clinical-accent)] px-3.5 py-2 text-sm font-semibold text-[color:var(--clinical-accent-contrast)] shadow-[var(--e1)] transition-colors hover:bg-[color:var(--clinical-accent-hover)] focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)]";
+  "pwa-action pwa-action-primary inline-flex min-h-tap items-center justify-center rounded-md px-4 text-sm font-semibold focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)]";
 const secondaryButtonClassName =
-  "inline-flex min-h-tap items-center justify-center rounded-lg border border-[color:var(--border-lux)] px-3.5 py-2 text-sm font-semibold text-[color:var(--text)] transition-colors hover:bg-[color:var(--surface-subtle)] focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)]";
+  "pwa-action pwa-action-secondary inline-flex min-h-tap items-center justify-center rounded-md px-4 text-sm font-semibold focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)]";
 const dismissIconButtonClassName =
   "absolute right-1 top-1 inline-flex h-tap w-tap items-center justify-center rounded-full text-[color:var(--text-muted)] transition-colors hover:bg-[color:var(--surface-subtle)] hover:text-[color:var(--text)] focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)]";
 
@@ -130,46 +142,75 @@ function NoticeIcon({ icon: Icon, tone }: { icon: LucideIcon; tone: "accent" | "
   );
 }
 
-// Phone install notices read as a native install sheet: grip bar (visual
-// echo of src/components/ui/sheet.tsx; static — notices are transient cards,
-// not draggable dialogs) and the real app icon as the identity mark.
+// Phone install notices echo the application's sheet language without acting
+// like a draggable modal. The grip is deliberately decorative and the notice
+// remains a non-blocking region.
 function InstallSheetGrip() {
   return (
-    <div className="flex justify-center pb-2 pt-0.5 sm:hidden" aria-hidden="true">
-      <span className="h-1 w-9 rounded-full bg-[color:var(--border-strong)]" />
+    <div className="pwa-install-grip sm:hidden" aria-hidden="true">
+      <span />
     </div>
   );
 }
 
-function InstallAppIdentity({ title, titleId, tagline }: { title: string; titleId: string; tagline: string }) {
+function InstallHeader({
+  dismissLabel,
+  onDismiss,
+  title,
+  titleId,
+}: {
+  dismissLabel: string;
+  onDismiss: () => void;
+  title: string;
+  titleId: string;
+}) {
   return (
-    <div className="flex min-w-0 items-center gap-3.5">
-      {/* eslint-disable-next-line @next/next/no-img-element -- static same-origin
-          brand asset; next/image adds a client chunk for zero benefit here. */}
-      <img
-        src="/icons/icon-192"
-        alt=""
-        aria-hidden="true"
-        width={56}
-        height={56}
-        className="h-14 w-14 shrink-0 rounded-xl border border-[color:var(--border-lux)] shadow-[var(--e1)]"
-      />
-      <div className="min-w-0">
-        <p id={titleId} className="text-base font-bold leading-tight text-[color:var(--text-heading)]">
+    <div className="pwa-install-header">
+      <div className="flex min-w-0 items-center gap-2.5">
+        <BrandMark className="pwa-install-mark h-9 w-9" />
+        <p id={titleId} className="min-w-0 text-sm font-bold leading-5 text-[color:var(--text-heading)]">
           {title}
         </p>
-        <p className="mt-1 text-sm leading-5 text-[color:var(--text-muted)]">{tagline}</p>
       </div>
+      <button type="button" className="pwa-install-dismiss" aria-label={dismissLabel} onClick={onDismiss}>
+        <X className="h-icon-sm w-icon-sm" aria-hidden="true" />
+        <span>Dismiss</span>
+      </button>
     </div>
   );
 }
 
-function InstallStepChip({ icon: Icon, label }: { icon: LucideIcon; label: string }) {
+const installBenefits: Array<{ icon: LucideIcon; label: string }> = [
+  { icon: Zap, label: "Quick access" },
+  { icon: Smartphone, label: "App-like launch" },
+  { icon: LayoutGrid, label: "Familiar workspace" },
+];
+
+function InstallBenefits() {
   return (
-    <span className="inline-flex min-h-8 items-center gap-1.5 rounded-lg border border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)] px-2.5 text-xs font-semibold text-[color:var(--clinical-accent)]">
-      <Icon className="h-3.5 w-3.5" aria-hidden="true" />
-      {label}
-    </span>
+    <ul className="pwa-install-benefits" aria-label="Install benefits">
+      {installBenefits.map(({ icon: Icon, label }) => (
+        <li key={label}>
+          <Icon className="h-icon-md w-icon-md" aria-hidden="true" />
+          <span>{label}</span>
+        </li>
+      ))}
+    </ul>
+  );
+}
+
+function InstallManualSteps() {
+  return (
+    <ol className="pwa-install-steps" aria-label="Add Clinical KB to your Home Screen">
+      <li>
+        <span>1. Tap Share</span>
+        <Share className="h-icon-md w-icon-md" aria-hidden="true" />
+      </li>
+      <li>
+        <span>2. Add to Home Screen</span>
+        <SquarePlus className="h-icon-md w-icon-md" aria-hidden="true" />
+      </li>
+    </ol>
   );
 }
 
@@ -457,7 +498,12 @@ export function PwaLifecycle() {
   return (
     <div className="pwa-notice-stack">
       {showOffline ? (
-        <section className={cardClassName} role="region" aria-labelledby="pwa-offline-title" aria-live="polite">
+        <section
+          className={`${cardClassName} pwa-lifecycle-card`}
+          role="region"
+          aria-labelledby="pwa-offline-title"
+          aria-live="polite"
+        >
           <button
             type="button"
             className={dismissIconButtonClassName}
@@ -470,10 +516,10 @@ export function PwaLifecycle() {
             <NoticeIcon icon={WifiOff} tone="warning" />
             <div className="min-w-0">
               <p id="pwa-offline-title" className="text-sm font-bold text-[color:var(--text-heading)]">
-                You appear to be offline
+                You’re offline
               </p>
               <p className="mt-1 text-sm leading-6 text-[color:var(--text-muted)]">
-                Clinical search, answers, private documents, uploads, and account data require a connection.
+                Clinical search and private features need a connection.
               </p>
               <button
                 type="button"
@@ -488,7 +534,7 @@ export function PwaLifecycle() {
       ) : null}
 
       {connectionRestored ? (
-        <section className={cardClassName} role="status">
+        <section className={`${cardClassName} pwa-connection-restored`} role="status">
           <div className="flex items-center gap-3">
             <NoticeIcon icon={Wifi} tone="success" />
             <p className="text-sm font-bold text-[color:var(--text-heading)]">Connection restored</p>
@@ -497,7 +543,12 @@ export function PwaLifecycle() {
       ) : null}
 
       {showUpdate ? (
-        <section className={cardClassName} role="region" aria-labelledby="pwa-update-title" aria-live="polite">
+        <section
+          className={`${cardClassName} pwa-lifecycle-card`}
+          role="region"
+          aria-labelledby="pwa-update-title"
+          aria-live="polite"
+        >
           <button
             type="button"
             className={dismissIconButtonClassName}
@@ -510,14 +561,15 @@ export function PwaLifecycle() {
             <NoticeIcon icon={RefreshCw} tone="info" />
             <div className="min-w-0">
               <p id="pwa-update-title" className="text-sm font-bold text-[color:var(--text-heading)]">
-                An update is ready
+                Update available
               </p>
               <p className="mt-1 text-sm leading-6 text-[color:var(--text-muted)]">
-                Refresh when convenient to use the latest Clinical KB version.
+                Reload when convenient to use the latest version.
               </p>
               <div className="mt-3 flex flex-wrap gap-2">
                 <button type="button" className={primaryButtonClassName} onClick={applyUpdate}>
-                  Refresh now
+                  <RefreshCw className="mr-2 h-icon-md w-icon-md" aria-hidden="true" />
+                  Reload
                 </button>
                 <button type="button" className={secondaryButtonClassName} onClick={dismissUpdate}>
                   Later
@@ -535,30 +587,20 @@ export function PwaLifecycle() {
           aria-labelledby="pwa-ios-install-title"
           aria-live="polite"
         >
-          <button
-            type="button"
-            className={dismissIconButtonClassName}
-            aria-label="Dismiss install hint"
-            onClick={dismissIosHint}
-          >
-            <X className="h-4 w-4" aria-hidden="true" />
-          </button>
           <InstallSheetGrip />
-          <div className="pr-12 sm:pr-10">
-            <InstallAppIdentity
-              title="Install Clinical KB"
-              titleId="pwa-ios-install-title"
-              tagline="Clinical guidelines on your home screen."
-            />
-            <p className="mt-3 text-sm leading-6 text-[color:var(--text-muted)]">
-              In Safari, tap Share, then Add to Home Screen. Private clinical features still require a connection.
-            </p>
-            <div className="mt-2.5 flex flex-wrap items-center gap-2" aria-hidden="true">
-              <InstallStepChip icon={Share} label="1. Tap Share" />
-              <InstallStepChip icon={SquarePlus} label="2. Add to Home Screen" />
-            </div>
-            <div className="mt-3.5 flex flex-wrap gap-2">
-              <button type="button" className={secondaryButtonClassName} onClick={dismissIosHint}>
+          <InstallHeader
+            title="Install Clinical KB"
+            titleId="pwa-ios-install-title"
+            dismissLabel="Dismiss install hint"
+            onDismiss={dismissIosHint}
+          />
+          <div className="pwa-install-body">
+            <p className="pwa-install-tagline">Clinical guidelines on your home screen.</p>
+            <p className="pwa-install-copy">In Safari, tap Share, then Add to Home Screen.</p>
+            <InstallManualSteps />
+            <p className="pwa-install-support">Private clinical features still require a connection.</p>
+            <div className="pwa-install-actions pwa-install-actions-single">
+              <button type="button" className={`${secondaryButtonClassName} w-full`} onClick={dismissIosHint}>
                 Not now
               </button>
             </div>
@@ -568,41 +610,40 @@ export function PwaLifecycle() {
 
       {showInstall ? (
         <section
-          className={`${cardClassName} pwa-install-sheet`}
+          className={`${cardClassName} pwa-install-sheet pwa-install-native-sheet`}
           role="region"
           aria-labelledby="pwa-install-title"
           aria-live="polite"
         >
-          <button
-            type="button"
-            className={dismissIconButtonClassName}
-            aria-label="Dismiss install prompt"
-            onClick={dismissInstall}
-          >
-            <X className="h-4 w-4" aria-hidden="true" />
-          </button>
           <InstallSheetGrip />
-          <div className="pr-12 sm:pr-10">
-            <InstallAppIdentity
-              title="Install Clinical KB"
-              titleId="pwa-install-title"
-              tagline="Clinical guidelines on your home screen."
-            />
-            <p className="mt-3 text-sm leading-6 text-[color:var(--text-muted)]">
+          <InstallHeader
+            title="Install Clinical KB"
+            titleId="pwa-install-title"
+            dismissLabel="Dismiss install prompt"
+            onDismiss={dismissInstall}
+          />
+          <div className="pwa-install-body">
+            <p className="pwa-install-compact-copy">Quick access · No app store</p>
+            <p className="pwa-install-tagline">Clinical guidelines on your home screen.</p>
+            <p className="pwa-install-copy">
               Open it from your device like an app. Private clinical features still require a connection.
             </p>
-            <p className="mt-1.5 text-xs font-semibold tracking-normal text-[color:var(--text-muted)]">
-              Free · No app store · Takes a few seconds
-            </p>
-            <div className="mt-3.5 flex flex-wrap gap-2">
+            <p className="pwa-install-support">Free · No app store · Takes a few seconds</p>
+            <InstallBenefits />
+            <div className="pwa-install-actions">
               <button
                 type="button"
-                className={`${primaryButtonClassName} max-sm:flex-1`}
+                className={`${primaryButtonClassName} pwa-install-primary`}
                 onClick={() => void requestInstall()}
               >
+                <Download className="mr-2 h-icon-md w-icon-md" aria-hidden="true" />
                 Install app
               </button>
-              <button type="button" className={secondaryButtonClassName} onClick={dismissInstall}>
+              <button
+                type="button"
+                className={`${secondaryButtonClassName} pwa-install-secondary`}
+                onClick={dismissInstall}
+              >
                 Not now
               </button>
             </div>
diff --git a/src/components/services/service-group-nav.tsx b/src/components/services/service-group-nav.tsx
deleted file mode 100644
index b0866e99f4..0000000000
--- a/src/components/services/service-group-nav.tsx
+++ /dev/null
@@ -1,113 +0,0 @@
-"use client";
-
-import Link from "next/link";
-import { ChevronDown } from "lucide-react";
-import { useId, useState } from "react";
-
-import { Sheet } from "@/components/ui/sheet";
-import { cn } from "@/components/ui-primitives";
-import { serviceCoreGroups, type ServiceCoreGroupId } from "@/lib/service-core-groups";
-
-type GroupValue = ServiceCoreGroupId | null;
-
-export function ServiceGroupNav({
-  activeGroup,
-  hrefForGroup,
-  counts,
-  className,
-}: {
-  activeGroup: GroupValue;
-  hrefForGroup: (group: GroupValue) => string;
-  counts?: Partial<Record<ServiceCoreGroupId, number>> & { all?: number };
-  className?: string;
-}) {
-  const [moreOpen, setMoreOpen] = useState(false);
-  const panelId = useId();
-  const phonePrimary = serviceCoreGroups.slice(0, 2);
-  const phoneMore = serviceCoreGroups.slice(2);
-  const moreActive = phoneMore.some((group) => group.id === activeGroup);
-
-  const groupLink = (group: (typeof serviceCoreGroups)[number], phone = false) => (
-    <Link
-      key={group.id}
-      href={hrefForGroup(group.id)}
-      aria-current={activeGroup === group.id ? "page" : undefined}
-      onClick={() => setMoreOpen(false)}
-      className={cn(
-        "inline-flex min-h-tap min-w-0 items-center justify-center gap-1.5 rounded-lg border px-3 text-xs font-bold transition focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)] sm:min-h-10",
-        activeGroup === group.id
-          ? "border-[color:var(--clinical-accent)] bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)]"
-          : "border-[color:var(--border)] bg-[color:var(--surface)] text-[color:var(--text-muted)] hover:border-[color:var(--border-strong)] hover:text-[color:var(--text)]",
-      )}
-    >
-      <span className={phone ? "truncate" : "text-center leading-4"}>{phone ? group.shortLabel : group.label}</span>
-      {typeof counts?.[group.id] === "number" ? (
-        <span className="nums text-2xs text-[color:var(--text-muted)]">{counts[group.id]}</span>
-      ) : null}
-    </Link>
-  );
-
-  return (
-    <nav aria-label="Service groups" className={cn("min-w-0", className)}>
-      <div className="hidden grid-cols-5 gap-2 sm:grid">
-        <Link
-          href={hrefForGroup(null)}
-          aria-current={activeGroup === null ? "page" : undefined}
-          className={cn(
-            "inline-flex min-h-10 items-center justify-center gap-1.5 rounded-lg border px-3 text-xs font-bold transition focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)]",
-            activeGroup === null
-              ? "border-[color:var(--clinical-accent)] bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)]"
-              : "border-[color:var(--border)] bg-[color:var(--surface)] text-[color:var(--text-muted)] hover:border-[color:var(--border-strong)] hover:text-[color:var(--text)]",
-          )}
-        >
-          All
-          {typeof counts?.all === "number" ? <span className="nums text-2xs">{counts.all}</span> : null}
-        </Link>
-        {serviceCoreGroups.map((group) => groupLink(group))}
-      </div>
-
-      <div className="grid grid-cols-4 gap-2 sm:hidden">
-        <Link
-          href={hrefForGroup(null)}
-          aria-current={activeGroup === null ? "page" : undefined}
-          className={cn(
-            "inline-flex min-h-tap items-center justify-center rounded-lg border px-2 text-xs font-bold focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)]",
-            activeGroup === null
-              ? "border-[color:var(--clinical-accent)] bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)]"
-              : "border-[color:var(--border)] bg-[color:var(--surface)] text-[color:var(--text-muted)]",
-          )}
-        >
-          All
-        </Link>
-        {phonePrimary.map((group) => groupLink(group, true))}
-        <button
-          type="button"
-          onClick={() => setMoreOpen(true)}
-          aria-expanded={moreOpen}
-          aria-haspopup="dialog"
-          aria-controls={moreOpen ? panelId : undefined}
-          className={cn(
-            "inline-flex min-h-tap items-center justify-center gap-1 rounded-lg border px-2 text-xs font-bold focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)]",
-            moreActive
-              ? "border-[color:var(--clinical-accent)] bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)]"
-              : "border-[color:var(--border)] bg-[color:var(--surface)] text-[color:var(--text-muted)]",
-          )}
-        >
-          More
-          <ChevronDown className="h-3.5 w-3.5" aria-hidden />
-        </button>
-      </div>
-
-      <Sheet
-        open={moreOpen}
-        onClose={() => setMoreOpen(false)}
-        title="More service groups"
-        description="Browse the remaining high-yield service groups."
-        id={panelId}
-        testId="service-group-more-sheet"
-      >
-        <div className="grid gap-2">{phoneMore.map((group) => groupLink(group))}</div>
-      </Sheet>
-    </nav>
-  );
-}
diff --git a/src/components/services/services-navigator-page.tsx b/src/components/services/services-navigator-page.tsx
index e6443dfbcf..3b3cad3a27 100644
--- a/src/components/services/services-navigator-page.tsx
+++ b/src/components/services/services-navigator-page.tsx
@@ -2,12 +2,23 @@
 
 import Link from "next/link";
 import { useRouter, useSearchParams } from "next/navigation";
-import { ArrowRight, Check, ExternalLink, GitCompareArrows, ListChecks, ShieldCheck, X } from "lucide-react";
-import { useCallback, useDeferredValue, useId, useMemo, useState } from "react";
+import {
+  ArrowRight,
+  Bookmark,
+  BookmarkCheck,
+  Check,
+  ExternalLink,
+  GitCompareArrows,
+  ListChecks,
+  X,
+} from "lucide-react";
+import { useCallback, useDeferredValue, useId, useMemo, useRef, useState } from "react";
 
+import { useAccountData } from "@/components/account-data-provider";
 import { DesktopComposerPortalSlot } from "@/components/desktop-composer-portal-slot";
 import { SearchResultsLayout } from "@/components/clinical-dashboard/search-results-layout";
 import {
+  type AppliedFilterChip,
   SearchResultsEmptyState,
   SearchResultsHeaderBand,
   SearchResultsSkeleton,
@@ -20,17 +31,17 @@ import {
   resultFilterGroup,
 } from "@/components/clinical-dashboard/result-filter-control";
 import { SegmentedControl } from "@/components/ui/segmented-control";
-import { ServiceGroupNav } from "@/components/services/service-group-nav";
 import { Chip as DesignChip, type ChipStatusTone } from "@/components/ui/chip";
 import { cn } from "@/components/ui-primitives";
 import { useResultSort } from "@/components/use-result-sort";
 import { compactBestUseTitle } from "@/lib/compact-best-use-title";
 import { modeHomeDesktopComposerSlotId } from "@/lib/mode-home-composer";
 import {
-  readServiceCoreGroup,
+  readServiceCoreGroupSelection,
   serviceCoreGroupLabel,
   serviceCoreGroups,
-  serviceMatchesCoreGroup,
+  serviceMatchesCoreGroupSelection,
+  writeServiceCoreGroupSelectionToParams,
   type ServiceCoreGroupId,
 } from "@/lib/service-core-groups";
 import {
@@ -81,15 +92,27 @@ function ServiceCard({
   relevanceRank,
   selected,
   onToggleSelected,
+  saved,
+  savedStateReady,
+  savedStateLoadFailed,
+  savePending,
+  onToggleSaved,
 }: {
   service: ServiceRecord;
   index: number;
   relevanceRank: number | null;
   selected: boolean;
   onToggleSelected: (slug: string) => void;
+  saved: boolean;
+  // False until the account favourites read settles. Until then `saved` is
+  // `false` for EVERY service — not because nothing is saved, but because
+  // nothing has been read yet — so the control must not assert a state.
+  savedStateReady: boolean;
+  savedStateLoadFailed: boolean;
+  savePending: boolean;
+  onToggleSaved: (slug: string) => void;
 }) {
   const showBestFit = relevanceRank !== null && relevanceRank <= 2;
-  const catchment = service.catchments?.slice(0, 2).join(" · ") || service.location;
 
   return (
     <article
@@ -101,7 +124,7 @@ function ServiceCard({
           : "border-[color:var(--border)]",
       )}
     >
-      <div className="grid grid-cols-[2.25rem_minmax(0,1fr)] items-start gap-3 sm:grid-cols-[2.5rem_minmax(0,1fr)_auto]">
+      <div className="grid grid-cols-[2.25rem_minmax(0,1fr)_auto] items-start gap-3 sm:grid-cols-[2.5rem_minmax(0,1fr)_auto]">
         <span
           className={cn(
             "grid h-9 w-9 place-items-center rounded-lg border text-sm font-extrabold",
@@ -144,33 +167,59 @@ function ServiceCard({
             ))}
           </div>
         </div>
-        <span className="hidden items-center gap-1.5 rounded-full border border-[color:var(--border)] bg-[color:var(--surface-subtle)] px-2.5 py-1 text-2xs font-semibold text-[color:var(--text-muted)] sm:inline-flex">
-          <ShieldCheck className="h-3.5 w-3.5 text-[color:var(--clinical-accent)]" aria-hidden />
-          {service.verification?.confidence ?? "Unknown"} confidence
-        </span>
+        {/* Favourite, not shortlist: the bookmark persists to the account
+            across sessions, while the shortlist below is this search's
+            working set and is deliberately not persisted. Two different
+            jobs, so they stay two different controls. */}
+        {/* Native `disabled`, not aria-disabled: this is transient inertness
+            while a request settles, which is exactly the case
+            docs/wiring-conventions.md reserves `disabled` for. Without it the
+            control asserts "not saved" for every service during the account
+            read and a tap issues a redundant write against a service that is
+            already saved. */}
+        <button
+          type="button"
+          onClick={() => onToggleSaved(service.slug)}
+          disabled={!savedStateReady || savedStateLoadFailed || savePending}
+          aria-pressed={savedStateReady && !savedStateLoadFailed ? saved : undefined}
+          title={
+            savedStateLoadFailed
+              ? "Saved services are unavailable. Retry from your favourites."
+              : !savedStateReady
+                ? "Loading your saved services…"
+                : savePending
+                  ? "Saving…"
+                  : undefined
+          }
+          aria-label={
+            savedStateLoadFailed
+              ? `Saved state unavailable for ${service.title}`
+              : savedStateReady
+                ? saved
+                  ? `Remove ${service.title} from favourites`
+                  : `Save ${service.title} to favourites`
+                : `Loading saved state for ${service.title}`
+          }
+          className={cn(
+            "grid min-h-12 min-w-12 place-items-center rounded-lg border focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)] disabled:cursor-not-allowed disabled:opacity-50 sm:min-h-10 sm:min-w-10",
+            savedStateReady && !savedStateLoadFailed && saved
+              ? "border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)]"
+              : "border-[color:var(--border)] bg-[color:var(--surface)] text-[color:var(--text-muted)] enabled:hover:bg-[color:var(--surface-subtle)]",
+          )}
+        >
+          {savedStateReady && !savedStateLoadFailed && saved ? (
+            <BookmarkCheck className="h-4 w-4" aria-hidden />
+          ) : (
+            <Bookmark className="h-4 w-4" aria-hidden />
+          )}
+        </button>
       </div>
 
-      <dl className="mt-3 grid min-w-0 grid-cols-1 overflow-hidden rounded-lg border border-[color:var(--border)] bg-[color:var(--surface-subtle)] sm:grid-cols-3">
-        {[
-          ["Catchment", compactText(catchment, 72, "Confirm locally")],
-          ["Eligibility", compactText(service.eligibility, 86, "Review criteria")],
-          ["Cost", compactText(service.cost, 72, "Confirm fees")],
-        ].map(([label, value], itemIndex) => (
-          <div
-            key={label}
-            className={cn(
-              "min-w-0 px-3 py-2.5",
-              itemIndex > 0 && "border-t border-[color:var(--border)] sm:border-l sm:border-t-0",
-            )}
-          >
-            <dt className="text-2xs font-semibold text-[color:var(--text-muted)]">{label}</dt>
-            <dd className="mt-0.5 line-clamp-2 text-xs font-bold leading-4 text-[color:var(--text-heading)]">
-              {value}
-            </dd>
-          </div>
-        ))}
-      </dl>
-
+      {/* The Catchment/Eligibility/Cost strip that used to sit here is gone
+          (direction B, ledger #163): three truncated fields per row turned a
+          scan of 45 crisis services into a wall of clipped prose. The full,
+          untruncated values are one tap away on the record via "Review
+          referral", which is where a referral decision is actually made. */}
       <div className="mt-3 grid grid-cols-2 gap-2 sm:flex sm:justify-end">
         <Link
           href={`/services/${service.slug}`}
@@ -200,6 +249,90 @@ function ServiceCard({
   );
 }
 
+const referralStages = [
+  { id: "search", label: "Search" },
+  { id: "shortlist", label: "Shortlist" },
+  { id: "compare", label: "Compare" },
+  { id: "refer", label: "Refer" },
+] as const;
+
+type ReferralStageId = (typeof referralStages)[number]["id"];
+
+/**
+ * A compact progress rail, not the old four-card walkthrough. It sits directly
+ * below the results heading because it describes the current search journey;
+ * category and suggestion navigation no longer compete for this position.
+ *
+ * The accessible name stays distinct from `ServiceReferralFlow` on the service
+ * record. "Refer" is reached there, but remains visible here so the whole path
+ * is understandable before a reader starts a shortlist.
+ */
+function ServiceReferralProgress({ active }: { active: ReferralStageId }) {
+  const activeIndex = referralStages.findIndex((stage) => stage.id === active);
+
+  return (
+    <nav
+      aria-label="Referral progress"
+      data-testid="service-referral-progress"
+      className="min-w-0 rounded-xl border border-[color:var(--border)] bg-[color:var(--surface)] px-3 py-2.5 shadow-[var(--shadow-inset)] sm:px-4 sm:py-3"
+    >
+      <div className="flex min-w-0 items-center justify-between gap-3">
+        <span className="truncate text-2xs font-extrabold uppercase tracking-eyebrow text-[color:var(--text-muted)]">
+          Referral pathway
+        </span>
+        <span className="nums shrink-0 text-2xs font-semibold text-[color:var(--clinical-accent)]" aria-live="polite">
+          Step {activeIndex + 1} of {referralStages.length}
+        </span>
+      </div>
+      <ol className="mt-2 grid min-w-0 grid-cols-4 gap-1 sm:mt-2.5 sm:gap-2">
+        {referralStages.map((stage, index) => {
+          const isActive = index === activeIndex;
+          const isComplete = index < activeIndex;
+          return (
+            <li key={stage.id} className="relative flex min-w-0 flex-col items-center gap-1.5">
+              {index > 0 ? (
+                <span
+                  aria-hidden
+                  className={cn(
+                    "absolute right-1/2 top-3 h-px w-[calc(100%+0.25rem)] sm:w-[calc(100%+0.5rem)]",
+                    isComplete || isActive ? "bg-[color:var(--clinical-accent-border)]" : "bg-[color:var(--border)]",
+                  )}
+                />
+              ) : null}
+              <span
+                aria-hidden
+                className={cn(
+                  "relative z-5 grid h-6 w-6 shrink-0 place-items-center rounded-full border text-3xs font-black",
+                  isActive
+                    ? "border-[color:var(--clinical-accent)] bg-[color:var(--clinical-accent)] text-[color:var(--clinical-accent-contrast)]"
+                    : isComplete
+                      ? "border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)] text-[color:var(--clinical-accent)]"
+                      : "border-[color:var(--border-strong)] bg-[color:var(--surface-raised)] text-[color:var(--text-muted)]",
+                )}
+              >
+                {isComplete ? <Check className="h-3 w-3" strokeWidth={3} aria-hidden="true" /> : index + 1}
+              </span>
+              <span
+                aria-current={isActive ? "step" : undefined}
+                className={cn(
+                  "min-w-0 max-w-full truncate text-center text-2xs font-bold",
+                  isActive
+                    ? "text-[color:var(--clinical-accent)]"
+                    : isComplete
+                      ? "text-[color:var(--text)]"
+                      : "text-[color:var(--text-muted)]",
+                )}
+              >
+                {stage.label}
+              </span>
+            </li>
+          );
+        })}
+      </ol>
+    </nav>
+  );
+}
+
 function ComparisonPanel({
   services,
   onRemove,
@@ -285,7 +418,7 @@ export function ServicesNavigatorPage() {
   const searchParams = useSearchParams();
   const [sortValue, setSortValue] = useResultSort();
   const urlQuery = searchParams.get("q")?.trim() || searchParams.get("query")?.trim() || "";
-  const activeGroup = readServiceCoreGroup(searchParams.get("group"));
+  const categorySelection = useMemo(() => readServiceCoreGroupSelection(searchParams.get("group")), [searchParams]);
   const [localQuery, setLocalQuery] = useState(() => ({ urlQuery, value: urlQuery }));
   const query = localQuery.urlQuery === urlQuery ? localQuery.value : urlQuery;
   const deferredQuery = useDeferredValue(query);
@@ -300,11 +433,6 @@ export function ServicesNavigatorPage() {
     if (ranked.length) return ranked.map((match) => match.service);
     return [];
   }, [deferredQuery, query, searchableRecords]);
-  const groupedMatches = useMemo(
-    () => rankedMatches.filter((service) => serviceMatchesCoreGroup(service, activeGroup)),
-    [activeGroup, rankedMatches],
-  );
-
   // Facet selection lives in the URL, alongside `q`/`group`, so a filtered
   // services search stays shareable and survives navigating away and back —
   // see docs/filter-contract.md section 1 and PR C's own scope note.
@@ -312,12 +440,16 @@ export function ServicesNavigatorPage() {
   const substanceLens = searchParams.get("substance") ?? "all";
   const resultScope: ServiceResultScope = searchParams.get("scope") === "all" ? "all" : "results";
   // The scope segment (section 4) lets a reader who has narrowed to zero
-  // widen from the query/group-scoped set to the whole 219-item catalogue
+  // widen from the query-scoped set to the whole 219-item catalogue
   // without discarding the query. Gated on the UNFACETED result set so the
   // segment does not flicker away as facets are applied — narrowing with
   // facets only ever makes "catalogue > results" more true, never less.
-  const showResultScope = searchableRecords.length > groupedMatches.length;
-  const facetBaseMatches = resultScope === "all" ? searchableRecords : groupedMatches;
+  const showResultScope = searchableRecords.length > rankedMatches.length;
+  const scopeBaseMatches = resultScope === "all" ? searchableRecords : rankedMatches;
+  const facetBaseMatches = useMemo(
+    () => scopeBaseMatches.filter((service) => serviceMatchesCoreGroupSelection(service, categorySelection)),
+    [categorySelection, scopeBaseMatches],
+  );
   const facetedMatches = useMemo(
     () => filterServicesByFacets(facetBaseMatches, facetSelection, substanceLens),
     [facetBaseMatches, facetSelection, substanceLens],
@@ -326,38 +458,92 @@ export function ServicesNavigatorPage() {
     () => sortResultItems(facetedMatches, sortValue, (service) => service.title),
     [facetedMatches, sortValue],
   );
-  // Both scope segments show the current facet selection applied — "counts
-  // on both" — differing only in whether the query/group scoping applies.
+  // Both scope segments show the current category/facet selection applied —
+  // "counts on both" — differing only in whether the query scoping applies.
   const resultsScopedCount = useMemo(
-    () => filterServicesByFacets(groupedMatches, facetSelection, substanceLens).length,
-    [groupedMatches, facetSelection, substanceLens],
+    () =>
+      filterServicesByFacets(
+        rankedMatches.filter((service) => serviceMatchesCoreGroupSelection(service, categorySelection)),
+        facetSelection,
+        substanceLens,
+      ).length,
+    [categorySelection, facetSelection, rankedMatches, substanceLens],
   );
   const allScopedCount = useMemo(
-    () => filterServicesByFacets(searchableRecords, facetSelection, substanceLens).length,
-    [searchableRecords, facetSelection, substanceLens],
+    () =>
+      filterServicesByFacets(
+        searchableRecords.filter((service) => serviceMatchesCoreGroupSelection(service, categorySelection)),
+        facetSelection,
+        substanceLens,
+      ).length,
+    [categorySelection, facetSelection, searchableRecords, substanceLens],
   );
-  const activeFilterCount = serviceFacetSelectionSize(facetSelection) + (substanceLens === "all" ? 0 : 1);
+  const activeFilterCount =
+    categorySelection.size + serviceFacetSelectionSize(facetSelection) + (substanceLens === "all" ? 0 : 1);
   const relevanceRankMap = useMemo(() => {
     const map = new Map<string, number>();
     rankedMatches.forEach((service, index) => map.set(service.slug, index + 1));
     return map;
   }, [rankedMatches]);
-  const groupCounts = useMemo(
+  const categoryCounts = useMemo(
     () =>
       Object.fromEntries(
-        serviceCoreGroups.map((group) => [
-          group.id,
-          rankedMatches.filter((service) => serviceMatchesCoreGroup(service, group.id)).length,
-        ]),
+        serviceCoreGroups.map((group) => {
+          const widened = new Set(categorySelection);
+          widened.add(group.id);
+          const categoryMatches = scopeBaseMatches.filter((service) =>
+            serviceMatchesCoreGroupSelection(service, widened),
+          );
+          return [group.id, filterServicesByFacets(categoryMatches, facetSelection, substanceLens).length];
+        }),
       ) as Record<ServiceCoreGroupId, number>,
-    [rankedMatches],
+    [categorySelection, facetSelection, scopeBaseMatches, substanceLens],
   );
   const [selectedSlugs, setSelectedSlugs] = useState<string[]>([]);
   const selected = searchableRecords.filter((service) => selectedSlugs.includes(service.slug));
   const [showComparison, setShowComparison] = useState(false);
   const filterPanelId = useId();
   const [filterOpen, setFilterOpen] = useState(false);
-  const heading = query || (activeGroup ? serviceCoreGroupLabel(activeGroup) : "Browse services");
+  const selectedCategory = categorySelection.size === 1 ? [...categorySelection][0] : null;
+  const heading = query || (selectedCategory ? serviceCoreGroupLabel(selectedCategory) : "Browse services");
+  const accountData = useAccountData();
+  const [saveNotice, setSaveNotice] = useState<string | null>(null);
+  // The provider rolls back a failed mutation from its pre-request snapshot.
+  // Serialize writes from this multi-row surface so one row's rollback cannot
+  // erase another row's successful optimistic update.
+  const savingSlugsRef = useRef(new Set<string>());
+  const [savingSlugs, setSavingSlugs] = useState<ReadonlySet<string>>(() => new Set());
+  // Derived during render rather than tracked in an effect: the stage is a
+  // pure function of the shortlist state that already exists, and
+  // tests/audit-content-services-regressions.test.ts pins this file as
+  // effect-free.
+  const referralStage: ReferralStageId = showComparison ? "compare" : selectedSlugs.length ? "shortlist" : "search";
+
+  async function toggleSaved(slug: string) {
+    // Belt as well as braces: the control is disabled until the read settles,
+    // but a toggle computed from an unread library would invert the wrong
+    // state, so refuse it here too rather than trusting the caller.
+    if (!accountData.ready || accountData.loadError || savingSlugsRef.current.size > 0) return;
+    const service = searchableRecords.find((record) => record.slug === slug);
+    if (!service) return;
+    savingSlugsRef.current.add(slug);
+    setSavingSlugs(new Set(savingSlugsRef.current));
+    const nowSaved = !accountData.isSaved("service", slug);
+    try {
+      if (!(await accountData.setFavourite("service", slug, nowSaved))) {
+        setSaveNotice(
+          accountData.isAuthenticated ? "Save failed. Try again." : "Sign in or create an account to save services.",
+        );
+        return;
+      }
+      setSaveNotice(nowSaved ? `${service.title} saved to favourites.` : `${service.title} removed from favourites.`);
+    } catch {
+      setSaveNotice("Save failed. Try again.");
+    } finally {
+      savingSlugsRef.current.delete(slug);
+      setSavingSlugs(new Set(savingSlugsRef.current));
+    }
+  }
 
   function toggleSelected(slug: string) {
     setSelectedSlugs((current) => {
@@ -382,6 +568,17 @@ export function ServicesNavigatorPage() {
   // Facet/lens/scope toggles replace (not push) — a reader ticking several
   // chips should not spam the back-button history the way submitting a new
   // search does.
+  const toggleCategoryValue = useCallback(
+    (value: ServiceCoreGroupId) => {
+      updateParams((params) => {
+        const next = new Set(readServiceCoreGroupSelection(params.get("group")));
+        if (!next.delete(value)) next.add(value);
+        writeServiceCoreGroupSelectionToParams(params, next);
+      }, true);
+    },
+    [updateParams],
+  );
+
   const toggleFacetValue = useCallback(
     (dimension: ServiceFacetDimension, value: string) => {
       updateParams((params) => {
@@ -414,13 +611,13 @@ export function ServicesNavigatorPage() {
     [updateParams],
   );
 
-  // Never touches `q`/`query`/`group` — docs/filter-contract.md section 6:
-  // clearing filters and clearing a search are different intentions. The
-  // quick filters this sheet used to hold DID conflate the two (clearing
-  // them wiped the search box); moving them to suggestion chips below the
-  // band removes that conflation rather than papering over it here.
+  // Never touches `q`/`query` — docs/filter-contract.md section 6: clearing
+  // filters and clearing a search are different intentions. `group` is now
+  // the URL-backed Service category facet, so it is cleared with the rest of
+  // the filter state rather than behaving as a separate navigation strip.
   const clearAllFilters = useCallback(() => {
     updateParams((params) => {
+      params.delete("group");
       for (const dimension of serviceFacetDimensions) params.delete(dimension);
       params.delete("substance");
       params.delete("scope");
@@ -437,17 +634,27 @@ export function ServicesNavigatorPage() {
     });
   }
 
-  function hrefForGroup(group: ServiceCoreGroupId | null) {
-    const params = new URLSearchParams(searchParams.toString());
-    params.set("run", "1");
-    if (group) params.set("group", group);
-    else params.delete("group");
-    return `/services?${params.toString()}`;
-  }
-
   // `substance_flags` is an exact partition (measured 2026-08-12: all 219
   // services carry exactly one of general/aod) — a lens, not a facet. See
   // src/lib/service-facets.ts for the full measurement note.
+  const categoryGroup = useMemo(
+    () =>
+      resultFilterFacetGroup({
+        id: "service-category",
+        label: "Service category",
+        selected: categorySelection,
+        options: serviceCoreGroups.map((group) => ({
+          value: group.id,
+          label: group.label,
+          searchText: `${group.label} ${group.shortLabel}`,
+          hint: String(categoryCounts[group.id]),
+          disabled: categoryCounts[group.id] === 0 && !categorySelection.has(group.id),
+        })),
+        onToggle: toggleCategoryValue,
+      }),
+    [categoryCounts, categorySelection, toggleCategoryValue],
+  );
+
   const substanceOptionValues = useMemo(() => deriveSubstanceLensOptions(searchableRecords), [searchableRecords]);
   const substanceGroup = useMemo(
     () =>
@@ -509,6 +716,35 @@ export function ServicesNavigatorPage() {
     [facetBaseMatches, facetSelection, searchableRecords, substanceLens, toggleFacetValue],
   );
 
+  const appliedFilters = useMemo<AppliedFilterChip[]>(() => {
+    const chips: AppliedFilterChip[] = [];
+    for (const group of serviceCoreGroups) {
+      if (!categorySelection.has(group.id)) continue;
+      chips.push({
+        id: `service-category:${group.id}`,
+        label: group.label,
+        onRemove: () => toggleCategoryValue(group.id),
+      });
+    }
+    if (substanceLens !== "all") {
+      chips.push({
+        id: `substance:${substanceLens}`,
+        label: serviceSubstanceLensValueLabel(substanceLens),
+        onRemove: () => setSubstanceLensValue("all"),
+      });
+    }
+    for (const dimension of serviceFacetDimensions) {
+      for (const value of facetSelection[dimension]) {
+        chips.push({
+          id: `${dimension}:${value}`,
+          label: serviceFacetValueLabel(dimension, value),
+          onRemove: () => toggleFacetValue(dimension, value),
+        });
+      }
+    }
+    return chips;
+  }, [categorySelection, facetSelection, setSubstanceLensValue, substanceLens, toggleCategoryValue, toggleFacetValue]);
+
   return (
     <SearchResultsLayout
       testId="services-navigator"
@@ -521,43 +757,6 @@ export function ServicesNavigatorPage() {
             className="mode-home-composer-slot hidden w-full min-w-0 [&:not(:empty)]:block"
           />
 
-          {selected.length ? (
-            <section
-              data-testid="services-shortlist-bar"
-              aria-label="Service shortlist"
-              className="flex min-h-14 flex-wrap items-center justify-between gap-2 rounded-xl border border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)] px-3 py-2 sm:px-4"
-            >
-              <span className="inline-flex items-center gap-2 text-sm font-bold text-[color:var(--clinical-accent)]">
-                <ListChecks className="h-4 w-4" aria-hidden />
-                {selected.length} shortlisted
-              </span>
-              <span className="flex items-center gap-1.5">
-                <button
-                  type="button"
-                  onClick={() => setShowComparison(true)}
-                  disabled={selected.length < 2}
-                  title={
-                    selected.length < 2 ? "Shortlist at least two services to compare" : "Compare shortlisted services"
-                  }
-                  className="inline-flex min-h-12 items-center gap-1.5 rounded-lg px-3 text-xs font-bold text-[color:var(--clinical-accent)] hover:bg-[color:var(--surface)] focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)] disabled:cursor-not-allowed disabled:opacity-50 sm:min-h-10"
-                >
-                  <GitCompareArrows className="h-4 w-4" aria-hidden />
-                  Compare
-                </button>
-                <button
-                  type="button"
-                  onClick={() => {
-                    setSelectedSlugs([]);
-                    setShowComparison(false);
-                  }}
-                  className="inline-flex min-h-12 items-center rounded-lg px-3 text-xs font-bold text-[color:var(--text-muted)] hover:bg-[color:var(--surface)] focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)] sm:min-h-10"
-                >
-                  Clear
-                </button>
-              </span>
-            </section>
-          ) : null}
-
           <SearchResultsHeaderBand
             modeId="services"
             query={heading}
@@ -593,6 +792,8 @@ export function ServicesNavigatorPage() {
             }
             sortValue={sortValue}
             onSortChange={setSortValue}
+            appliedFilters={appliedFilters}
+            onClearFilters={activeFilterCount > 0 ? clearAllFilters : undefined}
             mobileControlsPlacement="inline"
             mobileControls={
               <ResultFilterTrigger
@@ -618,13 +819,61 @@ export function ServicesNavigatorPage() {
             }
           />
 
-          <section className="grid gap-3 rounded-xl border border-[color:var(--border)] bg-[color:var(--surface)] p-3 shadow-[var(--shadow-inset)] sm:p-4">
-            <ServiceGroupNav
-              activeGroup={activeGroup}
-              hrefForGroup={hrefForGroup}
-              counts={{ ...groupCounts, all: rankedMatches.length }}
-            />
-          </section>
+          {/* Progress, then the shortlist banner, then browse — the banner
+              sits under the heading it qualifies rather than above it, and
+              appears only once something is shortlisted. */}
+          <ServiceReferralProgress active={referralStage} />
+
+          {selected.length ? (
+            <section
+              data-testid="services-shortlist-bar"
+              aria-label="Service shortlist"
+              className="flex min-h-14 flex-wrap items-center justify-between gap-2 rounded-xl border border-[color:var(--clinical-accent-border)] bg-[color:var(--clinical-accent-soft)] px-3 py-2 sm:px-4"
+            >
+              <span className="inline-flex items-center gap-2 text-sm font-bold text-[color:var(--clinical-accent)]">
+                <ListChecks className="h-4 w-4" aria-hidden />
+                {selected.length} shortlisted
+              </span>
+              <span className="flex items-center gap-1.5">
+                <button
+                  type="button"
+                  onClick={() => setShowComparison(true)}
+                  disabled={selected.length < 2}
+                  title={
+                    selected.length < 2 ? "Shortlist at least two services to compare" : "Compare shortlisted services"
+                  }
+                  className="inline-flex min-h-12 items-center gap-1.5 rounded-lg px-3 text-xs font-bold text-[color:var(--clinical-accent)] hover:bg-[color:var(--surface)] focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)] disabled:cursor-not-allowed disabled:opacity-50 sm:min-h-10"
+                >
+                  <GitCompareArrows className="h-4 w-4" aria-hidden />
+                  Compare
+                </button>
+                <button
+                  type="button"
+                  onClick={() => {
+                    setSelectedSlugs([]);
+                    setShowComparison(false);
+                  }}
+                  className="inline-flex min-h-12 items-center rounded-lg px-3 text-xs font-bold text-[color:var(--text-muted)] hover:bg-[color:var(--surface)] focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)] sm:min-h-10"
+                >
+                  Clear
+                </button>
+              </span>
+            </section>
+          ) : null}
+
+          {/* The bookmark control is otherwise silent, and a failed save must
+              not read as a success. Visible rather than sr-only: "Sign in to
+              save services" is the common outcome for a guest, and hiding it
+              from sighted readers leaves the bookmark looking simply broken.
+              The live region is always mounted so the announcement is not
+              swallowed by the node appearing at the same time as its text. */}
+          <p
+            role="status"
+            aria-live="polite"
+            className={cn("text-xs font-semibold text-[color:var(--text-muted)]", saveNotice ? "min-h-5" : "sr-only")}
+          >
+            {saveNotice ?? ""}
+          </p>
 
           <ResultFilterSheet
             open={filterOpen}
@@ -632,10 +881,11 @@ export function ServicesNavigatorPage() {
             panelId={filterPanelId}
             testId="service-filter-panel"
             title="Filter services"
-            groups={[substanceGroup, ...facetGroups]}
+            description="Narrow the current search by service category, program and referral fit."
+            groups={[categoryGroup, substanceGroup, ...facetGroups]}
             onClearAll={activeFilterCount > 0 ? clearAllFilters : undefined}
             footerNote={`${displayedMatches.length} showing`}
-            chromeResetKey={`${deferredQuery}|${activeGroup ?? ""}|${resultScope}`}
+            chromeResetKey={`${deferredQuery}|${searchParams.get("group") ?? ""}|${resultScope}`}
             scopeControl={
               showResultScope ? (
                 <SegmentedControl
@@ -670,32 +920,23 @@ export function ServicesNavigatorPage() {
           onTryExample={(example) => applyServiceQuery(example)}
         />
       ) : deferredQuery === query && displayedMatches.length === 0 ? (
-        // `displayedMatches` is now group- AND facet/lens-narrowed, so a zero
-        // here can come from either — the old copy named only the group tab
-        // and a "quick filter" concept that no longer filters anything (it
-        // navigates). Offer both escapes, and only the one that applies.
+        // `displayedMatches` is category- AND facet/lens-narrowed, so every
+        // constraint can be relaxed from the same filter surface without
+        // discarding the search query.
         <section className="rounded-xl border border-[color:var(--border)] bg-[color:var(--surface)] p-5 text-center">
           <h2 className="text-lg font-bold text-[color:var(--text-heading)]">No services match</h2>
           <p className="mt-1 text-sm text-[color:var(--text-muted)]">
-            {activeFilterCount > 0 ? "Try All services, or clear your filters." : "Try All services instead."}
+            {activeFilterCount > 0 ? "Adjust or clear your filters to see more services." : "Try a broader search."}
           </p>
-          <div className="mt-3 flex flex-wrap items-center justify-center gap-2">
-            <Link
-              href={hrefForGroup(null)}
-              className="inline-flex min-h-12 items-center justify-center rounded-lg border border-[color:var(--clinical-accent)] px-4 text-sm font-bold text-[color:var(--clinical-accent)] focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)]"
+          {activeFilterCount > 0 ? (
+            <button
+              type="button"
+              onClick={clearAllFilters}
+              className="mt-3 inline-flex min-h-12 items-center justify-center rounded-lg border border-[color:var(--clinical-accent)] bg-[color:var(--clinical-accent-soft)] px-4 text-sm font-bold text-[color:var(--clinical-accent)] focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)]"
             >
-              Show all services
-            </Link>
-            {activeFilterCount > 0 ? (
-              <button
-                type="button"
-                onClick={clearAllFilters}
-                className="inline-flex min-h-12 items-center justify-center rounded-lg border border-[color:var(--border)] bg-[color:var(--surface)] px-4 text-sm font-bold text-[color:var(--text)] hover:bg-[color:var(--surface-subtle)] focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)]"
-              >
-                Clear filters
-              </button>
-            ) : null}
-          </div>
+              Clear filters
+            </button>
+          ) : null}
         </section>
       ) : (
         <>
@@ -711,6 +952,11 @@ export function ServicesNavigatorPage() {
                 relevanceRank={sortValue === "alpha" ? null : (relevanceRankMap.get(service.slug) ?? null)}
                 selected={selectedSlugs.includes(service.slug)}
                 onToggleSelected={toggleSelected}
+                saved={accountData.isSaved("service", service.slug)}
+                savedStateReady={accountData.ready}
+                savedStateLoadFailed={Boolean(accountData.loadError)}
+                savePending={savingSlugs.size > 0}
+                onToggleSaved={toggleSaved}
               />
             ))}
           </div>
diff --git a/src/components/tools-page-mockups/tools-search-mode-mockup.tsx b/src/components/tools-page-mockups/tools-search-mode-mockup.tsx
index 3bdbe7baa2..0a8e966a04 100644
--- a/src/components/tools-page-mockups/tools-search-mode-mockup.tsx
+++ b/src/components/tools-page-mockups/tools-search-mode-mockup.tsx
@@ -3,5 +3,5 @@
 import { ToolsSearchResultsPage } from "@/components/tools/tools-search-results-page";
 
 export function ToolsSearchModeMockup() {
-  return <ToolsSearchResultsPage initialQuery="Compare" testId="tools-search-mode-mockup" />;
+  return <ToolsSearchResultsPage initialQuery="Compare" canAccessFavourites={true} testId="tools-search-mode-mockup" />;
 }
diff --git a/src/components/tools/tools-search-results-page.tsx b/src/components/tools/tools-search-results-page.tsx
index faa95fdd2f..43f5e5ef5e 100644
--- a/src/components/tools/tools-search-results-page.tsx
+++ b/src/components/tools/tools-search-results-page.tsx
@@ -12,6 +12,7 @@ import {
   Pill,
   Search,
   ShieldCheck,
+  Star,
   Users,
   Waves,
   type LucideIcon,
@@ -23,14 +24,23 @@ import {
   ResultFilterTrigger,
   resultFilterGroup,
 } from "@/components/clinical-dashboard/result-filter-control";
+import { useFavouritesAccess } from "@/components/clinical-dashboard/use-favourites-access";
 import { useSearchCommand } from "@/components/clinical-dashboard/search-command-context";
 import { UniversalSearchAlsoMatches } from "@/components/clinical-dashboard/universal-search-also-matches";
 import { SearchResultsHeaderBand } from "@/components/clinical-dashboard/search-results-header-band";
+import { DesktopComposerPortalSlot } from "@/components/desktop-composer-portal-slot";
 import { cn, controlBase, floatingControl } from "@/components/ui-primitives";
 import { SegmentedControl } from "@/components/ui/segmented-control";
 import { Sheet } from "@/components/ui/sheet";
 import { normalizeSearchText } from "@/lib/catalog-search";
-import { toolCatalogRecords, toolSearchText, type ToolCatalogArea, type ToolCatalogRecord } from "@/lib/tools-catalog";
+import { isLocalNoAuthMode, resolveClientDemoMode } from "@/lib/client-env";
+import { useAuthSession } from "@/lib/supabase/client";
+import {
+  toolCatalogRecordsForSession,
+  toolSearchText,
+  type ToolCatalogArea,
+  type ToolCatalogRecord,
+} from "@/lib/tools-catalog";
 
 const focusRing =
   "focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)]";
@@ -43,6 +53,7 @@ const iconByToolId: Record<string, LucideIcon> = {
   documents: FileText,
   services: Users,
   forms: FileCheck2,
+  favourites: Star,
 };
 
 const filterOptions = [
@@ -51,6 +62,7 @@ const filterOptions = [
   { id: "reference", label: "Evidence" },
   { id: "care", label: "Treat" },
   { id: "coordination", label: "Coordinate" },
+  { id: "saved", label: "Saved" },
 ] as const satisfies ReadonlyArray<{ id: "all" | ToolCatalogArea; label: string }>;
 
 type FilterId = (typeof filterOptions)[number]["id"];
@@ -228,11 +240,24 @@ function DetailActions({ tool }: { tool: ToolCatalogRecord }) {
 
 export function ToolsSearchResultsPage({
   initialQuery = "",
+  desktopComposerSlotId,
+  canAccessFavourites: canAccessFavouritesProp,
   testId = "tools-search-results-page",
 }: {
   initialQuery?: string;
+  desktopComposerSlotId?: string;
+  /** Optional deterministic override; defaults to the current auth/demo session gate. */
+  canAccessFavourites?: boolean;
   testId?: string;
 }) {
+  const auth = useAuthSession();
+  const clientDemoMode = resolveClientDemoMode({
+    explicitDemoMode: process.env.NEXT_PUBLIC_DEMO_MODE === "true",
+    authUnavailableFallback: !auth.isConfigured,
+    localNoAuthMode: isLocalNoAuthMode(),
+  });
+  const { favouritesAccessible } = useFavouritesAccess(auth.status === "authenticated", clientDemoMode);
+  const canAccessFavourites = canAccessFavouritesProp ?? favouritesAccessible;
   const searchCommand = useSearchCommand();
   const hydrated = useSyncExternalStore(
     subscribeNoop,
@@ -246,7 +271,7 @@ export function ToolsSearchResultsPage({
   const filterPanelId = useId();
   const [activeFilter, setActiveFilter] = useState<FilterId>("all");
   const [filterOpen, setFilterOpen] = useState(false);
-  const [selectedId, setSelectedId] = useState("differentials");
+  const [selectedId, setSelectedId] = useState("");
   const [phoneDetailOpen, setPhoneDetailOpen] = useState(false);
   const [openSection, setOpenSection] = useState<DetailSectionId | null>(null);
   const detailReturnFocusRef = useRef<HTMLElement | null>(null);
@@ -265,12 +290,24 @@ export function ToolsSearchResultsPage({
     return () => desktopMedia.removeEventListener("change", closePhoneOverlaysOnDesktop);
   }, []);
 
+  const accessibleTools = useMemo(
+    () =>
+      toolCatalogRecordsForSession({
+        authenticated: canAccessFavourites,
+        demoMode: false,
+      }),
+    [canAccessFavourites],
+  );
+  const visibleFilterOptions = useMemo(
+    () => (canAccessFavourites ? filterOptions : filterOptions.filter((option) => option.id !== "saved")),
+    [canAccessFavourites],
+  );
+  const effectiveActiveFilter: FilterId = activeFilter === "saved" && !canAccessFavourites ? "all" : activeFilter;
+
   const queryMatchedTools = useMemo(() => {
     const normalized = normalizeSearchText(query);
-    return toolCatalogRecords.filter(
-      (tool) => (!normalized || toolSearchText(tool).includes(normalized)) && tool.id !== "favourites",
-    );
-  }, [query]);
+    return accessibleTools.filter((tool) => !normalized || toolSearchText(tool).includes(normalized));
+  }, [accessibleTools, query]);
 
   const filterCounts = useMemo<Record<FilterId, number>>(
     () => ({
@@ -279,24 +316,28 @@ export function ToolsSearchResultsPage({
       reference: queryMatchedTools.filter((tool) => tool.area === "reference").length,
       care: queryMatchedTools.filter((tool) => tool.area === "care").length,
       coordination: queryMatchedTools.filter((tool) => tool.area === "coordination").length,
+      saved: queryMatchedTools.filter((tool) => tool.area === "saved").length,
     }),
     [queryMatchedTools],
   );
 
   const filteredTools = useMemo(
-    () => (activeFilter === "all" ? queryMatchedTools : queryMatchedTools.filter((tool) => tool.area === activeFilter)),
-    [activeFilter, queryMatchedTools],
+    () =>
+      effectiveActiveFilter === "all"
+        ? queryMatchedTools
+        : queryMatchedTools.filter((tool) => tool.area === effectiveActiveFilter),
+    [effectiveActiveFilter, queryMatchedTools],
   );
 
   const filterControlOptions = useMemo(
     () =>
-      filterOptions.map((option) => ({
+      visibleFilterOptions.map((option) => ({
         value: option.id,
         label: option.label,
         hint: String(filterCounts[option.id]),
-        disabled: filterCounts[option.id] === 0 && activeFilter !== option.id,
+        disabled: filterCounts[option.id] === 0 && effectiveActiveFilter !== option.id,
       })),
-    [activeFilter, filterCounts],
+    [effectiveActiveFilter, filterCounts, visibleFilterOptions],
   );
 
   const selectedTool = filteredTools.find((tool) => tool.id === selectedId) ?? filteredTools[0] ?? null;
@@ -321,6 +362,13 @@ export function ToolsSearchResultsPage({
       data-testid={testId}
       className="mx-auto w-full max-w-[90rem] overflow-x-hidden px-4 pb-12 pt-4 text-[color:var(--text)] sm:px-6 sm:pt-6 lg:px-8 lg:pt-8"
     >
+      {desktopComposerSlotId ? (
+        <DesktopComposerPortalSlot
+          id={desktopComposerSlotId}
+          data-testid="tools-results-home-composer"
+          className="mode-home-composer-slot mx-auto mb-4 hidden w-full max-w-3xl [&:not(:empty)]:block sm:mb-6"
+        />
+      ) : null}
       <section
         className={cn(
           "mx-auto grid max-w-6xl gap-5 lg:items-start",
@@ -330,7 +378,7 @@ export function ToolsSearchResultsPage({
         <div className="min-w-0">
           <SearchResultsHeaderBand
             modeId="tools"
-            query={query}
+            query={query.trim() || "All tools"}
             matchCount={filteredTools.length}
             headingLevel={1}
             filterLabel="Filter tools by category"
@@ -339,7 +387,7 @@ export function ToolsSearchResultsPage({
                 panelId={filterPanelId}
                 testId="tools-search-filter-trigger-phone"
                 open={filterOpen}
-                activeCount={activeFilter === "all" ? 0 : 1}
+                activeCount={effectiveActiveFilter === "all" ? 0 : 1}
                 onToggle={() => setFilterOpen((current) => !current)}
                 title="Filter tools"
               />
@@ -347,7 +395,7 @@ export function ToolsSearchResultsPage({
             mobileControlsPlacement="inline"
             filterControls={
               <SegmentedControl
-                value={activeFilter}
+                value={effectiveActiveFilter}
                 onChange={setActiveFilter}
                 options={filterControlOptions}
                 label="Tool category"
@@ -364,12 +412,12 @@ export function ToolsSearchResultsPage({
               resultFilterGroup({
                 id: "category",
                 label: "Category",
-                value: activeFilter,
+                value: effectiveActiveFilter,
                 options: filterControlOptions,
                 onChange: setActiveFilter,
               }),
             ]}
-            onClearAll={activeFilter === "all" ? undefined : () => setActiveFilter("all")}
+            onClearAll={effectiveActiveFilter === "all" ? undefined : () => setActiveFilter("all")}
             footerNote={`${filteredTools.length} showing`}
           />
 
diff --git a/src/components/ui/sheet.tsx b/src/components/ui/sheet.tsx
index a9f26b36e6..1baba55e63 100644
--- a/src/components/ui/sheet.tsx
+++ b/src/components/ui/sheet.tsx
@@ -9,6 +9,7 @@ import {
   type PointerEvent as ReactPointerEvent,
   type ReactNode,
   type RefObject,
+  type UIEventHandler,
 } from "react";
 import { X } from "lucide-react";
 import { OverlayPortal } from "@/components/ui/overlay-root";
@@ -24,6 +25,7 @@ import {
 } from "@/components/ui/sheet-focus";
 
 export type SheetMobileSize = "content" | "viewport";
+export type SheetMobileHeaderSafeArea = "none" | "padding" | "offset";
 
 type SheetAccessibleName =
   | { title: string; labelledBy?: string; ariaLabel?: string }
@@ -56,9 +58,19 @@ type SheetBaseProps = {
   contentClassName?: string;
   contentStyle?: CSSProperties;
   bodyClassName?: string;
+  bodyRef?: RefObject<HTMLDivElement | null>;
+  onBodyScroll?: UIEventHandler<HTMLDivElement>;
+  footerClassName?: string;
   placement?: "default" | "left";
   mobilePlacement?: "bottom" | "top" | "fullscreen";
   mobileSize?: SheetMobileSize;
+  /**
+   * Keeps the Sheet-owned header controls below the phone top safe area.
+   * Fullscreen sheets default to `padding`; near-full bottom sheets must opt in
+   * because short bottom sheets should not inherit a notch-sized empty band.
+   * Use `offset` only for an absolutely positioned header.
+   */
+  mobileHeaderSafeArea?: SheetMobileHeaderSafeArea;
   portal?: boolean;
   desktopBackdropClassName?: string;
   testId?: string;
@@ -102,9 +114,13 @@ export function Sheet({
   contentClassName,
   contentStyle,
   bodyClassName,
+  bodyRef,
+  onBodyScroll,
+  footerClassName,
   placement = "default",
   mobilePlacement = "bottom",
   mobileSize = "content",
+  mobileHeaderSafeArea,
   portal = true,
   desktopBackdropClassName,
   testId,
@@ -344,6 +360,7 @@ export function Sheet({
   const defaultSheetIsFullscreen = placement !== "left" && mobilePlacement === "fullscreen";
   const defaultSheetIsTopAligned = placement !== "left" && mobilePlacement === "top";
   const defaultSheetUsesViewportSize = placement !== "left" && mobileSize === "viewport";
+  const resolvedMobileHeaderSafeArea = mobileHeaderSafeArea ?? (defaultSheetIsFullscreen ? "padding" : "none");
   const contentClassTokens = contentClassName?.split(/\s+/) ?? [];
   const hasMobileMaxHeight = contentClassTokens.some((token) => /^!?max-h-/.test(token));
   const hasSmallScreenMaxHeight = contentClassTokens.some((token) => /^sm:!?max-h-/.test(token));
@@ -381,6 +398,7 @@ export function Sheet({
         ref={panelRef}
         id={id}
         data-testid={testId}
+        data-mobile-header-safe-area={resolvedMobileHeaderSafeArea}
         role="dialog"
         aria-modal="true"
         aria-labelledby={resolvedLabelledBy}
@@ -441,9 +459,12 @@ export function Sheet({
         </div>
         {title ? (
           <div
+            data-sheet-header="true"
             className={cn(
               "flex items-center justify-between gap-3 border-b border-[color:var(--border)] p-4 sm:p-5",
               headerClassName,
+              resolvedMobileHeaderSafeArea === "padding" && "pt-[max(1rem,var(--safe-area-top))] sm:pt-5",
+              resolvedMobileHeaderSafeArea === "offset" && "top-[max(0.75rem,var(--safe-area-top))] sm:top-4",
             )}
           >
             <div className="flex min-w-0 flex-1 items-center gap-3">
@@ -483,10 +504,18 @@ export function Sheet({
             </div>
           </div>
         ) : null}
-        <div className={cn("min-h-0 min-w-0 flex-1 overflow-y-auto p-4 polished-scroll sm:p-5", bodyClassName)}>
+        <div
+          ref={bodyRef}
+          onScroll={onBodyScroll}
+          className={cn("min-h-0 min-w-0 flex-1 overflow-y-auto p-4 polished-scroll sm:p-5", bodyClassName)}
+        >
           {children}
         </div>
-        {footer ? <div className="shrink-0 border-t border-[color:var(--border)] p-3 sm:p-4">{footer}</div> : null}
+        {footer ? (
+          <div className={cn("shrink-0 border-t border-[color:var(--border)] p-3 sm:p-4", footerClassName)}>
+            {footer}
+          </div>
+        ) : null}
       </div>
     </div>
   );
diff --git a/src/lib/api-list-response.ts b/src/lib/api-list-response.ts
index 0f0b980f06..ea143ff7c1 100644
--- a/src/lib/api-list-response.ts
+++ b/src/lib/api-list-response.ts
@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { z } from "zod";
 
 /**
  * Shared shapes for the admin list endpoints (documents, jobs, ingestion jobs,
@@ -11,6 +12,36 @@ export const ACTIVE_INDEXING_POLL_MS = 5_000;
 
 export type StatusRow = Record<string, unknown> & { status?: string | null };
 
+const statusRowSchema = z
+  .object({
+    status: z.string().nullable().optional(),
+  })
+  .passthrough();
+
+/**
+ * Validates an untrusted list-query result without exposing schema diagnostics.
+ * Route schemas decide which selected fields are required and whether unknown
+ * fields should be preserved.
+ */
+export function parseListRows<Row>(data: unknown, rowSchema: z.ZodType<Row>): Row[] {
+  const parsed = z.array(rowSchema).safeParse(data);
+  if (!parsed.success) {
+    // Keep dependency-response details out of both the public response and logs.
+    throw new Error("Invalid list data.");
+  }
+  return parsed.data;
+}
+
+/**
+ * Validates untrusted list-query output before it is counted or returned.
+ * Unknown fields are preserved because these endpoints intentionally expose
+ * the selected database rows, but every row must be an object and `status`
+ * must retain the text/null shape used by polling clients.
+ */
+export function parseStatusRows(data: unknown): StatusRow[] {
+  return parseListRows(data, statusRowSchema);
+}
+
 export type OffsetPagination = {
   limit: number;
   offset: number;
diff --git a/src/lib/app-mode-icons.ts b/src/lib/app-mode-icons.ts
index 090584c44d..0f91559cc3 100644
--- a/src/lib/app-mode-icons.ts
+++ b/src/lib/app-mode-icons.ts
@@ -2,6 +2,7 @@ import {
   BookOpenCheck,
   BookOpenText,
   BrainCircuit,
+  Calculator,
   Compass,
   FileSignature,
   FileText,
@@ -30,6 +31,7 @@ export const appModeIcons: Record<AppModeId, LucideIcon> = {
   formulation: Network,
   prescribing: Pill,
   tools: Wrench,
+  calculators: Calculator,
   "therapy-compass": Compass,
   factsheets: BookOpenText,
 };
diff --git a/src/lib/app-modes.ts b/src/lib/app-modes.ts
index 704ad37b77..1c74249d65 100644
--- a/src/lib/app-modes.ts
+++ b/src/lib/app-modes.ts
@@ -14,6 +14,7 @@ export const appModeIds = [
   "formulation",
   "prescribing",
   "tools",
+  "calculators",
   "therapy-compass",
   "factsheets",
 ] as const;
@@ -31,6 +32,7 @@ export type AppModeSearchKind =
   | "dsm"
   | "specifiers"
   | "formulation"
+  | "calculators"
   | "tools";
 export type AppModeResultKind = AppModeSearchKind;
 
@@ -336,6 +338,29 @@ export const appModeDefinitions = [
       badgeLabel: null,
     },
   },
+  {
+    id: "calculators",
+    label: "Calculators",
+    description: "Source-cited psychiatry scores and clinical decision calculators",
+    href: "/calculators",
+    search: {
+      kind: "calculators",
+      placeholder: "Search calculators by scale, symptom, or indication...",
+      inputAriaLabel: "Search clinical calculators by scale, symptom, or indication",
+      submitIdleLabel: "Calculate",
+      submitBusyLabel: "Calculate",
+      submitAriaLabel: "Search clinical calculators",
+      emptyTitle: "Search clinical calculators",
+      readyTitle: "Find a clinical calculator",
+      progressLabel: "Searching the local calculator catalogue.",
+      resultKind: "calculators",
+      resultHeading: "Calculator matches",
+      resultsSurface: "results-band",
+      statusLabel: "Calculators",
+      nextStep: "Open a calculator to score it and review next actions",
+      badgeLabel: null,
+    },
+  },
   {
     id: "therapy-compass",
     label: "Therapy",
@@ -429,6 +454,7 @@ const namespaceIsolatedModes = new Set<AppModeId>([
   "therapy-compass",
   "factsheets",
   "tools",
+  "calculators",
 ]);
 
 export function appModeHomeHref(modeId: AppModeId, options: SearchNavigationOptions = {}) {
@@ -523,6 +549,7 @@ export function isSearchableAppMode(modeId: string): modeId is SearchableAppMode
     kind === "dsm" ||
     kind === "specifiers" ||
     kind === "formulation" ||
+    kind === "calculators" ||
     kind === "tools"
   );
 }
diff --git a/src/lib/client-env.ts b/src/lib/client-env.ts
index 13e8a1f51f..9ff30e70fb 100644
--- a/src/lib/client-env.ts
+++ b/src/lib/client-env.ts
@@ -3,6 +3,13 @@ export function isLocalNoAuthMode() {
   return process.env.NODE_ENV !== "production" && process.env.NEXT_PUBLIC_LOCAL_NO_AUTH === "true";
 }
 
+/** Build-time client gate for #100 Phase 1 evidence-preview rendering. */
+export function incrementalEvidencePreviewRenderingEnabled(
+  value = process.env.NEXT_PUBLIC_RAG_INCREMENTAL_EVIDENCE_PREVIEW_RENDER,
+) {
+  return value === "true";
+}
+
 export function resolveClientDemoMode({
   explicitDemoMode,
   authUnavailableFallback,
diff --git a/src/lib/differential-search-composition.ts b/src/lib/differential-search-composition.ts
index aa075712d4..2e5a09f6f9 100644
--- a/src/lib/differential-search-composition.ts
+++ b/src/lib/differential-search-composition.ts
@@ -26,6 +26,8 @@ export type DifferentialSearchResultItem = {
   score: number;
   matchLabel: "Best match" | "High match" | "Moderate match" | "Lower match";
   tags: string[];
+  clinicalCues: string[];
+  nextSteps: string[];
   safety: string;
   reasons: string[];
 };
@@ -44,6 +46,8 @@ function diagnosisResultItem(match: DifferentialRecordMatch): Omit<DifferentialS
     tags: [...record.currentPresentation.slice(0, 3), record.investigations[0]]
       .filter((value): value is string => Boolean(value?.trim()))
       .slice(0, 4),
+    clinicalCues: record.currentPresentation.filter((value) => value.trim()).slice(0, 3),
+    nextSteps: record.investigations.filter((value) => value.trim()).slice(0, 2),
     safety: record.safetySnapshot.summary,
     reasons,
   };
@@ -63,6 +67,8 @@ function presentationResultItem(
     status: workflow.status,
     score,
     tags: workflow.safetySnapshot.tags.slice(0, 4),
+    clinicalCues: workflow.safetySnapshot.tags.filter((value) => value.trim()).slice(0, 3),
+    nextSteps: workflow.reviewChecklist.filter((value) => value.trim()).slice(0, 2),
     safety: workflow.safetySnapshot.summary,
     reasons,
   };
diff --git a/src/lib/mode-secondary-navigation.ts b/src/lib/mode-secondary-navigation.ts
index 48b959ab4d..ac51ae9629 100644
--- a/src/lib/mode-secondary-navigation.ts
+++ b/src/lib/mode-secondary-navigation.ts
@@ -57,10 +57,11 @@ export const modeSecondaryNavigationRegistry = {
   ],
   prescribing: [],
   tools: [],
+  calculators: [],
   // Inert: `PageSecondaryNavigation` early-returns on `/therapy-compass*`, and
   // the mode's live destination list is `useTherapyNavItems` in
   // `src/components/therapy-compass/nav.tsx`, which feeds the shared `ModeNav`.
-  // Kept because this registry is a 13-mode contract, not because it renders.
+  // Kept because this registry is a 14-mode contract, not because it renders.
   // Editing these entries changes nothing a user sees.
   "therapy-compass": [
     { id: "search", label: "Search", action: "therapy-search" },
diff --git a/src/lib/rag/rag-candidate-sources.ts b/src/lib/rag/rag-candidate-sources.ts
index 3d5d04b294..2029e7e9ff 100644
--- a/src/lib/rag/rag-candidate-sources.ts
+++ b/src/lib/rag/rag-candidate-sources.ts
@@ -26,6 +26,14 @@ import {
 import { applyMemoryCardBoosts, fetchMemoryCardsForQuery } from "@/lib/deep-memory";
 import { env } from "@/lib/env";
 import { logger } from "@/lib/logger";
+import {
+  RetrievalRowShapeError,
+  assertEmbeddingFieldRows,
+  assertIndexUnitRows,
+  assertRetrievalRows,
+  type EmbeddingFieldSignalRow,
+  type IndexUnitSignalRow,
+} from "@/lib/rag/rag-row-contracts";
 import {
   firstVariantPoolIsStrong,
   maxTextRpcQueryVariants,
@@ -140,6 +148,12 @@ export function recordHybridRpcError(telemetry: SearchTelemetry | undefined, rpc
   }
 }
 
+/** Index-unit consumers read these provenance fields as maps; retain that output contract. */
+function optionalJsonRecord(value: unknown): Record<string, unknown> | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  return value as Record<string, unknown>;
+}
+
 /** Record how many variant RPCs a lexical surface actually issued (PT-02 early-exit). */
 function recordTextVariantFanout(
   telemetry: SearchTelemetry | undefined,
@@ -211,7 +225,9 @@ export async function searchTextChunkCandidates(args: {
     // most-terminal lexical layer surfaces in hybrid_rpc_errors telemetry
     // instead of silently degrading to zero candidates. Return value unchanged.
     if (error) recordHybridRpcError(args.telemetry, "match_document_chunks_text", error);
-    return error || !data?.length ? ([] as SearchResult[]) : (data as SearchResult[]);
+    if (error || !data?.length) return [] as SearchResult[];
+    assertRetrievalRows(data, "match_document_chunks_text");
+    return data;
   };
 
   const variants = args.queryVariants.slice(0, maxTextRpcQueryVariants);
@@ -338,14 +354,6 @@ export type ChunkSignalMatch = {
   indexUnit?: DocumentIndexUnitMatch | null;
 };
 
-type IndexUnitRpcRow = DocumentIndexUnitMatch & {
-  document_id: string;
-  source_chunk_id: string | null;
-  similarity?: number | null;
-  text_rank?: number | null;
-  hybrid_score?: number | null;
-};
-
 type TableFactRpcRow = {
   id: string;
   document_id: string;
@@ -1058,26 +1066,14 @@ export async function searchEmbeddingFieldCandidates(args: {
   );
   if (error) recordHybridRpcError(args.telemetry, "match_document_embedding_fields_hybrid", error);
   if (error || !data?.length) return [] as SearchResult[];
-  const matches = (
-    data as Array<{
-      source_chunk_id: string | null;
-      field_type: string | null;
-      similarity?: number | null;
-      text_rank?: number | null;
-      hybrid_score?: number | null;
-    }>
-  )
-    .filter(
-      (
-        row,
-      ): row is {
-        source_chunk_id: string;
-        field_type: string | null;
-        similarity?: number | null;
-        text_rank?: number | null;
-        hybrid_score?: number | null;
-      } => Boolean(row.source_chunk_id),
-    )
+  try {
+    assertEmbeddingFieldRows(data, "match_document_embedding_fields_hybrid");
+  } catch (error) {
+    if (!(error instanceof RetrievalRowShapeError)) throw error;
+    return [] as SearchResult[];
+  }
+  const matches = data
+    .filter((row): row is EmbeddingFieldSignalRow & { source_chunk_id: string } => Boolean(row.source_chunk_id))
     .map((row) => ({
       chunkId: row.source_chunk_id,
       similarity: Number(row.similarity ?? 0),
@@ -1125,8 +1121,14 @@ export async function searchIndexUnitCandidates(args: {
   );
   if (error) recordHybridRpcError(args.telemetry, "match_document_index_units_hybrid", error);
   if (error || !data?.length) return [] as SearchResult[];
-  const matches = (data as IndexUnitRpcRow[])
-    .filter((row): row is IndexUnitRpcRow & { source_chunk_id: string } => Boolean(row.source_chunk_id))
+  try {
+    assertIndexUnitRows(data, "match_document_index_units_hybrid");
+  } catch (error) {
+    if (!(error instanceof RetrievalRowShapeError)) throw error;
+    return [] as SearchResult[];
+  }
+  const matches = data
+    .filter((row): row is IndexUnitSignalRow & { source_chunk_id: string } => Boolean(row.source_chunk_id))
     .map((row) => ({
       chunkId: row.source_chunk_id,
       similarity: Number(row.similarity ?? 0),
@@ -1146,13 +1148,13 @@ export async function searchIndexUnitCandidates(args: {
         page_end: row.page_end,
         heading_path: row.heading_path ?? [],
         normalized_terms: row.normalized_terms ?? [],
-        source_span: row.source_span ?? null,
+        source_span: optionalJsonRecord(row.source_span),
         quality_score: row.quality_score,
         extraction_mode: row.extraction_mode,
         similarity: row.similarity,
         text_rank: row.text_rank,
         hybrid_score: row.hybrid_score,
-        metadata: row.metadata ?? null,
+        metadata: optionalJsonRecord(row.metadata),
       },
     }));
   return loadChunksForSignalMatches({
diff --git a/src/lib/rag/rag-row-contracts.ts b/src/lib/rag/rag-row-contracts.ts
new file mode 100644
index 0000000000..8b140732cf
--- /dev/null
+++ b/src/lib/rag/rag-row-contracts.ts
@@ -0,0 +1,201 @@
+import { z } from "zod";
+import { logger } from "@/lib/logger";
+import { normalizeOptionalSourceMetadata } from "@/lib/source-metadata";
+import type { SearchResult } from "@/lib/types";
+
+/**
+ * Runtime shape contract for a row returned by a retrieval RPC.
+ *
+ * Retrieval rows are untrusted external data, not a compile-time guarantee. The RPCs are
+ * versioned (`*_v2` with a legacy fallback) and the live database has been observed to
+ * drift from the migrations in this repo — `docs/outstanding-issues.md` `#316` records ten
+ * retrieval RPC bodies diverging, with weekly live-drift red since 2026-07-26. Before this
+ * contract existed, `rag.ts` asserted those rows straight into the ranking pipeline with a
+ * bare `as SearchResult[]`, so a renamed column or a numeric returned as a string did not
+ * fail — it misranked or mis-cited silently, which is the worst failure mode for a clinical
+ * reference surface.
+ *
+ * The schema is deliberately asymmetric:
+ *
+ * - **Strict on the ranking, citation, and evidence fields.** Every required field except
+ *   `source_metadata` is `not null` in `supabase/schema.sql`, so requiring it cannot reject a
+ *   row that works today. `source_metadata` is the exception: `documents.metadata` is bare
+ *   `jsonb`, which permits arrays and scalars, so pinning it to an object is guaranteed by the
+ *   data rather than by a constraint. Measured 2026-08-15, all 2851 live documents are
+ *   objects; a `check (jsonb_typeof(metadata) = 'object')` would make that structural.
+ *   The four score fields are `.nullish()` — absent or
+ *   null already flows through the downstream `?? 0` handling unchanged — but a *string where
+ *   a number belongs* is rejected, which is precisely the silent-misranking case this exists
+ *   to catch.
+ * - **Loose about everything else.** Column sets genuinely differ between RPC versions
+ *   (`retrieval_synopsis` is absent from the older base hybrid function; `document_labels`
+ *   and `document_summary` only appear on `match_document_chunks_v2`). `z.looseObject`
+ *   preserves unknown keys rather than stripping them, so a harmless schema difference
+ *   never becomes an outage or silent data loss.
+ */
+const retrievalImageSchema = z.looseObject({
+  id: z.string().min(1),
+  page_number: z.number().int().nullable(),
+  storage_path: z.string(),
+  caption: z.string(),
+});
+
+const retrievalRowSchema = z.looseObject({
+  id: z.string().min(1),
+  document_id: z.string().min(1),
+  title: z.string(),
+  file_name: z.string(),
+  page_number: z.number().int().nullable(),
+  chunk_index: z.number().int(),
+  section_heading: z.string().nullable(),
+  content: z.string(),
+  image_ids: z.array(z.string()),
+  source_metadata: z.record(z.string(), z.unknown()).nullable(),
+  images: z.array(retrievalImageSchema),
+  similarity: z.number().nullish(),
+  text_rank: z.number().nullish(),
+  hybrid_score: z.number().nullish(),
+  rrf_score: z.number().nullish(),
+});
+
+const retrievalRowsSchema = z.array(retrievalRowSchema);
+
+/** Cap on reported issues; a wholesale shape change would otherwise report one per row. */
+const MAX_REPORTED_ISSUES = 5;
+
+/**
+ * Thrown when a retrieval RPC returns rows that do not satisfy the ranking contract.
+ *
+ * The message carries only Zod issue paths and codes — never a row value. Retrieval rows
+ * contain clinical document text, so echoing one into a log or an error response would
+ * leak source content past the privacy boundary that `query-privacy.ts` maintains.
+ */
+export class RetrievalRowShapeError extends Error {
+  readonly rpc: string;
+  readonly issues: string[];
+
+  constructor(rpc: string, issues: string[]) {
+    super(`Retrieval RPC "${rpc}" returned rows that do not match the ranking contract: ${issues.join("; ")}`);
+    this.name = "RetrievalRowShapeError";
+    this.rpc = rpc;
+    this.issues = issues;
+  }
+}
+
+function describeIssues(error: z.ZodError): string[] {
+  const described = error.issues
+    .slice(0, MAX_REPORTED_ISSUES)
+    .map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`);
+  const remaining = error.issues.length - described.length;
+  return remaining > 0 ? [...described, `and ${remaining} more`] : described;
+}
+
+/**
+ * Validate retrieval RPC rows before they enter the ranking pipeline.
+ *
+ * This asserts rather than transforms: on success the caller keeps the original array and
+ * row objects, so object identity, key order, and nested `images` / `source_metadata`
+ * references are unchanged from what the RPC returned. That matters because ranking is a
+ * live-validated protected surface (`docs/rag-behaviour/`) — validation must be observable
+ * only when the data is already wrong.
+ *
+ * Logs before throwing so drift stays visible even where a caller degrades: the vector
+ * fallback in `rag.ts` catches retrieval failures and falls back to lexical results when it
+ * has them, which would otherwise swallow the signal entirely.
+ */
+export function assertRetrievalRows(rows: unknown, rpc: string): asserts rows is SearchResult[] {
+  assertRowsAgainst(retrievalRowsSchema, rows, rpc);
+}
+
+/** Shared validate-log-throw step. Kept separate so every row contract fails identically. */
+function assertRowsAgainst(schema: z.ZodType, rows: unknown, rpc: string): void {
+  const parsed = schema.safeParse(rows);
+  if (parsed.success) return;
+  const issues = describeIssues(parsed.error);
+  logger.error("retrieval_row_shape_mismatch", {
+    rpc,
+    issues,
+    rowCount: Array.isArray(rows) ? rows.length : null,
+  });
+  throw new RetrievalRowShapeError(rpc, issues);
+}
+
+/**
+ * Signal rows from `match_document_embedding_fields_hybrid` — not `SearchResult`s.
+ *
+ * These carry a chunk id plus scores; `loadChunksForSignalMatches` then loads the real chunk.
+ * A wrong `source_chunk_id` loads the wrong evidence, and the mapping coerces scores with
+ * `Number(row.similarity ?? 0)`, which turns a stringified score into a silently different
+ * number rather than an error. Both are validated here; `field_type` is only a provenance
+ * label, so it stays permissive.
+ */
+const embeddingFieldRowSchema = z.looseObject({
+  source_chunk_id: z.string().nullable(),
+  field_type: z.string().nullable(),
+  similarity: z.number().nullish(),
+  text_rank: z.number().nullish(),
+  hybrid_score: z.number().nullish(),
+});
+
+export type EmbeddingFieldSignalRow = z.infer<typeof embeddingFieldRowSchema>;
+
+/** Validate embedding-field signal rows before they select chunks and scores. */
+export function assertEmbeddingFieldRows(rows: unknown, rpc: string): asserts rows is EmbeddingFieldSignalRow[] {
+  assertRowsAgainst(z.array(embeddingFieldRowSchema), rows, rpc);
+}
+
+/**
+ * Index-unit rows from `match_document_index_units_hybrid`.
+ *
+ * The fields that select a chunk, control scoring, or label extraction are backed by
+ * constraints on `public.document_index_units` in `supabase/schema.sql`: `unit_type`, `title`,
+ * `content` and `extraction_mode` are `not null`, and both `unit_type` and `extraction_mode`
+ * carry `check` constraints — so the enum below cannot reject a row the database would accept.
+ * `source_span` and `metadata` are unconstrained `jsonb`, so they accept any JSON value rather
+ * than turning a non-object provenance value into a retrieval outage. `heading_path` and
+ * `normalized_terms` stay `.nullish()` to match the `?? []` handling the caller already applies.
+ */
+const indexUnitRowSchema = z.looseObject({
+  id: z.string().min(1),
+  document_id: z.string().min(1),
+  source_chunk_id: z.string().nullable(),
+  source_image_id: z.string().nullable(),
+  unit_type: z.string().min(1),
+  title: z.string(),
+  content: z.string(),
+  page_start: z.number().int().nullable(),
+  page_end: z.number().int().nullable(),
+  heading_path: z.array(z.string()).nullish(),
+  normalized_terms: z.array(z.string()).nullish(),
+  source_span: z.json().nullish(),
+  quality_score: z.number().nullable(),
+  extraction_mode: z.enum(["deterministic", "model_heavy", "hybrid"]),
+  metadata: z.json().nullish(),
+  similarity: z.number().nullish(),
+  text_rank: z.number().nullish(),
+  hybrid_score: z.number().nullish(),
+});
+
+export type IndexUnitSignalRow = z.infer<typeof indexUnitRowSchema>;
+
+/** Validate index-unit signal rows before they select chunks, scores, and unit provenance. */
+export function assertIndexUnitRows(rows: unknown, rpc: string): asserts rows is IndexUnitSignalRow[] {
+  assertRowsAgainst(z.array(indexUnitRowSchema), rows, rpc);
+}
+
+/** Build and validate the locally retrieved rows used as document-summary context. */
+export function buildDocumentSummaryResults(
+  chunks: unknown[],
+  document: { title: string; file_name: string; metadata?: unknown },
+): SearchResult[] {
+  const results = chunks.map((chunk) => ({
+    ...(chunk as object),
+    title: document.title,
+    file_name: document.file_name,
+    source_metadata: normalizeOptionalSourceMetadata(document.metadata),
+    similarity: 1,
+    images: [],
+  }));
+  assertRetrievalRows(results, "document_summary_context");
+  return results;
+}
diff --git a/src/lib/rag/rag.ts b/src/lib/rag/rag.ts
index e09f968c1f..564c66b06c 100644
--- a/src/lib/rag/rag.ts
+++ b/src/lib/rag/rag.ts
@@ -1,6 +1,7 @@
 import { createAdminClient } from "@/lib/supabase/admin";
 import { loadDocumentSummaryContext } from "@/lib/rag/rag-document-summary-context";
 import { generationFailureDetailToken } from "@/lib/rag/rag-generation-failure-diagnostics";
+import { assertRetrievalRows, buildDocumentSummaryResults } from "@/lib/rag/rag-row-contracts";
 import { answerInstructions } from "@/lib/rag/rag-answer-instructions";
 import { retrievalAccessScopeForArgs, retrievalRpcScopeArgs } from "@/lib/owner-scope";
 import {
@@ -2093,7 +2094,8 @@ export async function searchChunksWithTelemetry(
   // A1: the embedding-field, index-unit, and chunk-hybrid RPCs each depend only on the
   // already-computed query embedding and have no data dependency on one another, so run
   // them concurrently instead of as three sequential Supabase round-trips. The two helper
-  // functions swallow their own RPC errors and resolve to [], so Promise.all cannot reject.
+  // functions resolve their own RPC errors and logged row-shape mismatches to [], so Promise.all
+  // cannot reject when an optional signal layer drifts.
   throwIfAborted(args.signal);
   const parallelRpcStartedAt = Date.now();
   const [embeddingFieldResult, indexUnitResult, hybridResult] = await Promise.all([
@@ -2179,13 +2181,17 @@ export async function searchChunksWithTelemetry(
 
   const { data: hybridData, error: hybridError } = hybridResult;
   if (hybridError) recordHybridRpcError(telemetry, "match_document_chunks_hybrid", hybridError);
-  telemetry.vector_candidate_count = hybridData?.length ?? 0;
-  recordRetrievalLayer(telemetry, "hybrid_vector", hybridData?.length ?? 0, {
+  // On a hybrid RPC error `hybridData` is null, so this validates an empty array and the
+  // existing hybrid-error -> vector-fallback path below is reached unchanged.
+  const hybridRows = hybridData ?? [];
+  assertRetrievalRows(hybridRows, "match_document_chunks_hybrid");
+  telemetry.vector_candidate_count = hybridRows.length;
+  recordRetrievalLayer(telemetry, "hybrid_vector", hybridRows.length, {
     latencyMs: hybridResult.latencyMs,
-    topScore: layerTopScore((hybridData ?? []) as SearchResult[]),
+    topScore: layerTopScore(hybridRows),
   });
   const vectorCandidates = mergeSearchResults(
-    mergeSearchResults((hybridData ?? []) as SearchResult[], embeddingFieldCandidates),
+    mergeSearchResults(hybridRows, embeddingFieldCandidates),
     indexUnitCandidates,
   );
 
@@ -2257,7 +2263,9 @@ export async function searchChunksWithTelemetry(
       );
 
       if (error) throw new Error(error.message);
-      return (data ?? []) as SearchResult[];
+      const rows = data ?? [];
+      assertRetrievalRows(rows, "match_document_chunks");
+      return rows;
     }),
   ).catch((error) => {
     if (!args.forceEmbedding && textFastResults.length > 0) return [] as SearchResult[][];
@@ -4304,15 +4312,7 @@ export async function summarizeDocument(documentId: string, ownerId?: string, op
     } satisfies RagAnswer;
   }
 
-  const documentMetadata = (document as { metadata?: unknown }).metadata;
-  const results = committedChunks.map((chunk) => ({
-    ...chunk,
-    title: document.title,
-    file_name: document.file_name,
-    source_metadata: normalizeOptionalSourceMetadata(documentMetadata),
-    similarity: 1,
-    images: [],
-  })) as SearchResult[];
+  const results = buildDocumentSummaryResults(committedChunks, document);
 
   const summaryInstructions = `Summarize a clinical document for practical psychiatric use in Perth, Australia.
 Use only the excerpts provided. Use a layered response: make the answer field a plain high-yield clinical paragraph,
diff --git a/src/lib/search-command-surface.ts b/src/lib/search-command-surface.ts
index 7c5c690981..506782033a 100644
--- a/src/lib/search-command-surface.ts
+++ b/src/lib/search-command-surface.ts
@@ -9,6 +9,8 @@ export type SearchCommandSurfaceConfig = {
   examples: string[];
   suggestions: CommandSuggestion[];
   crossModes: AppModeId[];
+  /** Defaults to true. Set false when a mode's search contract is entirely local. */
+  remoteSearchEnabled?: boolean;
 };
 
 export type CommandSurfacePlacement = "bottom-dock" | "inline";
@@ -141,12 +143,27 @@ const searchCommandSurfaceByMode: Partial<Record<AppModeId, SearchCommandSurface
     ],
     crossModes: ["documents", "prescribing", "forms", "favourites"],
   },
+  calculators: {
+    examples: ["depression severity", "anxiety screening", "alcohol use"],
+    suggestions: [
+      { text: "depression severity", meta: "PHQ-9" },
+      { text: "anxiety screening", meta: "GAD-7" },
+      { text: "alcohol use", meta: "AUDIT-C" },
+    ],
+    crossModes: ["documents", "forms", "tools"],
+    remoteSearchEnabled: false,
+  },
 };
 
 export function searchCommandSurfaceConfig(modeId: AppModeId): SearchCommandSurfaceConfig | null {
   return searchCommandSurfaceByMode[modeId] ?? null;
 }
 
+export function commandSurfaceRemoteSearchEnabled(modeId: AppModeId) {
+  const config = searchCommandSurfaceConfig(modeId);
+  return Boolean(config && config.remoteSearchEnabled !== false);
+}
+
 export const differentialRedFlagTerms = ["confusion", "overdose", "suicid", "chest pain", "unresponsive", "catatoni"];
 
 export function isFormCodeQuery(query: string) {
diff --git a/src/lib/search-route-ownership.ts b/src/lib/search-route-ownership.ts
index 08e77fcbaa..f5a69c5e39 100644
--- a/src/lib/search-route-ownership.ts
+++ b/src/lib/search-route-ownership.ts
@@ -16,6 +16,7 @@ const routeOwnedSubmittedSearchModes = new Set<AppModeId>([
   "therapy-compass",
   "factsheets",
   "tools",
+  "calculators",
 ]);
 
 /**
@@ -34,6 +35,7 @@ const standaloneModeHomePaths = new Set<string>([
   "/factsheets",
   "/therapy-compass",
   "/tools",
+  "/calculators",
   // Documents and Medication gained real homes when `/` became the single shared
   // home for every mode. Like the others they own an in-flow hero composer.
   "/documents",
diff --git a/src/lib/search-shell-props.ts b/src/lib/search-shell-props.ts
index 08b29bf501..7c2d162546 100644
--- a/src/lib/search-shell-props.ts
+++ b/src/lib/search-shell-props.ts
@@ -4,6 +4,7 @@ export type SearchShellPathProps = {
   initialMode: AppModeId;
   availableModeIds?: AppModeId[];
   desktopSearchPlacement?: "default" | "hero";
+  mobileHomeComposerPlacement?: "hero" | "footer";
   searchComposerVisible?: boolean;
   mobileChromeVisible?: boolean;
 };
@@ -67,12 +68,15 @@ export function searchShellPropsForPathname(pathname: string): SearchShellPathPr
   }
 
   if (pathname.startsWith("/tools")) {
-    return { initialMode: "tools", desktopSearchPlacement: "hero" };
+    return {
+      initialMode: "tools",
+      desktopSearchPlacement: "hero",
+      mobileHomeComposerPlacement: "footer",
+    };
   }
 
-  // Calculators owns its search composer (desktop top + phone bottom dock).
   if (pathname.startsWith("/calculators")) {
-    return { initialMode: "tools", searchComposerVisible: false };
+    return { initialMode: "calculators", desktopSearchPlacement: "hero" };
   }
 
   if (pathname.startsWith("/therapy-compass")) {
diff --git a/src/lib/service-core-groups.ts b/src/lib/service-core-groups.ts
index 9827c160d3..7adf8ea7ff 100644
--- a/src/lib/service-core-groups.ts
+++ b/src/lib/service-core-groups.ts
@@ -8,6 +8,7 @@ export const serviceCoreGroups = [
 ] as const;
 
 export type ServiceCoreGroupId = (typeof serviceCoreGroups)[number]["id"];
+export type ServiceCoreGroupSelection = ReadonlySet<ServiceCoreGroupId>;
 
 const urgentPattern = /\b(?:acute|crisis|emergenc\w*|urgent|suicide|after[- ]?hours|triage)\b/i;
 const publicPattern =
@@ -38,6 +39,28 @@ export function readServiceCoreGroup(value: string | null | undefined): ServiceC
   return serviceCoreGroups.some((group) => group.id === value) ? (value as ServiceCoreGroupId) : null;
 }
 
+/**
+ * Service categories overlap, so the filter sheet treats them as an OR-within
+ * facet rather than a one-of-N lens. Comma-separated values keep legacy
+ * `?group=urgent` links valid while allowing honest multi-selection.
+ */
+export function readServiceCoreGroupSelection(value: string | null | undefined): ServiceCoreGroupSelection {
+  const groups = (value ?? "")
+    .split(",")
+    .map((candidate) => readServiceCoreGroup(candidate.trim()))
+    .filter((candidate): candidate is ServiceCoreGroupId => candidate !== null);
+  return new Set(groups);
+}
+
+export function writeServiceCoreGroupSelectionToParams(
+  params: URLSearchParams,
+  selection: ServiceCoreGroupSelection,
+): void {
+  const ordered = serviceCoreGroups.map((group) => group.id).filter((group) => selection.has(group));
+  if (ordered.length > 0) params.set("group", ordered.join(","));
+  else params.delete("group");
+}
+
 export function serviceCoreGroupIds(service: ServiceRecord): ServiceCoreGroupId[] {
   const fields = serviceGroupFields(service);
   const groups: ServiceCoreGroupId[] = [];
@@ -52,6 +75,14 @@ export function serviceMatchesCoreGroup(service: ServiceRecord, group: ServiceCo
   return group === null || serviceCoreGroupIds(service).includes(group);
 }
 
+export function serviceMatchesCoreGroupSelection(
+  service: ServiceRecord,
+  selection: ServiceCoreGroupSelection,
+): boolean {
+  if (selection.size === 0) return true;
+  return serviceCoreGroupIds(service).some((group) => selection.has(group));
+}
+
 export function serviceCoreGroupLabel(group: ServiceCoreGroupId | null) {
   if (group === null) return "All services";
   return serviceCoreGroups.find((item) => item.id === group)?.label ?? "All services";
diff --git a/src/lib/ui-copy.ts b/src/lib/ui-copy.ts
index 2d26a6abc2..fec7bfe772 100644
--- a/src/lib/ui-copy.ts
+++ b/src/lib/ui-copy.ts
@@ -52,6 +52,9 @@ export const sharedHomePresentation = {
   tools: {
     title: "Clinical Tools",
   },
+  calculators: {
+    title: "Clinical Calculators",
+  },
   "therapy-compass": {
     title: "Therapy Compass",
   },
diff --git a/src/lib/universal-search-mode-context.ts b/src/lib/universal-search-mode-context.ts
index f921eb953b..d90dcbe2ba 100644
--- a/src/lib/universal-search-mode-context.ts
+++ b/src/lib/universal-search-mode-context.ts
@@ -13,6 +13,9 @@ const preferredDomainsByMode: Record<AppModeId, readonly UniversalSearchDomain[]
   formulation: ["formulation"],
   prescribing: ["medications", "documents"],
   tools: ["tools"],
+  // Calculators searches its local, session-aware catalogue rather than the
+  // cross-entity index, so it has no universal-search domain preference.
+  calculators: [],
   // Therapy Compass leads with its own therapy library, exposed to cross-entity
   // search as the "therapies" domain.
   "therapy-compass": ["therapies"],
diff --git a/src/lib/universal-search-stream.ts b/src/lib/universal-search-stream.ts
index c3ba49156a..33af25025f 100644
--- a/src/lib/universal-search-stream.ts
+++ b/src/lib/universal-search-stream.ts
@@ -7,7 +7,8 @@ export type UniversalSearchStreamResponse = UniversalSearchResponse & {
 
 export type UniversalSearchStreamEvent =
   | { type: "group"; query: string; group: UniversalSearchGroup }
-  | { type: "complete"; response: UniversalSearchStreamResponse };
+  | { type: "complete"; response: UniversalSearchStreamResponse }
+  | { type: "error"; code: "universal_search_failed" };
 
 function abortReason(signal: AbortSignal): Error {
   return signal.reason instanceof Error ? signal.reason : new DOMException("The operation was aborted.", "AbortError");
@@ -25,6 +26,9 @@ function parseEvent(line: string): UniversalSearchStreamEvent {
   if (parsed.type === "complete" && parsed.response) {
     return parsed as Extract<UniversalSearchStreamEvent, { type: "complete" }>;
   }
+  if (parsed.type === "error" && parsed.code === "universal_search_failed") {
+    return parsed as Extract<UniversalSearchStreamEvent, { type: "error" }>;
+  }
   throw new Error("Invalid universal-search NDJSON event.");
 }
 
@@ -52,7 +56,12 @@ export async function consumeUniversalSearchNdjson(
     if (!line.trim()) return;
     const event = parseEvent(line);
     if (event.type === "group") await options.onGroup?.(event.group, event.query);
-    else complete = event.response;
+    else if (event.type === "complete") complete = event.response;
+    else {
+      const error = new Error("Universal search failed.");
+      void reader.cancel(error).catch(() => undefined);
+      throw error;
+    }
   };
 
   try {
diff --git a/tests/answer-activity-trace-css.test.ts b/tests/answer-activity-trace-css.test.ts
index 4676b2d6bf..a64f704996 100644
--- a/tests/answer-activity-trace-css.test.ts
+++ b/tests/answer-activity-trace-css.test.ts
@@ -3,6 +3,10 @@ import { readFileSync } from "node:fs";
 import { describe, expect, it } from "vitest";
 
 const globalsCss = readFileSync(new URL("../src/app/globals.css", import.meta.url), "utf8");
+const answerStatusSource = readFileSync(
+  new URL("../src/components/clinical-dashboard/answer-status.tsx", import.meta.url),
+  "utf8",
+);
 
 function keyframes(name: string) {
   const start = globalsCss.indexOf(`@keyframes ${name}`);
@@ -24,11 +28,21 @@ function keyframes(name: string) {
 }
 
 describe("answer activity trace CSS", () => {
-  it("cycles through the positive dash-offset equivalent for WebKit", () => {
-    const sweep = keyframes("answer-ecg-sweep");
+  it("does not paint-contain the animated SVG on WebKit", () => {
+    expect(globalsCss).not.toMatch(/\.answer-activity-trace\s*{[^}]*contain:\s*paint;/s);
+  });
+
+  it("pulses with opacity instead of WebKit-unreliable SVG dash offsets", () => {
+    const pulse = keyframes("answer-ecg-pulse");
+
+    expect(pulse).toMatch(/opacity:\s*0\.2;/);
+    expect(pulse).toMatch(/opacity:\s*1;/);
+    expect(pulse).not.toMatch(/stroke-dashoffset/);
+  });
 
-    expect(sweep).toMatch(/from\s*{\s*stroke-dashoffset:\s*320;/);
-    expect(sweep).toMatch(/to\s*{\s*stroke-dashoffset:\s*0;/);
-    expect(sweep).not.toMatch(/stroke-dashoffset:\s*-/);
+  it("hosts the animation on a regular HTML compositor layer instead of an SVG path", () => {
+    expect(answerStatusSource).toMatch(/<span[^>]*data-slot="answer-activity-trace-sweep"/s);
+    expect(answerStatusSource).not.toMatch(/<path[^>]*data-slot="answer-activity-trace-sweep"/s);
+    expect(globalsCss).toMatch(/\.answer-activity-trace__sweep\s*{[^}]*will-change:\s*opacity;/s);
   });
 });
diff --git a/tests/answer-evidence-preview.dom.test.tsx b/tests/answer-evidence-preview.dom.test.tsx
new file mode 100644
index 0000000000..197eee929a
--- /dev/null
+++ b/tests/answer-evidence-preview.dom.test.tsx
@@ -0,0 +1,49 @@
+import { render, screen, within } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { AnswerEvidencePreview } from "@/components/clinical-dashboard/answer-evidence-preview";
+import { incrementalEvidencePreviewRenderingEnabled } from "@/lib/client-env";
+import type { VerifiedEvidencePreviewUnit } from "@/lib/answer-stream-contract";
+
+function evidencePreview(sourceCount = 4): VerifiedEvidencePreviewUnit {
+  return {
+    schemaVersion: 1,
+    kind: "evidence_preview",
+    sequence: 0,
+    selectedContextCount: sourceCount,
+    sources: Array.from({ length: sourceCount }, (_, index) => ({
+      id: `chunk-${index + 1}`,
+      document_id: `doc-${index + 1}`,
+      title: `Clinical guideline ${index + 1}`,
+      file_name: `guideline-${index + 1}.pdf`,
+      page_number: index + 2,
+      chunk_index: index,
+      section_heading: "Monitoring",
+      content: "Review the source passage and confirm the monitoring schedule before clinical use.",
+      image_ids: [],
+      similarity: 0.8,
+      images: [],
+    })),
+  };
+}
+
+describe("incremental answer evidence preview", () => {
+  it("keeps its client render flag off unless explicitly enabled", () => {
+    expect(incrementalEvidencePreviewRenderingEnabled(undefined)).toBe(false);
+    expect(incrementalEvidencePreviewRenderingEnabled("false")).toBe(false);
+    expect(incrementalEvidencePreviewRenderingEnabled("true")).toBe(true);
+  });
+
+  it("renders a bounded, non-live evidence region without presenting a completed answer", () => {
+    render(<AnswerEvidencePreview preview={evidencePreview()} />);
+
+    const region = screen.getByTestId("answer-evidence-preview");
+    expect(
+      within(region).getByRole("heading", { name: "Selected evidence — answer still being verified" }),
+    ).toBeTruthy();
+    expect(within(region).getByText(/4 source passages selected/i)).toBeTruthy();
+    expect(within(region).getAllByRole("link")).toHaveLength(3);
+    expect(region).not.toHaveAttribute("aria-live");
+    expect(within(region).queryByText(/answer ready/i)).toBeNull();
+  });
+});
diff --git a/tests/answer-progress-ui-smoke.spec.ts b/tests/answer-progress-ui-smoke.spec.ts
index 01b7121bf5..12e4accf9d 100644
--- a/tests/answer-progress-ui-smoke.spec.ts
+++ b/tests/answer-progress-ui-smoke.spec.ts
@@ -42,6 +42,15 @@ async function fillHydratedAnswerQuestion(page: Page, value: string) {
   return submit;
 }
 
+async function dismissBlockingPwaNotice(page: Page) {
+  const dismiss = page.getByRole("button", { name: /Dismiss (?:offline notice|update notice|install)/ }).first();
+  const noticeAppeared = await dismiss
+    .waitFor({ state: "visible", timeout: 2_000 })
+    .then(() => true)
+    .catch(() => false);
+  if (noticeAppeared) await dismiss.click();
+}
+
 async function mockDashboardApis(page: Page) {
   await page.route("**/*", async (route) => {
     const url = new URL(route.request().url());
@@ -435,6 +444,7 @@ test("follow-up answer generation stays compact above the previous answer", asyn
   await mockDashboardApis(page);
   await installSuccessfulThenHoldingAnswerStreams(page);
   await page.goto("/?mode=answer", { waitUntil: "domcontentloaded" });
+  await dismissBlockingPwaNotice(page);
 
   const submit = await fillHydratedAnswerQuestion(page, "Lithium dosing");
   await submit.click();
@@ -466,7 +476,7 @@ test("follow-up answer generation stays compact above the previous answer", asyn
         timingFunction: style.animationTimingFunction,
       };
     }),
-  ).toEqual({ duration: "1.6s", iterationCount: "infinite", timingFunction: "linear" });
+  ).toEqual({ duration: "1.6s", iterationCount: "infinite", timingFunction: "ease-in-out" });
   const stop = progress.getByRole("button", { name: "Stop generating answer" });
   expect((await stop.boundingBox())?.height ?? 0).toBeGreaterThanOrEqual(48);
 
@@ -528,6 +538,7 @@ test("answer progress keeps focus, reduced-motion, and forced-colour behavior in
   await mockDashboardApis(page);
   await installHoldingAnswerStream(page);
   await page.goto("/?mode=answer", { waitUntil: "domcontentloaded" });
+  await dismissBlockingPwaNotice(page);
 
   const submit = await fillHydratedAnswerQuestion(page, "Lithium dosing");
   await submit.click();
@@ -566,11 +577,28 @@ test("answer progress keeps focus, reduced-motion, and forced-colour behavior in
       };
     }),
   ).toEqual({
-    name: "answer-ecg-sweep",
+    name: "answer-ecg-pulse",
     duration: "1.8s",
     iterationCount: "infinite",
-    timingFunction: "linear",
+    timingFunction: "ease-in-out",
+  });
+  const restingOpacity = await activityTraceSweep.evaluate(async (trace) => {
+    const animation = trace.getAnimations()[0];
+    animation.pause();
+    animation.currentTime = 0;
+    await new Promise(requestAnimationFrame);
+    return getComputedStyle(trace).opacity;
+  });
+  const restingPixels = await activityTraceSweep.screenshot();
+  const peakOpacity = await activityTraceSweep.evaluate(async (trace) => {
+    const animation = trace.getAnimations()[0];
+    animation.currentTime = 900;
+    await new Promise(requestAnimationFrame);
+    return getComputedStyle(trace).opacity;
   });
+  const peakPixels = await activityTraceSweep.screenshot();
+  expect({ restingOpacity, peakOpacity }).toEqual({ restingOpacity: "0.2", peakOpacity: "1" });
+  expect(restingPixels.equals(peakPixels), "the WebKit raster must visibly change across the pulse").toBe(false);
 
   await page.emulateMedia({ reducedMotion: "reduce", forcedColors: "active" });
   await expect(currentStage.locator('[data-slot="answer-progress-stage-marker"]')).toBeVisible();
diff --git a/tests/answer-progress.test.ts b/tests/answer-progress.test.ts
index a4e2646945..bec5014a8c 100644
--- a/tests/answer-progress.test.ts
+++ b/tests/answer-progress.test.ts
@@ -5,7 +5,33 @@ import {
   normalizeAnswerProgressEvent,
 } from "../src/components/clinical-dashboard/answer-progress";
 import { toPublicAnswerProgressEvent } from "../src/lib/answer-progress-public";
-import { readAnswerStream } from "../src/components/clinical-dashboard/search-utils";
+import {
+  evidencePreviewReconcilesWithFinal,
+  readAnswerStream,
+} from "../src/components/clinical-dashboard/search-utils";
+import type { VerifiedEvidencePreviewUnit } from "../src/lib/answer-stream-contract";
+
+const previewSource = {
+  id: "chunk-1",
+  document_id: "doc-1",
+  title: "Clozapine Monitoring",
+  file_name: "clozapine.pdf",
+  page_number: 3,
+  chunk_index: 1,
+  section_heading: "Monitoring",
+  content: "ANC thresholds and FBC monitoring schedule for clozapine.",
+  image_ids: [],
+  similarity: 0.82,
+  images: [],
+};
+
+const evidencePreview: VerifiedEvidencePreviewUnit = {
+  schemaVersion: 1,
+  kind: "evidence_preview",
+  sequence: 0,
+  sources: [previewSource],
+  selectedContextCount: 1,
+};
 
 describe("answer progress events", () => {
   it("keeps only safe, normalized Australian source counts at the public boundary", () => {
@@ -108,16 +134,23 @@ describe("answer progress events", () => {
     ).toMatchObject({ resultCount: 2, selectedContextCount: undefined });
   });
 
-  it("shares one SSE parser across answer surfaces and commits completion only with a valid final answer", async () => {
+  it("parses only allowlisted SSE events and clears a verified preview when final becomes authoritative", async () => {
     const progress: string[] = [];
     const tokens: string[] = [];
+    const previews: Array<VerifiedEvidencePreviewUnit | null> = [];
     let revisions = 0;
     const body = [
-      'event: progress\ndata: {"stage":"retrieving","message":"private"}',
+      `event: progress\ndata: ${JSON.stringify({ stage: "ranking", message: "private", verifiedUnit: evidencePreview })}`,
       'event: token\ndata: {"delta":"Draft"}',
       "event: revising\ndata: {}",
       'event: progress\ndata: {"stage":"complete","message":"private","elapsedMs":1200}',
-      'event: final\ndata: {"answer":"Grounded answer.","grounded":true,"confidence":"medium","citations":[],"sources":[]}',
+      `event: final\ndata: ${JSON.stringify({
+        answer: "Grounded answer.",
+        grounded: true,
+        confidence: "medium",
+        citations: [],
+        sources: [previewSource],
+      })}`,
       "",
     ].join("\n\n");
 
@@ -128,14 +161,178 @@ describe("answer progress events", () => {
       () => {
         revisions += 1;
       },
+      undefined,
+      (preview) => previews.push(preview),
     );
 
-    expect(progress).toEqual(["retrieving", "complete"]);
-    expect(tokens).toEqual(["Draft"]);
-    expect(revisions).toBe(1);
+    expect(progress).toEqual(["ranking", "complete"]);
+    expect(tokens).toEqual([]);
+    expect(revisions).toBe(0);
+    expect(previews).toEqual([evidencePreview, null]);
     expect(answer.answer).toBe("Grounded answer.");
   });
 
+  it("drops invalid, duplicate, and out-of-order verified units", async () => {
+    const previews: Array<VerifiedEvidencePreviewUnit | null> = [];
+    const previewByStage: Array<[string, VerifiedEvidencePreviewUnit | null]> = [];
+    let visiblePreview: VerifiedEvidencePreviewUnit | null = null;
+    const body = [
+      `event: progress\ndata: ${JSON.stringify({ stage: "ranking", message: "private", verifiedUnit: evidencePreview })}`,
+      `event: progress\ndata: ${JSON.stringify({ stage: "generating", message: "private", verifiedUnit: evidencePreview })}`,
+      `event: progress\ndata: ${JSON.stringify({
+        stage: "verifying",
+        message: "private",
+        verifiedUnit: { ...evidencePreview, schemaVersion: 2 },
+      })}`,
+      `event: final\ndata: ${JSON.stringify({
+        answer: "Grounded answer.",
+        grounded: true,
+        confidence: "medium",
+        citations: [],
+        sources: [previewSource],
+      })}`,
+      "",
+    ].join("\n\n");
+
+    await readAnswerStream(
+      new Response(body, { headers: { "Content-Type": "text/event-stream" } }),
+      (progress) => previewByStage.push([progress.stage, visiblePreview]),
+      undefined,
+      undefined,
+      undefined,
+      (preview) => {
+        visiblePreview = preview;
+        previews.push(preview);
+      },
+    );
+
+    expect(previews).toEqual([evidencePreview, null]);
+    expect(previewByStage).toContainEqual(["ranking", evidencePreview]);
+    expect(previewByStage).toContainEqual(["generating", null]);
+    expect(previewByStage).toContainEqual(["verifying", null]);
+  });
+
+  it("discards a preview on stream error and starts sequence validation fresh for a retry", async () => {
+    const firstAttemptPreviews: Array<VerifiedEvidencePreviewUnit | null> = [];
+    const failedBody = [
+      `event: progress\ndata: ${JSON.stringify({ stage: "ranking", message: "private", verifiedUnit: evidencePreview })}`,
+      'event: error\ndata: {"error":"provider unavailable","status":503}',
+      "",
+    ].join("\n\n");
+
+    await expect(
+      readAnswerStream(
+        new Response(failedBody, { headers: { "Content-Type": "text/event-stream" } }),
+        () => undefined,
+        undefined,
+        undefined,
+        undefined,
+        (preview) => firstAttemptPreviews.push(preview),
+      ),
+    ).rejects.toThrow("provider unavailable");
+    expect(firstAttemptPreviews).toEqual([evidencePreview, null]);
+
+    const retryPreviews: Array<VerifiedEvidencePreviewUnit | null> = [];
+    const retryBody = [
+      `event: progress\ndata: ${JSON.stringify({ stage: "ranking", message: "private", verifiedUnit: evidencePreview })}`,
+      `event: final\ndata: ${JSON.stringify({
+        answer: "Retry succeeded.",
+        grounded: true,
+        confidence: "medium",
+        citations: [],
+        sources: [previewSource],
+      })}`,
+      "",
+    ].join("\n\n");
+    await readAnswerStream(
+      new Response(retryBody, { headers: { "Content-Type": "text/event-stream" } }),
+      () => undefined,
+      undefined,
+      undefined,
+      undefined,
+      (preview) => retryPreviews.push(preview),
+    );
+    expect(retryPreviews).toEqual([evidencePreview, null]);
+  });
+
+  it("discards a preview when the response stream is cancelled", async () => {
+    const previews: Array<VerifiedEvidencePreviewUnit | null> = [];
+    const encoder = new TextEncoder();
+    let previewDelivered = false;
+    const body = new ReadableStream<Uint8Array>({
+      pull(controller) {
+        if (!previewDelivered) {
+          previewDelivered = true;
+          controller.enqueue(
+            encoder.encode(
+              `event: progress\ndata: ${JSON.stringify({ stage: "ranking", message: "private", verifiedUnit: evidencePreview })}\n\n`,
+            ),
+          );
+          return;
+        }
+        controller.error(new DOMException("Cancelled", "AbortError"));
+      },
+    });
+
+    await expect(
+      readAnswerStream(
+        new Response(body, { headers: { "Content-Type": "text/event-stream" } }),
+        () => undefined,
+        undefined,
+        undefined,
+        undefined,
+        (preview) => previews.push(preview),
+      ),
+    ).rejects.toMatchObject({ name: "AbortError" });
+    expect(previews).toEqual([evidencePreview, null]);
+  });
+
+  it("requires byte-identical preview sources to reconcile with final", () => {
+    const finalPayload = {
+      answer: "Grounded answer.",
+      grounded: true,
+      confidence: "medium" as const,
+      citations: [],
+      sources: [previewSource],
+    };
+
+    expect(evidencePreviewReconcilesWithFinal(evidencePreview, finalPayload)).toBe(true);
+    expect(
+      evidencePreviewReconcilesWithFinal(
+        { ...evidencePreview, sources: [{ ...previewSource, content: "Changed source text." }] },
+        finalPayload,
+      ),
+    ).toBe(false);
+  });
+
+  it("discards a mismatched preview while retaining the authoritative final payload", async () => {
+    const previews: Array<VerifiedEvidencePreviewUnit | null> = [];
+    const authoritativeSource = { ...previewSource, content: "Authoritative final source text." };
+    const body = [
+      `event: progress\ndata: ${JSON.stringify({ stage: "ranking", message: "private", verifiedUnit: evidencePreview })}`,
+      `event: final\ndata: ${JSON.stringify({
+        answer: "Authoritative final answer.",
+        grounded: true,
+        confidence: "medium",
+        citations: [],
+        sources: [authoritativeSource],
+      })}`,
+      "",
+    ].join("\n\n");
+
+    const finalPayload = await readAnswerStream(
+      new Response(body, { headers: { "Content-Type": "text/event-stream" } }),
+      () => undefined,
+      undefined,
+      undefined,
+      undefined,
+      (preview) => previews.push(preview),
+    );
+
+    expect(previews).toEqual([evidencePreview, null]);
+    expect(finalPayload.sources).toEqual([authoritativeSource]);
+  });
+
   it("fails closed when a shared answer stream ends without a valid final payload", async () => {
     const response = new Response('event: progress\ndata: {"stage":"complete","message":"private"}\n\n');
 
diff --git a/tests/answer-request.test.ts b/tests/answer-request.test.ts
new file mode 100644
index 0000000000..e2c9bc2dcd
--- /dev/null
+++ b/tests/answer-request.test.ts
@@ -0,0 +1,104 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { requestAnswerStream } from "../src/components/clinical-dashboard/answer-request";
+import type { VerifiedEvidencePreviewUnit } from "../src/lib/answer-stream-contract";
+
+const previewSource = {
+  id: "chunk-1",
+  document_id: "doc-1",
+  title: "Clozapine Monitoring",
+  file_name: "clozapine.pdf",
+  page_number: 3,
+  chunk_index: 1,
+  section_heading: "Monitoring",
+  content: "ANC thresholds and FBC monitoring schedule for clozapine.",
+  image_ids: [],
+  similarity: 0.82,
+  images: [],
+};
+
+const evidencePreview: VerifiedEvidencePreviewUnit = {
+  schemaVersion: 1,
+  kind: "evidence_preview",
+  sequence: 0,
+  sources: [previewSource],
+  selectedContextCount: 1,
+};
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+  vi.restoreAllMocks();
+});
+
+describe("requestAnswerStream", () => {
+  it("preserves the authenticated request body and forwards only verified preview events", async () => {
+    const streamBody = [
+      `event: progress\ndata: ${JSON.stringify({ stage: "ranking", message: "private", verifiedUnit: evidencePreview })}`,
+      `event: final\ndata: ${JSON.stringify({
+        answer: "Grounded answer.",
+        grounded: true,
+        confidence: "medium",
+        citations: [],
+        sources: [previewSource],
+      })}`,
+      "",
+    ].join("\n\n");
+    const fetchMock = vi.fn(async () => new Response(streamBody, { headers: { "Content-Type": "text/event-stream" } }));
+    vi.stubGlobal("fetch", fetchMock);
+    const previews: Array<VerifiedEvidencePreviewUnit | null> = [];
+
+    const result = await requestAnswerStream({
+      queryText: "clozapine monitoring",
+      filters: { medications: ["clozapine"] },
+      queryMode: "auto",
+      selectedDocumentIds: ["doc-1"],
+      clientDemoMode: false,
+      authorizationHeader: { authorization: "Bearer test-token" },
+      onProgress: () => undefined,
+      onEvidencePreview: (preview) => previews.push(preview),
+      timedOut: () => false,
+      onSessionExpired: vi.fn(),
+      networkFailure: () => new Error("network failure"),
+    });
+
+    const [input, init] = fetchMock.mock.calls[0] as unknown as [RequestInfo | URL, RequestInit];
+    expect(input).toBe("/api/answer/stream");
+    expect(init.headers).toEqual({
+      "Content-Type": "application/json",
+      authorization: "Bearer test-token",
+    });
+    expect(JSON.parse(String(init.body))).toEqual({
+      query: "clozapine monitoring",
+      documentIds: ["doc-1"],
+      filters: { medications: ["clozapine"] },
+      queryMode: "auto",
+    });
+    expect(previews).toEqual([evidencePreview, null]);
+    expect(result).toMatchObject({ kind: "answer", query: "clozapine monitoring" });
+    expect(result.payload.answer).toBe("Grounded answer.");
+  });
+
+  it("expires the client session before surfacing a 401 answer response", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => new Response(null, { status: 401 })),
+    );
+    const onSessionExpired = vi.fn();
+
+    await expect(
+      requestAnswerStream({
+        queryText: "clozapine monitoring",
+        filters: {},
+        queryMode: "auto",
+        selectedDocumentIds: [],
+        clientDemoMode: true,
+        authorizationHeader: {},
+        onProgress: () => undefined,
+        onEvidencePreview: () => undefined,
+        timedOut: () => false,
+        onSessionExpired,
+        networkFailure: () => new Error("network failure"),
+      }),
+    ).rejects.toMatchObject({ status: 401, retryable: false });
+    expect(onSessionExpired).toHaveBeenCalledOnce();
+  });
+});
diff --git a/tests/api-list-response.test.ts b/tests/api-list-response.test.ts
new file mode 100644
index 0000000000..8c237dd049
--- /dev/null
+++ b/tests/api-list-response.test.ts
@@ -0,0 +1,18 @@
+import { describe, expect, it } from "vitest";
+import { z } from "zod";
+import { parseListRows } from "../src/lib/api-list-response";
+
+const rowSchema = z.object({ id: z.string() });
+
+describe("parseListRows", () => {
+  it.each([
+    { label: "null", data: null },
+    { label: "undefined", data: undefined },
+  ])("rejects $label list payloads instead of coercing them to an empty array", ({ data }) => {
+    expect(() => parseListRows(data, rowSchema)).toThrow("Invalid list data.");
+  });
+
+  it("accepts an explicitly empty list", () => {
+    expect(parseListRows([], rowSchema)).toEqual([]);
+  });
+});
diff --git a/tests/api-validation-contract.test.ts b/tests/api-validation-contract.test.ts
index 54ae24b100..b1c8032ed2 100644
--- a/tests/api-validation-contract.test.ts
+++ b/tests/api-validation-contract.test.ts
@@ -332,6 +332,42 @@ describe("API validation contracts", () => {
     expect(client.calls[0].range).toEqual({ from: 10_000, to: 10_049 });
   });
 
+  it.each([
+    {
+      table: "documents",
+      malformedRow: { id: { sensitive: "patient-secret" }, owner_id: userId, status: "indexed" },
+    },
+    {
+      table: "document_labels",
+      malformedRow: { document_id: { sensitive: "patient-secret" }, label: "Clinical" },
+    },
+    {
+      table: "document_summaries",
+      malformedRow: { document_id: { sensitive: "patient-secret" }, summary: "Private summary" },
+    },
+  ])("rejects and redacts malformed $table rows from the document list", async ({ table, malformedRow }) => {
+    const client = createSupabaseMock((call) => {
+      if (call.table === table) return ok([malformedRow]);
+      if (call.table === "documents") {
+        return ok([{ id: documentId, owner_id: userId, status: "indexed", title: "Guideline" }], 1);
+      }
+      return ok([]);
+    });
+    mockRuntime(client);
+    const { GET } = await import("../src/app/api/documents/route");
+
+    const response = await GET(authenticatedRequest("/api/documents"));
+    const body = await payload(response);
+
+    expect(response.status).toBe(500);
+    expect(body).toEqual({
+      error: "Request failed.",
+      message: "Request failed.",
+      code: "internal_error",
+    });
+    expect(JSON.stringify(body)).not.toContain("patient-secret");
+  });
+
   it("treats empty document-detail chunk as absent and clamps page/chunk windows", async () => {
     const client = createSupabaseMock((call) => {
       if (call.table === "documents" && call.maybeSingle) {
@@ -402,6 +438,115 @@ describe("API validation contracts", () => {
     expect(client.calls[0]).toMatchObject({ table: "documents", limitCount: 200 });
   });
 
+  it.each([
+    {
+      table: "documents",
+      malformedRow: {
+        id: { sensitive: "patient-secret" },
+        title: "Guideline",
+        file_name: "guideline.pdf",
+        status: "indexed",
+        page_count: 1,
+        chunk_count: 1,
+        image_count: 0,
+        error_message: null,
+        metadata: {},
+        updated_at: null,
+      },
+    },
+    {
+      table: "document_index_quality",
+      malformedRow: {
+        document_id: { sensitive: "patient-secret" },
+        quality_score: 0.8,
+        extraction_quality: "good",
+        metrics: {},
+        issues: [],
+        updated_at: null,
+      },
+    },
+    {
+      table: "ingestion_jobs",
+      malformedRow: {
+        id: "job-1",
+        document_id: { sensitive: "patient-secret" },
+        status: "completed",
+        stage: null,
+        error_message: null,
+        updated_at: null,
+      },
+    },
+    {
+      table: "ingestion_job_stages",
+      malformedRow: {
+        id: "stage-1",
+        document_id: { sensitive: "patient-secret" },
+        job_id: null,
+        stage_name: null,
+        stage_status: null,
+        error_message: null,
+        metadata: {},
+        artifact_counts: {},
+        finished_at: null,
+        started_at: null,
+      },
+    },
+    {
+      table: "document_pages",
+      malformedRow: {
+        document_id: { sensitive: "patient-secret" },
+        page_number: 1,
+        text: null,
+        ocr_used: false,
+        metadata: {},
+      },
+    },
+    {
+      table: "document_images",
+      malformedRow: {
+        document_id: { sensitive: "patient-secret" },
+        page_number: 1,
+        source_kind: null,
+        searchable: false,
+        metadata: {},
+      },
+    },
+  ])("rejects and redacts malformed $table rows from ingestion quality", async ({ table, malformedRow }) => {
+    const client = createSupabaseMock((call) => {
+      if (call.table === table) return ok([malformedRow]);
+      if (call.table === "documents") {
+        return ok([
+          {
+            id: documentId,
+            title: "Guideline",
+            file_name: "guideline.pdf",
+            status: "indexed",
+            page_count: 1,
+            chunk_count: 1,
+            image_count: 0,
+            error_message: null,
+            metadata: {},
+            updated_at: null,
+          },
+        ]);
+      }
+      return ok([]);
+    });
+    mockRuntime(client);
+    const { GET } = await import("../src/app/api/ingestion/quality/route");
+
+    const response = await GET(authenticatedRequest("/api/ingestion/quality"));
+    const body = await payload(response);
+
+    expect(response.status).toBe(500);
+    expect(body).toEqual({
+      error: "Request failed.",
+      message: "Request failed.",
+      code: "internal_error",
+    });
+    expect(JSON.stringify(body)).not.toContain("patient-secret");
+  });
+
   it("rejects invalid ingestion jobs batchId without querying jobs", async () => {
     const client = createSupabaseMock();
     mockRuntime(client);
@@ -473,6 +618,36 @@ describe("API validation contracts", () => {
     expect(client.calls[2]).toMatchObject({ table: "import_batches", range: { from: 1, to: 2 } });
   });
 
+  it.each([
+    {
+      path: "/api/jobs",
+      loadRoute: () => import("../src/app/api/jobs/route"),
+    },
+    {
+      path: "/api/ingestion/jobs",
+      loadRoute: () => import("../src/app/api/ingestion/jobs/route"),
+    },
+    {
+      path: "/api/ingestion/batches",
+      loadRoute: () => import("../src/app/api/ingestion/batches/route"),
+    },
+  ])("rejects and redacts malformed status rows from $path", async ({ path, loadRoute }) => {
+    const client = createSupabaseMock(() => ok([{ status: { sensitive: "patient-secret" } }]));
+    mockRuntime(client);
+    const { GET } = await loadRoute();
+
+    const response = await GET(authenticatedRequest(path));
+    const body = await payload(response);
+
+    expect(response.status).toBe(500);
+    expect(body).toEqual({
+      error: "Request failed.",
+      message: "Request failed.",
+      code: "internal_error",
+    });
+    expect(JSON.stringify(body)).not.toContain("patient-secret");
+  });
+
   it("validates UUID route params for retry, summarize, and labels endpoints", async () => {
     const client = createSupabaseMock();
     mockRuntime(client);
diff --git a/tests/app-modes.test.ts b/tests/app-modes.test.ts
index e5aff4e24f..ef1c5e061a 100644
--- a/tests/app-modes.test.ts
+++ b/tests/app-modes.test.ts
@@ -32,6 +32,7 @@ describe("app mode search contract", () => {
     expect(universalSearchModeForDomain("therapies")).toBe("therapy-compass");
     expect(universalSearchPreferredDomains("favourites")).toEqual([]);
     expect(universalSearchPreferredDomains("factsheets")).toEqual([]);
+    expect(universalSearchPreferredDomains("calculators")).toEqual([]);
   });
 
   it("requires every mode to declare its search behavior and copy", () => {
@@ -77,6 +78,17 @@ describe("app mode search contract", () => {
     expect(config.placeholder.toLowerCase()).toContain("tools");
   });
 
+  it("keeps calculators local and searchable as a first-class mode", () => {
+    const config = appModeSearchConfig("calculators");
+    const mode = appModeDefinitions.find((definition) => definition.id === "calculators");
+
+    expect(isSearchableAppMode("calculators")).toBe(true);
+    expect(mode?.href).toBe("/calculators");
+    expect(config.kind).toBe("calculators");
+    expect(config.resultKind).toBe("calculators");
+    expect(config.resultsSurface).toBe("results-band");
+  });
+
   it("keeps services searchable through the shared dashboard composer", () => {
     const config = appModeSearchConfig("services");
     const mode = appModeDefinitions.find((definition) => definition.id === "services");
@@ -236,6 +248,9 @@ describe("app mode search contract", () => {
     expect(appModeHomeHref("tools", { query: "  medications  ", run: true, focus: true })).toBe(
       "/tools?q=medications&focus=1&run=1",
     );
+    expect(appModeHomeHref("calculators", { query: "  PHQ-9  ", run: true, focus: true })).toBe(
+      "/calculators?q=PHQ-9&focus=1&run=1",
+    );
   });
 
   it("keeps active search context while routing from the shared composer", () => {
@@ -270,6 +285,7 @@ describe("app mode search contract", () => {
         "formulation",
         "prescribing",
         "tools",
+        "calculators",
         "therapy-compass",
         "factsheets",
       ]),
@@ -291,6 +307,7 @@ describe("app mode search contract", () => {
     expect(isAppModeVisible("formulation", "production")).toBe(true);
     expect(isAppModeVisible("prescribing", "production")).toBe(true);
     expect(isAppModeVisible("tools", "production")).toBe(true);
+    expect(isAppModeVisible("calculators", "production")).toBe(true);
     expect(isAppModeVisible("therapy-compass", "production")).toBe(true);
     expect(isAppModeVisible("factsheets", "production")).toBe(true);
     expect(productionModes).not.toContain("evidence");
@@ -303,6 +320,7 @@ describe("app mode search contract", () => {
     expect(productionModes).toContain("formulation");
     expect(productionModes).toContain("prescribing");
     expect(productionModes).toContain("tools");
+    expect(productionModes).toContain("calculators");
     expect(productionModes).toContain("therapy-compass");
     expect(productionModes).toContain("factsheets");
     expect(developmentModes).toEqual(
@@ -318,6 +336,7 @@ describe("app mode search contract", () => {
         "formulation",
         "prescribing",
         "tools",
+        "calculators",
         "therapy-compass",
         "factsheets",
       ]),
@@ -393,6 +412,7 @@ describe("app mode search contract", () => {
       "therapy-compass": "/therapy-compass?q=clozapine&run=1",
       // Tools has no search route by design: it filters its launcher in place.
       tools: "/tools?q=clozapine&run=1",
+      calculators: "/calculators?q=clozapine&run=1",
     });
   });
 
diff --git a/tests/audit-navigation-auth-regressions.test.ts b/tests/audit-navigation-auth-regressions.test.ts
index 15eac0c271..34e84d65cc 100644
--- a/tests/audit-navigation-auth-regressions.test.ts
+++ b/tests/audit-navigation-auth-regressions.test.ts
@@ -7,20 +7,12 @@ import { describe, expect, it } from "vitest";
 import { GET as redirectApplications, HEAD as headApplications } from "@/app/applications/route";
 import { resolveDifferentialCompareHandoff } from "@/lib/differentials";
 import { legacyHomeRedirectUrl } from "@/lib/legacy-home-redirect";
+import { sourceSegment } from "./helpers/source-contract";
 
 function source(relativePath: string) {
   return readFileSync(resolve(process.cwd(), relativePath), "utf8");
 }
 
-function sourceSegment(contents: string, startMarker: string, endMarker: string) {
-  const start = contents.indexOf(startMarker);
-  const end = contents.indexOf(endMarker, start + startMarker.length);
-  if (start < 0 || end < 0) {
-    throw new Error(`Could not locate source segment from ${startMarker} to ${endMarker}.`);
-  }
-  return contents.slice(start, end);
-}
-
 const clinicalDashboardSource = source("src/components/ClinicalDashboard.tsx");
 const masterSearchHeaderSource = source("src/components/clinical-dashboard/master-search-header.tsx");
 const universalAlsoMatchesSource = source("src/components/clinical-dashboard/universal-search-also-matches.tsx");
@@ -103,6 +95,7 @@ describe("audit navigation and auth regressions", () => {
       masterSearchHeaderSource,
       "ref={modeMenuRef}",
       'className={cn("relative z-[60]',
+      { label: "master mode-menu focus boundary" },
     );
 
     expect(focusLeaveContract).toContain("onBlur={(event) => {");
@@ -135,20 +128,25 @@ describe("audit navigation and auth regressions", () => {
       masterSearchHeaderSource,
       "function renderModeMenuOption(",
       "function renderModeMenuOptions()",
+      { label: "mode-menu option prefetch" },
     );
     const openModeMenuWithFocus = sourceSegment(
       masterSearchHeaderSource,
       "function openModeMenuWithFocus(",
       "function toggleModeMenu(",
+      { label: "mode-menu focus-open prefetch" },
     );
     const toggleModeMenu = sourceSegment(
       masterSearchHeaderSource,
       "function toggleModeMenu(",
       "function handleModeTriggerKeyDown(",
+      { label: "mode-menu toggle prefetch" },
     );
 
     expect(masterSearchHeaderSource).toContain("function prefetchModeSelection(modeId: AppModeId)");
-    expect(masterSearchHeaderSource).toContain("const href = appModeSelectionHref(modeId)");
+    expect(masterSearchHeaderSource).toContain(
+      'const href = modeId === "tools" ? "/tools" : appModeSelectionHref(modeId)',
+    );
     expect(masterSearchHeaderSource).toContain("router.prefetch(href,");
     expect(masterSearchHeaderSource).toContain("onInvalidate:");
     expect(modeOption).toContain("onFocus={() => prefetchModeSelection(mode.id)}");
@@ -179,6 +177,7 @@ describe("audit navigation and auth regressions", () => {
       clinicalDashboardSource,
       "const showUniversalAlsoMatches =",
       "const showDesktopHomeComposer =",
+      { label: "also-matches visibility gate" },
     );
     expect(alsoMatchesGate).toContain('activeModeResultKind === "tools"');
     expect(alsoMatchesGate).toContain('activeModeResultKind === "favourites"');
@@ -193,6 +192,7 @@ describe("audit navigation and auth regressions", () => {
       clinicalDashboardSource,
       "const uploadReadOnlyMode =",
       "const canUsePrivateApis =",
+      { label: "upload read-only capability" },
     );
     // Uploads stay writable in local no-auth; only explicit demo / auth-unavailable lock them.
     expect(uploadReadOnlyContract).toContain("const uploadReadOnlyMode = resolveUploadReadOnlyMode({");
@@ -207,6 +207,7 @@ describe("audit navigation and auth regressions", () => {
       clinicalDashboardSource,
       "const canUsePrivateApis =",
       "const canRunSearch =",
+      { label: "private API capability" },
     );
     expect(privateCapabilityContract).toContain("const canUsePrivateApis =");
     expect(privateCapabilityContract).toContain(
@@ -217,6 +218,7 @@ describe("audit navigation and auth regressions", () => {
       clinicalDashboardSource,
       "if (!nextDemoMode && !canUsePrivateApis) {",
       "const shouldRefreshWorkState =",
+      { label: "private polling capability" },
     );
     expect(pollingContract).toContain("if (!nextDemoMode && !canUsePrivateApis) {");
     expect(pollingContract).toContain("setDocuments([]);");
@@ -226,6 +228,7 @@ describe("audit navigation and auth regressions", () => {
       clinicalDashboardSource,
       "const mutateDocumentLabel =",
       "const handleDocumentDeleted =",
+      { label: "private label mutation" },
     );
     expect(labelMutationContract).toContain("if (!canUsePrivateApis) return false;");
 
@@ -233,6 +236,7 @@ describe("audit navigation and auth regressions", () => {
       clinicalDashboardSource,
       "function openUploadDrawer()",
       "function openEvidenceDrawer()",
+      { label: "private upload mutation" },
     );
     expect(uploadMutationContract).toContain("if (!canUseAdministrativeApis) {");
   });
@@ -264,6 +268,7 @@ describe("audit navigation and auth regressions", () => {
       uploadDesktopHookSource,
       "export function useUploadDesktopLayout(",
       "}",
+      { label: "upload desktop layout hook" },
     );
     expect(useUploadDesktopLayoutBody).toMatch(
       /return\s+useSyncExternalStore\(\s*subscribeToUploadDesktopLayout,\s*getUploadDesktopLayoutSnapshot,\s*\(\)\s*=>\s*false\s*\)/,
@@ -280,17 +285,33 @@ describe("audit navigation and auth regressions", () => {
   });
 
   it("leaves favourites universal matches to the favourites hub", () => {
-    const universalMatchesContract = sourceSegment(
+    const nonAnswerUniversalMatchesContract = sourceSegment(
       clinicalDashboardSource,
-      "{showUniversalAlsoMatches &&",
+      "{showUniversalAlsoMatches &&\n                (activeModeResultKind",
       // The shared home now opens the mode-content chain, ahead of differentials.
       "{showSharedHome ?",
+      { label: "non-answer also-matches render branch" },
+    );
+    const answerUniversalMatchesContract = sourceSegment(
+      clinicalDashboardSource,
+      '{showUniversalAlsoMatches && activeModeResultKind === "answer" ? (',
+      "</section>",
+      { label: "answer also-matches render branch" },
     );
 
-    expect(universalMatchesContract).toContain("<UniversalSearchAlsoMatches modeId={searchMode}");
-    expect(universalMatchesContract).not.toContain('activeModeResultKind === "favourites"');
+    // Pin every dashboard-owned also-matches render branch. A third occurrence
+    // must be classified here rather than silently escaping the negative.
+    expect(clinicalDashboardSource.match(/\{showUniversalAlsoMatches &&/g)).toHaveLength(2);
+    for (const contract of [nonAnswerUniversalMatchesContract, answerUniversalMatchesContract]) {
+      expect(contract).toContain("<UniversalSearchAlsoMatches modeId={searchMode}");
+      expect(contract).not.toContain('activeModeResultKind === "favourites"');
+    }
+    // This test is about WHICH surface owns the favourites also-matches block,
+    // not about the expression feeding its query prop — that became
+    // `activeQuery` when the page took over live in-place filtering from the
+    // shared composer (ledger #164).
     expect(source("src/components/clinical-dashboard/favourites-command-library-page.tsx")).toContain(
-      '<UniversalSearchAlsoMatches modeId="favourites" query={query} />',
+      '<UniversalSearchAlsoMatches modeId="favourites"',
     );
   });
 });
diff --git a/tests/calculators-mode.dom.test.tsx b/tests/calculators-mode.dom.test.tsx
new file mode 100644
index 0000000000..9aabe09ca2
--- /dev/null
+++ b/tests/calculators-mode.dom.test.tsx
@@ -0,0 +1,240 @@
+/** @vitest-environment jsdom */
+
+import { render, screen, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { describe, expect, it, vi } from "vitest";
+
+const navigation = vi.hoisted(() => ({
+  push: vi.fn(),
+  redirect: vi.fn(() => {
+    throw new Error("NEXT_REDIRECT");
+  }),
+}));
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: navigation.push }),
+  redirect: navigation.redirect,
+}));
+
+import CalculatorsRoute from "@/app/(search-app)/calculators/page";
+import {
+  calculatorDomainCandidateCount,
+  calculatorProgressCandidateCount,
+  calculatorTimeCandidateCount,
+  filterCalculatorRecords,
+  type CalculatorFilterRecord,
+  type CalculatorFilterState,
+} from "@/components/calculators/calculator-filters";
+import { calculators, type CalculatorFixture } from "@/components/calculators/calculator-fixtures";
+import { CalculatorsHomePage } from "@/components/calculators/home-page";
+import { CalculatorsSearchPage } from "@/components/calculators/search-page";
+import { deriveCalculator, type AnswerMap } from "@/components/calculators/calculator-ui";
+import { SearchCommandProvider } from "@/components/clinical-dashboard/search-command-context";
+
+function completeAnswers(calc: CalculatorFixture): AnswerMap {
+  return Object.fromEntries(calc.items.map((item) => [item.id, 0]));
+}
+
+function recordsWithProgress(): CalculatorFilterRecord[] {
+  return calculators.map((calc) => {
+    const answers = calc.id === "gad7" ? completeAnswers(calc) : calc.id === "phq9" ? { p1: 1 } : {};
+    return { calc, derived: deriveCalculator(calc, answers) };
+  });
+}
+
+const emptyFilters = (): CalculatorFilterState => ({
+  domains: new Set(),
+  progress: "all",
+  time: "all",
+});
+
+describe("calculator mode routing", () => {
+  it("renders the shared-composer home until a non-empty search is submitted", async () => {
+    const home = await CalculatorsRoute({ searchParams: Promise.resolve({}) });
+    const emptyRun = await CalculatorsRoute({ searchParams: Promise.resolve({ run: "1", q: "  " }) });
+    const results = await CalculatorsRoute({
+      searchParams: Promise.resolve({ run: "1", q: " depression " }),
+    });
+
+    expect(home.type).toBe(CalculatorsHomePage);
+    expect(emptyRun.type).toBe(CalculatorsHomePage);
+    expect(results.type).toBe(CalculatorsSearchPage);
+    expect(results.props.initialQuery).toBe("depression");
+  });
+
+  it("normalizes the legacy query parameter to the canonical q URL", async () => {
+    navigation.redirect.mockClear();
+    await expect(
+      CalculatorsRoute({
+        searchParams: Promise.resolve({ run: "1", query: "PHQ-9", focus: "1" }),
+      }),
+    ).rejects.toThrow("NEXT_REDIRECT");
+    expect(navigation.redirect).toHaveBeenCalledWith("/calculators?run=1&focus=1&q=PHQ-9");
+  });
+
+  it("removes empty and redundant legacy query parameters", async () => {
+    navigation.redirect.mockClear();
+    await expect(CalculatorsRoute({ searchParams: Promise.resolve({ query: "   " }) })).rejects.toThrow(
+      "NEXT_REDIRECT",
+    );
+    expect(navigation.redirect).toHaveBeenLastCalledWith("/calculators");
+
+    await expect(CalculatorsRoute({ searchParams: Promise.resolve({ q: "GAD-7", query: "" }) })).rejects.toThrow(
+      "NEXT_REDIRECT",
+    );
+    expect(navigation.redirect).toHaveBeenLastCalledWith("/calculators?q=GAD-7");
+  });
+
+  it("mounts the universal hero composer slot and canonical starter searches", () => {
+    const { container } = render(<CalculatorsHomePage />);
+
+    expect(screen.getByRole("heading", { level: 1, name: "Clinical Calculators" })).toBeVisible();
+    expect(container.querySelector(".mode-home-composer-slot")).toBeInTheDocument();
+    expect(screen.getByRole("link", { name: /Depression severity/ })).toHaveAttribute(
+      "href",
+      "/calculators?q=depression&run=1",
+    );
+    expect(screen.getByRole("link", { name: "PHQ-9" })).toHaveAttribute("href", "/calculators?q=PHQ-9&run=1");
+  });
+});
+
+describe("calculator filter predicates", () => {
+  it("applies OR within domains and AND across domain, progress, time, and query", () => {
+    const records = recordsWithProgress();
+    const filters: CalculatorFilterState = {
+      domains: new Set(["mood", "anxiety"]),
+      progress: "completed",
+      time: "quick",
+    };
+
+    expect(filterCalculatorRecords(records, "anxiety", filters).map(({ calc }) => calc.id)).toEqual(["gad7"]);
+    expect(filterCalculatorRecords(records, "depression", filters)).toEqual([]);
+  });
+
+  it("keeps not-started, in-progress, and completed boundaries exclusive", () => {
+    const records = recordsWithProgress();
+    const states = ["not-started", "in-progress", "completed"] as const;
+    const ids = Object.fromEntries(
+      states.map((progress) => [
+        progress,
+        filterCalculatorRecords(records, "", { ...emptyFilters(), progress }).map(({ calc }) => calc.id),
+      ]),
+    );
+
+    expect(ids["in-progress"]).toEqual(["phq9"]);
+    expect(ids.completed).toEqual(["gad7"]);
+    expect(ids["not-started"]).not.toContain("phq9");
+    expect(ids["not-started"]).not.toContain("gad7");
+    expect(new Set(Object.values(ids).flat()).size).toBe(calculators.length);
+  });
+
+  it("buckets completion time by the fixture's numeric maximum", () => {
+    const records = recordsWithProgress();
+    const idsFor = (time: "quick" | "standard" | "extended") =>
+      filterCalculatorRecords(records, "", { ...emptyFilters(), time }).map(({ calc }) => calc.id);
+
+    expect(idsFor("quick")).toEqual(["gad7", "cage", "auditc", "sadpersons"]);
+    expect(idsFor("standard")).toEqual(["phq9", "k10", "mdq"]);
+    expect(idsFor("extended")).toEqual(["ybocs"]);
+  });
+
+  it("derives candidate counts from the same predicates", () => {
+    const records = recordsWithProgress();
+    const filters: CalculatorFilterState = {
+      domains: new Set(["mood"]),
+      progress: "all",
+      time: "all",
+    };
+
+    expect(calculatorDomainCandidateCount(records, "", filters, "anxiety")).toBe(4);
+    expect(calculatorProgressCandidateCount(records, "", filters, "in-progress")).toBe(1);
+    expect(calculatorTimeCandidateCount(records, "", filters, "quick")).toBe(0);
+  });
+});
+
+describe("calculator results surface", () => {
+  it("uses the shared results band and filter sheet without a page-owned composer", async () => {
+    const user = userEvent.setup();
+    const { container } = render(<CalculatorsSearchPage initialQuery="depression" />);
+
+    expect(screen.getByRole("heading", { level: 1, name: "depression" })).toBeVisible();
+    expect(screen.getByRole("status")).toHaveTextContent("2 calculators");
+    expect(container.querySelector('[data-testid="calculators-phone-dock"]')).toBeNull();
+
+    await user.click(screen.getByTestId("calculators-filter-trigger-phone"));
+    const sheet = screen.getByTestId("calculators-filter-sheet");
+    expect(within(sheet).getByRole("group", { name: "Clinical domain" })).toBeVisible();
+    expect(within(sheet).getByRole("radiogroup", { name: "Session progress" })).toBeVisible();
+    expect(within(sheet).getByRole("radiogroup", { name: "Completion time" })).toBeVisible();
+  });
+
+  it("labels applied filters, removes one chip, and clears filters without clearing the query", async () => {
+    const user = userEvent.setup();
+    render(<CalculatorsSearchPage initialQuery="depression" />);
+
+    await user.click(screen.getByTestId("calculators-filter-trigger-phone"));
+    const sheet = screen.getByTestId("calculators-filter-sheet");
+    await user.click(within(sheet).getByRole("button", { name: /Mood/ }));
+    expect(screen.getByRole("button", { name: "Remove Clinical domain: Mood filter" })).toBeVisible();
+    expect(screen.getByRole("heading", { level: 1, name: "depression" })).toBeVisible();
+
+    await user.click(screen.getByRole("button", { name: "Remove Clinical domain: Mood filter" }));
+    expect(screen.queryByRole("button", { name: "Remove Clinical domain: Mood filter" })).toBeNull();
+
+    await user.click(within(sheet).getByRole("button", { name: /Mood/ }));
+    await user.click(screen.getByTestId("calculators-filter-sheet-clear"));
+    expect(screen.queryByRole("button", { name: "Remove Clinical domain: Mood filter" })).toBeNull();
+    expect(screen.getByRole("heading", { level: 1, name: "depression" })).toBeVisible();
+  });
+
+  it("distinguishes filtered and query-only empty recovery", async () => {
+    const user = userEvent.setup();
+    const { rerender } = render(
+      <SearchCommandProvider value={{ query: "", modeId: "calculators" }}>
+        <CalculatorsSearchPage />
+      </SearchCommandProvider>,
+    );
+
+    await user.click(screen.getByTestId("calculators-filter-trigger-phone"));
+    await user.click(within(screen.getByTestId("calculators-filter-sheet")).getByRole("button", { name: /Mood/ }));
+    rerender(
+      <SearchCommandProvider value={{ query: "anxiety", modeId: "calculators" }}>
+        <CalculatorsSearchPage />
+      </SearchCommandProvider>,
+    );
+    expect(screen.getByText("No calculators match the selected filter")).toBeVisible();
+    expect(screen.getByTestId("search-results-empty-remove-filter")).toBeVisible();
+
+    await user.click(screen.getByTestId("calculators-filter-sheet-clear"));
+    rerender(
+      <SearchCommandProvider value={{ query: "no-such-calculator", modeId: "calculators" }}>
+        <CalculatorsSearchPage />
+      </SearchCommandProvider>,
+    );
+    expect(screen.getByText("No matches for “no-such-calculator”")).toBeVisible();
+    await user.click(screen.getByTestId("search-results-empty-clear-search"));
+    expect(navigation.push).toHaveBeenCalledWith("/calculators?focus=1");
+  });
+
+  it("opens, updates, completes, closes, and resumes a scoring session", async () => {
+    const user = userEvent.setup();
+    Element.prototype.scrollTo = vi.fn();
+    render(<CalculatorsSearchPage initialQuery="PHQ-9" />);
+
+    await user.click(screen.getByRole("button", { name: /^Open PHQ-9/ }));
+    let dialog = screen.getByRole("dialog", { name: "PHQ-9 calculator" });
+    const firstItem = within(dialog).getByRole("group", { name: "Little interest or pleasure in doing things" });
+    await user.click(within(firstItem).getByRole("button", { name: "Several days (1 point)" }));
+    expect(within(dialog).getAllByText("1 of 9 answered")[0]).toBeVisible();
+
+    for (const option of within(dialog).getAllByRole("button", { name: "Not at all (0 points)" })) {
+      await user.click(option);
+    }
+    expect(within(dialog).getAllByText("9 of 9 answered")[0]).toBeVisible();
+
+    await user.click(within(dialog).getByRole("button", { name: /^Close$/ }));
+    await user.click(screen.getAllByRole("button", { name: /^Open PHQ-9/ })[0]);
+    dialog = screen.getByRole("dialog", { name: "PHQ-9 calculator" });
+    expect(within(dialog).getAllByText("9 of 9 answered")[0]).toBeVisible();
+  });
+});
diff --git a/tests/check-playwright-browser-revision.test.ts b/tests/check-playwright-browser-revision.test.ts
index f3f802ba33..25087eaef6 100644
--- a/tests/check-playwright-browser-revision.test.ts
+++ b/tests/check-playwright-browser-revision.test.ts
@@ -1,10 +1,12 @@
 import { describe, expect, it } from "vitest";
 import {
+  findInstalledChromiumBinary,
   listInstalledChromiumRevisions,
   playwrightBrowserRevisionCheck,
   readExpectedChromiumRevision,
+  resolveDefaultManagedBrowsersRoot,
 } from "../scripts/check-playwright-browser-revision.mjs";
-import { mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 
@@ -15,12 +17,102 @@ describe("check-playwright-browser-revision", () => {
     expect(expected.revision).toMatch(/^\d+$/);
   });
 
-  it("passes when no designated container browser root is forced", () => {
-    const result = playwrightBrowserRevisionCheck({
-      env: { NODE_ENV: "test" },
-    });
-    expect(result.ok).toBe(true);
-    expect(result.status).toBe("managed-or-unconstrained");
+  it("fails closed (#312) when no browsers root — forced or default — has a matching binary on disk", () => {
+    // This is the exact false-"OK" regression: no PLAYWRIGHT_BROWSERS_PATH is
+    // forced, so the old check trusted "unconstrained" as a pass without ever
+    // looking at disk. An isolated, guaranteed-empty default cache directory
+    // must now report failure, not a green light.
+    const emptyDefaultRoot = mkdtempSync(path.join(tmpdir(), "pw-empty-default-"));
+    const projectRoot = mkdtempSync(path.join(tmpdir(), "pw-project-"));
+    try {
+      mkdirSync(path.join(projectRoot, "node_modules", "playwright-core"), { recursive: true });
+      writeFileSync(
+        path.join(projectRoot, "node_modules", "playwright-core", "browsers.json"),
+        JSON.stringify({ browsers: [{ name: "chromium", revision: "1234" }] }),
+      );
+
+      const result = playwrightBrowserRevisionCheck({
+        projectRoot,
+        env: { NODE_ENV: "test" },
+        defaultManagedBrowsersRoot: emptyDefaultRoot,
+      });
+
+      expect(result.ok).toBe(false);
+      expect(result.status).toBe("not-installed");
+      expect(result.expectedRevision).toBe("1234");
+      expect(result.installedRevisions).toEqual([]);
+      expect(result.message).toContain("npx playwright install chromium");
+    } finally {
+      rmSync(emptyDefaultRoot, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+      rmSync(projectRoot, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+    }
+  });
+
+  it("passes (#312) when the default managed cache has a launchable headless-shell binary", () => {
+    const root = mkdtempSync(path.join(tmpdir(), "pw-default-installed-"));
+    const projectRoot = mkdtempSync(path.join(tmpdir(), "pw-project-"));
+    try {
+      const binary = path.join(
+        root,
+        "chromium_headless_shell-1234",
+        "chrome-headless-shell-linux64",
+        "chrome-headless-shell",
+      );
+      mkdirSync(path.dirname(binary), { recursive: true });
+      writeFileSync(binary, "", { mode: 0o755 });
+
+      mkdirSync(path.join(projectRoot, "node_modules", "playwright-core"), { recursive: true });
+      writeFileSync(
+        path.join(projectRoot, "node_modules", "playwright-core", "browsers.json"),
+        JSON.stringify({ browsers: [{ name: "chromium", revision: "1234" }] }),
+      );
+
+      const result = playwrightBrowserRevisionCheck({
+        projectRoot,
+        env: { NODE_ENV: "test" },
+        defaultManagedBrowsersRoot: root,
+        platform: "linux",
+        architecture: "x64",
+      });
+
+      expect(result.ok).toBe(true);
+      expect(result.status).toBe("installed");
+      expect(result.binaryPath).toBe(binary);
+    } finally {
+      rmSync(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+      rmSync(projectRoot, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+    }
+  });
+
+  it("fails closed (#312) when a revision directory exists but has no real binary inside it (partial/corrupt install)", () => {
+    // Directory-name matching alone is not enough — this is the residual gap
+    // that survived even in the old "container-aligned" path.
+    const root = mkdtempSync(path.join(tmpdir(), "pw-empty-dir-"));
+    const projectRoot = mkdtempSync(path.join(tmpdir(), "pw-project-"));
+    try {
+      mkdirSync(path.join(root, "chromium-1234"), { recursive: true });
+
+      mkdirSync(path.join(projectRoot, "node_modules", "playwright-core"), { recursive: true });
+      writeFileSync(
+        path.join(projectRoot, "node_modules", "playwright-core", "browsers.json"),
+        JSON.stringify({ browsers: [{ name: "chromium", revision: "1234" }] }),
+      );
+
+      const result = playwrightBrowserRevisionCheck({
+        projectRoot,
+        env: { NODE_ENV: "test" },
+        defaultManagedBrowsersRoot: root,
+        platform: "linux",
+        architecture: "x64",
+      });
+
+      expect(result.ok).toBe(false);
+      expect(result.status).toBe("binary-missing");
+      expect(result.installedRevisions).toEqual(["1234"]);
+    } finally {
+      rmSync(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+      rmSync(projectRoot, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+    }
   });
 
   it("fails closed on /opt/pw-browsers revision drift without suggesting a mismatched executable (#255)", () => {
@@ -51,6 +143,187 @@ describe("check-playwright-browser-revision", () => {
     expect(result.message).not.toMatch(/set PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH to .*1194/);
   });
 
+  it("passes when the designated container actually has a launchable binary for the pinned revision", () => {
+    const root = mkdtempSync(path.join(tmpdir(), "pw-container-aligned-"));
+    const projectRoot = mkdtempSync(path.join(tmpdir(), "pw-project-"));
+    try {
+      const binary = path.join(
+        root,
+        "chromium_headless_shell-1234",
+        "chrome-headless-shell-linux64",
+        "chrome-headless-shell",
+      );
+      mkdirSync(path.dirname(binary), { recursive: true });
+      writeFileSync(binary, "", { mode: 0o755 });
+
+      mkdirSync(path.join(projectRoot, "node_modules", "playwright-core"), { recursive: true });
+      writeFileSync(
+        path.join(projectRoot, "node_modules", "playwright-core", "browsers.json"),
+        JSON.stringify({ browsers: [{ name: "chromium", revision: "1234" }] }),
+      );
+
+      const result = playwrightBrowserRevisionCheck({
+        projectRoot,
+        containerBrowsersRoot: root,
+        platform: "linux",
+        architecture: "x64",
+        env: {
+          NODE_ENV: "test",
+          PLAYWRIGHT_BROWSERS_PATH: root,
+          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1",
+        },
+      });
+
+      expect(result.ok).toBe(true);
+      expect(result.status).toBe("container-aligned");
+      expect(result.binaryPath).toBe(binary);
+    } finally {
+      rmSync(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+      rmSync(projectRoot, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+    }
+  });
+
+  it("fails closed when the designated container has only an empty revision directory, not a real binary (#312)", () => {
+    // Same drift status as a fully-missing revision: a same-named empty
+    // directory must not be mistaken for an installed, launchable browser.
+    const root = mkdtempSync(path.join(tmpdir(), "pw-container-empty-"));
+    const projectRoot = mkdtempSync(path.join(tmpdir(), "pw-project-"));
+    try {
+      mkdirSync(path.join(root, "chromium_headless_shell-1234"), { recursive: true });
+
+      mkdirSync(path.join(projectRoot, "node_modules", "playwright-core"), { recursive: true });
+      writeFileSync(
+        path.join(projectRoot, "node_modules", "playwright-core", "browsers.json"),
+        JSON.stringify({ browsers: [{ name: "chromium", revision: "1234" }] }),
+      );
+
+      const result = playwrightBrowserRevisionCheck({
+        projectRoot,
+        containerBrowsersRoot: root,
+        platform: "linux",
+        architecture: "x64",
+        env: {
+          NODE_ENV: "test",
+          PLAYWRIGHT_BROWSERS_PATH: root,
+          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1",
+        },
+      });
+
+      expect(result.ok).toBe(false);
+      expect(result.status).toBe("container-revision-drift");
+      expect(result.installedRevisions).toEqual(["1234"]);
+    } finally {
+      rmSync(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+      rmSync(projectRoot, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+    }
+  });
+
+  it("fails closed when only full Chrome is present because the default projects launch headless shell", () => {
+    const root = mkdtempSync(path.join(tmpdir(), "pw-full-chrome-only-"));
+    const projectRoot = mkdtempSync(path.join(tmpdir(), "pw-project-"));
+    try {
+      const fullChrome = path.join(root, "chromium-1234", "chrome-linux64", "chrome");
+      mkdirSync(path.dirname(fullChrome), { recursive: true });
+      writeFileSync(fullChrome, "", { mode: 0o755 });
+      mkdirSync(path.join(projectRoot, "node_modules", "playwright-core"), { recursive: true });
+      writeFileSync(
+        path.join(projectRoot, "node_modules", "playwright-core", "browsers.json"),
+        JSON.stringify({ browsers: [{ name: "chromium", revision: "1234" }] }),
+      );
+
+      const result = playwrightBrowserRevisionCheck({
+        projectRoot,
+        env: { NODE_ENV: "test" },
+        defaultManagedBrowsersRoot: root,
+        platform: "linux",
+        architecture: "x64",
+      });
+
+      expect(result.ok).toBe(false);
+      expect(result.status).toBe("binary-missing");
+    } finally {
+      rmSync(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+      rmSync(projectRoot, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+    }
+  });
+
+  it("uses playwright-core's package-local cache when PLAYWRIGHT_BROWSERS_PATH=0", () => {
+    const projectRoot = mkdtempSync(path.join(tmpdir(), "pw-project-"));
+    try {
+      const coreRoot = path.join(projectRoot, "node_modules", "playwright-core");
+      const binary = path.join(
+        coreRoot,
+        ".local-browsers",
+        "chromium_headless_shell-1234",
+        "chrome-headless-shell-linux64",
+        "chrome-headless-shell",
+      );
+      mkdirSync(path.dirname(binary), { recursive: true });
+      writeFileSync(binary, "", { mode: 0o755 });
+      writeFileSync(
+        path.join(coreRoot, "browsers.json"),
+        JSON.stringify({ browsers: [{ name: "chromium", revision: "1234" }] }),
+      );
+
+      const result = playwrightBrowserRevisionCheck({
+        projectRoot,
+        env: { NODE_ENV: "test", PLAYWRIGHT_BROWSERS_PATH: "0" },
+        platform: "linux",
+        architecture: "x64",
+      });
+
+      expect(result.ok).toBe(true);
+      expect(result.status).toBe("installed");
+      expect(result.binaryPath).toBe(binary);
+    } finally {
+      rmSync(projectRoot, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+    }
+  });
+
+  it("fails closed when the expected headless-shell path is a directory or a non-executable file", () => {
+    const root = mkdtempSync(path.join(tmpdir(), "pw-not-executable-"));
+    const projectRoot = mkdtempSync(path.join(tmpdir(), "pw-project-"));
+    try {
+      const binary = path.join(
+        root,
+        "chromium_headless_shell-1234",
+        "chrome-headless-shell-linux64",
+        "chrome-headless-shell",
+      );
+      mkdirSync(binary, { recursive: true });
+      mkdirSync(path.join(projectRoot, "node_modules", "playwright-core"), { recursive: true });
+      writeFileSync(
+        path.join(projectRoot, "node_modules", "playwright-core", "browsers.json"),
+        JSON.stringify({ browsers: [{ name: "chromium", revision: "1234" }] }),
+      );
+
+      const directoryResult = playwrightBrowserRevisionCheck({
+        projectRoot,
+        env: { NODE_ENV: "test" },
+        defaultManagedBrowsersRoot: root,
+        platform: "linux",
+        architecture: "x64",
+      });
+      expect(directoryResult.ok).toBe(false);
+      expect(directoryResult.status).toBe("binary-missing");
+
+      rmSync(binary, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+      writeFileSync(binary, "", { mode: 0o644 });
+      const nonExecutableResult = playwrightBrowserRevisionCheck({
+        projectRoot,
+        env: { NODE_ENV: "test" },
+        defaultManagedBrowsersRoot: root,
+        platform: "linux",
+        architecture: "x64",
+      });
+      expect(nonExecutableResult.ok).toBe(false);
+      expect(nonExecutableResult.status).toBe("binary-missing");
+    } finally {
+      rmSync(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+      rmSync(projectRoot, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+    }
+  });
+
   it("lists installed chromium revisions from a browsers root", () => {
     const root = mkdtempSync(path.join(tmpdir(), "pw-list-"));
     mkdirSync(path.join(root, "chromium-1234"));
@@ -58,4 +331,49 @@ describe("check-playwright-browser-revision", () => {
     mkdirSync(path.join(root, "firefox-1000"));
     expect(listInstalledChromiumRevisions(root)).toEqual(["1234"]);
   });
+
+  it("finds the actual headless-shell binary for a revision, not just its directory", () => {
+    const root = mkdtempSync(path.join(tmpdir(), "pw-find-binary-"));
+    try {
+      expect(findInstalledChromiumBinary(root, "1234", { platform: "linux", architecture: "x64" })).toBeNull();
+
+      const binary = path.join(
+        root,
+        "chromium_headless_shell-1234",
+        "chrome-headless-shell-linux64",
+        "chrome-headless-shell",
+      );
+      mkdirSync(path.dirname(binary), { recursive: true });
+      writeFileSync(binary, "", { mode: 0o755 });
+      expect(findInstalledChromiumBinary(root, "1234", { platform: "linux", architecture: "x64" })).toBe(binary);
+    } finally {
+      rmSync(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+    }
+  });
+
+  it("resolves the platform-specific default managed-cache directory", () => {
+    const baseEnv = { NODE_ENV: "test" as const };
+    expect(resolveDefaultManagedBrowsersRoot(baseEnv, "/home/dev", "linux").replaceAll("\\", "/")).toBe(
+      "/home/dev/.cache/ms-playwright",
+    );
+    expect(
+      resolveDefaultManagedBrowsersRoot(
+        { ...baseEnv, XDG_CACHE_HOME: "/custom/cache" },
+        "/home/dev",
+        "linux",
+      ).replaceAll("\\", "/"),
+    ).toBe("/custom/cache/ms-playwright");
+    expect(resolveDefaultManagedBrowsersRoot(baseEnv, "/Users/dev", "darwin").replaceAll("\\", "/")).toBe(
+      "/Users/dev/Library/Caches/ms-playwright",
+    );
+    expect(resolveDefaultManagedBrowsersRoot(baseEnv, "C:/Users/dev", "win32").replaceAll("\\", "/")).toBe(
+      "C:/Users/dev/AppData/Local/ms-playwright",
+    );
+    expect(
+      resolveDefaultManagedBrowsersRoot({ ...baseEnv, LOCALAPPDATA: "C:/custom" }, "C:/Users/dev", "win32").replaceAll(
+        "\\",
+        "/",
+      ),
+    ).toBe("C:/custom/ms-playwright");
+  });
 });
diff --git a/tests/ci-cache-safety.test.ts b/tests/ci-cache-safety.test.ts
index ffd387b525..480df51044 100644
--- a/tests/ci-cache-safety.test.ts
+++ b/tests/ci-cache-safety.test.ts
@@ -99,6 +99,12 @@ describe("CI cache safety", () => {
     expect(workflow).toContain("run: npm run check:verification-plan");
   });
 
+  it("runs the generated medication lexicon freshness check through static-heavy scope", () => {
+    expect(workflow).toMatch(
+      /name: Medication lexicon report freshness\n\s+if: needs\.changes\.outputs\.static_heavy_changed == 'true'\n\s+run: npm run check:medication-lexicon-report/,
+    );
+  });
+
   it("does not repeat focused workflow contracts inside the full coverage run", () => {
     expect(workflow).toContain(
       "if: needs.changes.outputs.workflow_changed == 'true' && needs.changes.outputs.coverage_changed != 'true'",
diff --git a/tests/client-secret-surface.test.ts b/tests/client-secret-surface.test.ts
index e84748dad2..4b0b30d0c1 100644
--- a/tests/client-secret-surface.test.ts
+++ b/tests/client-secret-surface.test.ts
@@ -19,7 +19,11 @@ const SRC_ROOT = join(ROOT, "src");
 const SERVER_ENV = join(SRC_ROOT, "lib", "env.ts");
 const PUBLIC_ENV = join(SRC_ROOT, "lib", "client-env.ts");
 const SOURCE_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx"];
-const PUBLIC_ENV_KEYS = new Set(["NODE_ENV", "NEXT_PUBLIC_LOCAL_NO_AUTH"]);
+const PUBLIC_ENV_KEYS = new Set([
+  "NODE_ENV",
+  "NEXT_PUBLIC_LOCAL_NO_AUTH",
+  "NEXT_PUBLIC_RAG_INCREMENTAL_EVIDENCE_PREVIEW_RENDER",
+]);
 const importCache = new Map<string, string[]>();
 
 function sourceFiles(dir: string): string[] {
diff --git a/tests/clinical-dashboard-helpers.test.ts b/tests/clinical-dashboard-helpers.test.ts
index bbe7330fa4..163daa32ba 100644
--- a/tests/clinical-dashboard-helpers.test.ts
+++ b/tests/clinical-dashboard-helpers.test.ts
@@ -15,6 +15,7 @@ import {
   normalizedPollDelay,
   setupNeedsSlowRecheck,
   setupRecheckPollMs,
+  shouldShowSharedHome,
   shorterPollDelay,
 } from "@/components/clinical-dashboard/clinical-dashboard-helpers";
 import type { ClinicalDocument, ImportBatch, IngestionJob, RagAnswer } from "@/lib/types";
@@ -54,6 +55,36 @@ describe("normalizedPollDelay / shorterPollDelay", () => {
   });
 });
 
+describe("shouldShowSharedHome", () => {
+  const sharedHomeState = {
+    pathname: "/",
+    mode: null,
+    submittedUrlRunRequested: false,
+    hasError: false,
+    hasAnswer: false,
+    loading: false,
+    submittedAnswerSearchActive: false,
+  };
+
+  it("shows an idle mode home but preserves the legacy Tools launcher alias", () => {
+    expect(shouldShowSharedHome(sharedHomeState)).toBe(true);
+    expect(shouldShowSharedHome({ ...sharedHomeState, mode: "tools" })).toBe(false);
+    expect(shouldShowSharedHome({ ...sharedHomeState, pathname: "/tools" })).toBe(false);
+  });
+
+  it("hides the shared home whenever search or answer state owns the page", () => {
+    for (const state of [
+      { submittedUrlRunRequested: true },
+      { hasError: true },
+      { hasAnswer: true },
+      { loading: true },
+      { submittedAnswerSearchActive: true },
+    ]) {
+      expect(shouldShowSharedHome({ ...sharedHomeState, ...state })).toBe(false);
+    }
+  });
+});
+
 describe("hasActiveIndexingWork / setupNeedsSlowRecheck", () => {
   it("detects in-flight work across documents, jobs, batches, and the route hint", () => {
     expect(hasActiveIndexingWork([], [], [], true)).toBe(true);
diff --git a/tests/design-system-contract-utils.test.ts b/tests/design-system-contract-utils.test.ts
index 5c13181f1d..69e4aa6d51 100644
--- a/tests/design-system-contract-utils.test.ts
+++ b/tests/design-system-contract-utils.test.ts
@@ -12,6 +12,7 @@ import {
   findErrorStateCountPropsInSource,
   findFailedStateResultCountsInSource,
   findHardcodedMotionClassesInSource,
+  findInteractiveTapFloorDeclarationsInSource,
   findInteractiveTapLiteralsInSource,
   findJsxEdgeOwnershipConflictsInSource,
   findLayoutTransitionClassesInSource,
@@ -81,6 +82,39 @@ describe("design-system contract helpers", () => {
     ).toEqual([]);
   });
 
+  it("flags interactive controls declaring a sub-floor min-height, and only those (Gate 2)", () => {
+    const find = (source: string) => findInteractiveTapFloorDeclarationsInSource("src/example.tsx", source);
+
+    // The violation: an interactive element declaring its own floor under 48px.
+    expect(find('<button className="min-h-9 px-3">Reset</button>')).toEqual(["src/example.tsx:1"]);
+    expect(find('<button className={cn("inline-flex min-h-10", active && "px-3")}>Reset</button>')).toEqual([
+      "src/example.tsx:1",
+    ]);
+    expect(find('<summary className="min-h-8">Details</summary>')).toEqual(["src/example.tsx:1"]);
+    expect(find('<summary className="min-h-[42px]">Details</summary>')).toEqual(["src/example.tsx:1"]);
+    expect(find('<button className="min-h-[2.5rem]">Reset</button>')).toEqual(["src/example.tsx:1"]);
+    expect(find('<button className={compact ? "min-h-10" : "min-h-12"}>Reset</button>')).toEqual(["src/example.tsx:1"]);
+    expect(find('<button className={cn("min-h-12", compact && "min-h-10")}>Reset</button>')).toEqual([
+      "src/example.tsx:1",
+    ]);
+
+    // The repo's correct responsive pattern must NOT be flagged: 48px on
+    // phones, released to 40px from `sm` up.
+    expect(find('<button className="min-h-12 sm:min-h-10">Save</button>')).toEqual([]);
+    expect(find('<button className="min-h-tap sm:min-h-9">Save</button>')).toEqual([]);
+    expect(find('<button className="min-h-[48px]">Save</button>')).toEqual([]);
+    expect(find('<button className="min-h-[3rem]">Save</button>')).toEqual([]);
+    expect(find('<button className={compact ? "min-h-tap" : "min-h-12"}>Save</button>')).toEqual([]);
+
+    // A short height on a NON-interactive element is layout, not a tap target.
+    expect(find('<div className="min-h-9">Panel</div>')).toEqual([]);
+
+    // Scoped to `min-h-*`: a short `h-*`/`size-*` is routinely the visible box
+    // of a control whose hit area belongs to a tap-sized wrapper, so flagging
+    // it would pad the baseline with non-defects (GATES.md §5).
+    expect(find('<input type="checkbox" className="h-4 w-4" />')).toEqual([]);
+  });
+
   it("finds whitespace, fallback, URL, string and template --text-soft consumers in TypeScript", () => {
     const source = [
       'const spacedClose = "text-[color:var(--text-soft )]";',
diff --git a/tests/differentials-compare-selection.dom.test.tsx b/tests/differentials-compare-selection.dom.test.tsx
index 41c2a7fb29..a021834579 100644
--- a/tests/differentials-compare-selection.dom.test.tsx
+++ b/tests/differentials-compare-selection.dom.test.tsx
@@ -3,6 +3,21 @@ import type { ReactNode } from "react";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import { getDifferentialRecord, getPresentationWorkflow } from "@/lib/differentials";
+import type { DocumentMatch } from "@/lib/types";
+
+const unrelatedDocumentMatch: DocumentMatch = {
+  document_id: "unrelated-source",
+  title: "Unrelated indexed source",
+  file_name: "unrelated.pdf",
+  labels: [],
+  summarySnippet: "The query matched this document without linking it to a ranked differential.",
+  bestPages: [1],
+  bestChunkIds: ["unrelated-chunk"],
+  imageCount: 0,
+  tableCount: 0,
+  matchReason: "query overlap",
+  score: 0.8,
+};
 
 const catalogState = vi.hoisted(() => ({
   status: "loading" as "loading" | "ready" | "error" | "unauthorized" | "refetching",
@@ -41,9 +56,12 @@ vi.mock("@/components/clinical-dashboard/use-differential-catalog", () => ({
   }),
 }));
 
-vi.mock("@/components/use-result-sort", () => ({
-  useResultSort: () => ["relevance", vi.fn()] as const,
-}));
+vi.mock("@/components/use-result-sort", async () => {
+  const { useState } = await import("react");
+  return {
+    useResultSort: () => useState<"relevance" | "alpha">("relevance"),
+  };
+});
 
 vi.mock("@/components/clinical-dashboard/universal-search-also-matches", () => ({
   UniversalSearchAlsoMatches: () => null,
@@ -163,4 +181,144 @@ describe("DifferentialsHome compare selection URL handoff", () => {
       }
     });
   });
+
+  it("keeps guided best matches in accent styling, shows only clinical cues, and ranks them after A–Z sorting", async () => {
+    const alphabeticalFirst = getDifferentialRecord("acute-dystonia");
+    const relevanceBest = getDifferentialRecord("medical-gi-endocrine-painful-organic-cause");
+    expect(alphabeticalFirst && relevanceBest).toBeTruthy();
+    catalogState.status = "ready";
+    catalogState.matches = {
+      diagnoses: [
+        { record: relevanceBest!, score: 20, reasons: ["title"] },
+        { record: alphabeticalFirst!, score: 12, reasons: ["title"] },
+      ],
+      presentations: [],
+    };
+
+    render(<DifferentialsHome query="Pain" loading={false} searchSubmitted onRunSearch={vi.fn()} />);
+
+    const bestMatch = await screen.findByTestId("differential-best-match-card");
+    expect(bestMatch).toHaveClass("border-[color:var(--clinical-accent-border)]");
+    expect(bestMatch).not.toHaveClass("border-[color:var(--success-border)]");
+
+    const resultRow = screen.getByTestId("differential-compact-result");
+    const clinicalCue = alphabeticalFirst!.currentPresentation.find((cue) => cue.trim());
+    const investigation = alphabeticalFirst!.investigations.find((step) => step.trim());
+    expect(clinicalCue).toBeTruthy();
+    expect(investigation).toBeTruthy();
+    expect(resultRow).toHaveTextContent(clinicalCue!.replaceAll("/", " / ").replace(/\s+/g, " ").trim().toLowerCase());
+    expect(resultRow).not.toHaveTextContent(investigation!);
+
+    await act(async () => {
+      screen.getByRole("button", { name: "A–Z" }).click();
+    });
+    await waitFor(() => {
+      expect(screen.getByTestId("differential-best-match-rank")).toHaveTextContent("2");
+    });
+  });
+
+  it("does not present query-wide source matches as verification of the ranked differential", async () => {
+    const relevanceBest = getDifferentialRecord("medical-gi-endocrine-painful-organic-cause");
+    expect(relevanceBest).toBeTruthy();
+    catalogState.status = "ready";
+    catalogState.matches = {
+      diagnoses: [{ record: relevanceBest!, score: 20, reasons: ["title"] }],
+      presentations: [],
+    };
+
+    render(
+      <DifferentialsHome
+        query="Pain"
+        loading={false}
+        searchSubmitted
+        documentMatches={[unrelatedDocumentMatch]}
+        evidenceQuery="Pain"
+        onRunSearch={vi.fn()}
+      />,
+    );
+
+    const bestMatch = await screen.findByTestId("differential-best-match-card");
+    expect(bestMatch).toHaveClass("border-[color:var(--clinical-accent-border)]");
+    expect(bestMatch).not.toHaveClass("border-[color:var(--success-border)]");
+  });
+
+  it("does not render an empty reasoning panel for a sparse catalogue record", async () => {
+    const record = getDifferentialRecord("medical-gi-endocrine-painful-organic-cause");
+    expect(record).toBeTruthy();
+    catalogState.status = "ready";
+    catalogState.matches = {
+      diagnoses: [
+        {
+          record: {
+            ...record!,
+            subtitle: "",
+            clinicalHinge: "",
+            currentPresentation: [" "],
+            investigations: [" "],
+          },
+          score: 20,
+          reasons: ["title"],
+        },
+      ],
+      presentations: [],
+    };
+
+    render(<DifferentialsHome query="Pain" loading={false} searchSubmitted onRunSearch={vi.fn()} />);
+
+    await screen.findByTestId("differential-best-match-card");
+    expect(screen.queryAllByTestId("differential-best-match-panel")).toHaveLength(0);
+  });
+
+  it("renders duplicate clinical cues without duplicate React keys", async () => {
+    const record = getDifferentialRecord("medical-gi-endocrine-painful-organic-cause");
+    const lead = getDifferentialRecord("acute-dystonia");
+    expect(record && lead).toBeTruthy();
+    const repeatedCue = record!.currentPresentation.find((cue) => cue.trim()) ?? "pain";
+    catalogState.status = "ready";
+    catalogState.matches = {
+      diagnoses: [
+        { record: lead!, score: 20, reasons: ["title"] },
+        {
+          record: { ...record!, currentPresentation: [repeatedCue, repeatedCue] },
+          score: 12,
+          reasons: ["title"],
+        },
+      ],
+      presentations: [],
+    };
+    const consoleError = vi.spyOn(console, "error").mockImplementation(() => undefined);
+
+    try {
+      render(<DifferentialsHome query="Pain" loading={false} searchSubmitted onRunSearch={vi.fn()} />);
+      await screen.findByTestId("differential-best-match-card");
+      expect(consoleError.mock.calls.flat().join(" ")).not.toContain("same key");
+    } finally {
+      consoleError.mockRestore();
+    }
+  });
+
+  it("drops blank and less-specific duplicate cues from the reasoning panel", async () => {
+    const record = getDifferentialRecord("medical-gi-endocrine-painful-organic-cause");
+    expect(record).toBeTruthy();
+    catalogState.status = "ready";
+    catalogState.matches = {
+      diagnoses: [
+        {
+          record: { ...record!, currentPresentation: ["pain", "severe pain", " "] },
+          score: 20,
+          reasons: ["title"],
+        },
+      ],
+      presentations: [],
+    };
+
+    render(<DifferentialsHome query="Pain" loading={false} searchSubmitted onRunSearch={vi.fn()} />);
+
+    const lookForSections = await screen.findAllByText("Look for");
+    expect(lookForSections).not.toHaveLength(0);
+    for (const heading of lookForSections) {
+      expect(heading.parentElement).toHaveTextContent("severe pain");
+      expect(heading.parentElement).not.toHaveTextContent("pain · severe pain");
+    }
+  });
 });
diff --git a/tests/differentials.test.ts b/tests/differentials.test.ts
index a1289bd837..0572fd4137 100644
--- a/tests/differentials.test.ts
+++ b/tests/differentials.test.ts
@@ -379,7 +379,7 @@ function presentationMatch(id: string, score: number, candidateSlugs: string[]):
       safetySnapshot: { summary: `${id} safety`, tags: ["tag-one"] },
       criteria: [],
       candidates: candidateSlugs.map((slug) => ({ slug, selected: false, comparison: {} })),
-      reviewChecklist: [],
+      reviewChecklist: [`${id} review step`],
       highestUrgencyNote: "",
       sourceStatus: { label: "", version: "", lastUpdated: "" },
     },
@@ -394,7 +394,13 @@ describe("composeDifferentialSearchResults", () => {
       [diagnosisMatch("alpha", 10), diagnosisMatch("beta", 8)],
       [presentationMatch("workflow-one", 9, ["beta"])],
     );
-    expect(results[0]).toMatchObject({ kind: "presentation", id: "workflow-one", matchLabel: "Best match" });
+    expect(results[0]).toMatchObject({
+      kind: "presentation",
+      id: "workflow-one",
+      matchLabel: "Best match",
+      clinicalCues: ["tag-one"],
+      nextSteps: ["workflow-one review step"],
+    });
     // Candidate diagnoses of the lead presentation come before other diagnoses.
     expect(results[1]).toMatchObject({ kind: "diagnosis", id: "beta" });
     expect(results[2]).toMatchObject({ kind: "diagnosis", id: "alpha" });
@@ -405,7 +411,12 @@ describe("composeDifferentialSearchResults", () => {
       [diagnosisMatch("alpha", 20)],
       [presentationMatch("workflow-one", 3, [])],
     );
-    expect(results[0]).toMatchObject({ kind: "diagnosis", id: "alpha" });
+    expect(results[0]).toMatchObject({
+      kind: "diagnosis",
+      id: "alpha",
+      clinicalCues: ["alpha presentation feature"],
+      nextSteps: ["alpha test"],
+    });
     expect(results[1]).toMatchObject({ kind: "presentation", id: "workflow-one" });
   });
 
diff --git a/tests/document-cover-thumbnails.test.ts b/tests/document-cover-thumbnails.test.ts
index 0e757eff8d..34320164bc 100644
--- a/tests/document-cover-thumbnails.test.ts
+++ b/tests/document-cover-thumbnails.test.ts
@@ -5,6 +5,7 @@ import { demoDocuments, demoImages, getDemoImage } from "@/lib/demo-data";
 import { toDocumentMatch } from "@/lib/document-enrichment";
 import { isClinicalImageEvidence } from "@/lib/image-filtering";
 import type { RelatedDocument } from "@/lib/types";
+import { isMissingStorageObject, selectCommittedCovers } from "../scripts/archive/backfill-document-covers.mjs";
 
 const extractorSource = readFileSync(new URL("../worker/python/extract_pdf_assets.py", import.meta.url), "utf8");
 const workerSource = readFileSync(new URL("../worker/main.ts", import.meta.url), "utf8");
@@ -24,6 +25,59 @@ describe("document cover thumbnails", () => {
     );
   });
 
+  it("audits every selected PDF and repairs missing objects or cover metadata", () => {
+    expect(backfillSource).toContain('const all = hasFlag("--all")');
+    expect(backfillSource).toContain("loadCurrentDocument(candidate.id)");
+    expect(backfillSource).toContain("loadCurrentCovers(doc.id)");
+    expect(backfillSource).toContain("existingObjectIsLive");
+    expect(backfillSource).toContain("recovered cover metadata");
+    expect(backfillSource).toContain('.eq("metadata->>index_generation_id", expectedGeneration)');
+    expect(backfillSource).toContain("rolled back generation-changed cover repair");
+    expect(backfillSource).not.toContain("coveredIds.has(String(doc.id))");
+  });
+
+  it("fails closed when a cover probe reports anything except a definite missing object", () => {
+    expect(isMissingStorageObject({ status: 404 })).toBe(true);
+    expect(isMissingStorageObject({ code: "NoSuchKey" })).toBe(true);
+    expect(isMissingStorageObject({ statusCode: "404" })).toBe(true);
+    expect(isMissingStorageObject({ status: 403, code: "AccessDenied" })).toBe(false);
+    expect(isMissingStorageObject({ status: 503, code: "InternalError" })).toBe(false);
+    expect(backfillSource).toContain("probe.error && !isMissingStorageObject(probe.error)");
+  });
+
+  it("prefers the document pointer when duplicate committed covers remain", () => {
+    const covers = [
+      { id: "old", index_generation_id: "generation-a", metadata: {} },
+      { id: "pointed", index_generation_id: "generation-a", metadata: {} },
+      { id: "staged", index_generation_id: "generation-b", metadata: {} },
+    ];
+
+    expect(selectCommittedCovers(covers, "generation-a", "pointed")).toEqual({
+      selected: covers[1],
+      matches: covers.slice(0, 2),
+    });
+  });
+
+  it("uses compare-and-swap metadata writes and owned rollback cleanup", () => {
+    expect(backfillSource).toContain('.eq("metadata", JSON.stringify(current))');
+    expect(backfillSource).toMatch(/cover-page-1-\$\{repairId\}\.png/);
+    expect(backfillSource).toContain("failed to roll back replacement cover row");
+    expect(backfillSource).toContain("fresh?.metadata?.cover_image_id === insertedId");
+    expect(backfillSource).toMatch(
+      /failed to roll back replacement cover row[\s\S]*?removeOrQueueReplacedImage\(targetDocument, imagePath\)/,
+    );
+  });
+
+  it("retires replaced rows only after the pointer moves and preserves storage cleanup", () => {
+    expect(backfillSource).toContain("Insert first and retire the previous row only after the document");
+    expect(backfillSource).toMatch(
+      /patchCoverImageId\(doc\.id, inserted\.id, committedGeneration\)[\s\S]*?retireCoverRow\(doc, existingCover\)/,
+    );
+    expect(backfillSource).toContain("removeOrQueueReplacedImage(targetDocument, coverRow.storage_path)");
+    expect(backfillSource).toContain('supabase.from("storage_cleanup_jobs").insert({');
+    expect(backfillSource).toContain('operation: "replace_document_cover"');
+  });
+
   it("extracts a first-page cover_page artifact in the PDF worker", () => {
     expect(extractorSource).toContain("def save_cover_page(");
     expect(extractorSource).toContain('"sourceKind": "cover_page"');
diff --git a/tests/document-detail-performance.test.ts b/tests/document-detail-performance.test.ts
index 9c1b04b51e..929ecb0145 100644
--- a/tests/document-detail-performance.test.ts
+++ b/tests/document-detail-performance.test.ts
@@ -2,6 +2,8 @@ import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { describe, expect, it } from "vitest";
 
+import { sourceSegment } from "./helpers/source-contract";
+
 function source(path: string) {
   return readFileSync(resolve(process.cwd(), path), "utf8");
 }
@@ -99,8 +101,12 @@ describe("document viewer latency guards", () => {
     const viewer = source("src/components/DocumentViewer.tsx");
     const routeHook = source("src/components/document-viewer/use-document-viewer-route.ts");
     const panelInstances = viewer.match(/<IndexedTextPanel\b/g) ?? [];
-    const retryStart = viewer.indexOf("const retryPreview");
-    const retryBlock = viewer.slice(retryStart, viewer.indexOf("useEffect", retryStart));
+    // `useEffect` as an end marker is an arbitrary token, not a structure —
+    // DocumentViewer has several. Guarded so a reorder fails loudly instead of
+    // widening this window to the rest of the file.
+    const retryBlock = sourceSegment(viewer, "const retryPreview", "useEffect", {
+      label: "DocumentViewer retryPreview block",
+    });
 
     expect(viewer).toContain('assetScope: "window"');
     expect(viewer).toContain("useInitialResult");
diff --git a/tests/document-section-nav-contract.test.ts b/tests/document-section-nav-contract.test.ts
index c6031f75e5..1dc66fd755 100644
--- a/tests/document-section-nav-contract.test.ts
+++ b/tests/document-section-nav-contract.test.ts
@@ -2,6 +2,8 @@ import { readFileSync } from "node:fs";
 
 import { describe, expect, it } from "vitest";
 
+import { sourceSegment } from "./helpers/source-contract";
+
 /**
  * Cheap wiring contract for document section navigation.
  *
@@ -50,9 +52,11 @@ describe("document section navigation ownership", () => {
   });
 
   it("keeps document-viewer ui-smoke on the current phone section chrome", () => {
-    const documentViewerSmoke = uiSmokeSource.slice(
-      uiSmokeSource.indexOf('test("document viewer puts the PDF preview first'),
-      uiSmokeSource.indexOf('test("answer glass header overlays main'),
+    const documentViewerSmoke = sourceSegment(
+      uiSmokeSource,
+      'test("document viewer puts the PDF preview first',
+      'test("answer glass header overlays main',
+      { label: "document viewer phone section smoke" },
     );
 
     expect(documentViewerSmoke).toContain('getByTestId("document-section-trigger")');
diff --git a/tests/favourites-auth-gate.dom.test.tsx b/tests/favourites-auth-gate.dom.test.tsx
index 0534422e19..5d98170a2d 100644
--- a/tests/favourites-auth-gate.dom.test.tsx
+++ b/tests/favourites-auth-gate.dom.test.tsx
@@ -10,6 +10,7 @@ import { FavouritesCommandLibraryPage } from "@/components/clinical-dashboard/fa
 import { AccountSetupDialog } from "@/components/clinical-dashboard/account-setup-dialog";
 import { ApplicationsLauncherWorkspace } from "@/components/applications-launcher-page";
 import { MasterSearchHeader } from "@/components/clinical-dashboard/master-search-header";
+import { ToolsSearchResultsPage } from "@/components/tools/tools-search-results-page";
 import { filterCrossModesForSession, visibleAppModeDefinitionsForSession } from "@/lib/app-modes";
 import { toolCatalogRecordsForSession } from "@/lib/tools-catalog";
 
@@ -133,7 +134,7 @@ describe("favourites auth gate DOM", () => {
     authSession.status = "signed_out";
     render(<FavouritesCommandLibraryPage query="" demoMode={false} />);
 
-    expect(screen.getByRole("heading", { name: "Favourites command library" })).toBeVisible();
+    expect(screen.getByRole("heading", { name: "Favourites" })).toBeVisible();
     expect(screen.getByText(/Sign up to save favourites and access them across devices/i)).toBeVisible();
     expect(screen.getByTestId("favourites-open-account-setup")).toBeVisible();
     expect(screen.getByRole("heading", { name: "Sign up to save favourites" })).toBeVisible();
@@ -144,7 +145,7 @@ describe("favourites auth gate DOM", () => {
     authSession.status = "signed_out";
     render(<FavouritesCommandLibraryPage query="" demoMode={true} />);
 
-    expect(screen.getByRole("heading", { name: "Favourites command library" })).toBeVisible();
+    expect(screen.getByRole("heading", { name: "Favourites" })).toBeVisible();
     expect(screen.queryByRole("heading", { name: "Sign up to save favourites" })).toBeNull();
     expect(screen.queryByTestId("favourites-open-account-setup")).toBeNull();
   });
@@ -261,6 +262,19 @@ describe("favourites auth gate DOM", () => {
     ]);
   });
 
+  it("applies the same Favourites access gate to the all-tools results directory", () => {
+    const { rerender } = render(<ToolsSearchResultsPage canAccessFavourites={false} />);
+
+    expect(screen.getByRole("heading", { level: 1, name: "All tools" })).toBeVisible();
+    expect(screen.queryByRole("radio", { name: /Saved/ })).toBeNull();
+    expect(screen.queryByRole("heading", { name: "Saved workflows" })).toBeNull();
+
+    rerender(<ToolsSearchResultsPage canAccessFavourites />);
+
+    expect(screen.getByRole("radio", { name: "Saved (1)" })).toBeVisible();
+    expect(screen.getByRole("heading", { name: "Saved workflows" })).toBeVisible();
+  });
+
   it("omits Favourites from the mode menu for guests", async () => {
     const user = userEvent.setup();
     render(<MasterSearchHeader {...headerProps(false)} />);
diff --git a/tests/favourites-demo-boundary.test.ts b/tests/favourites-demo-boundary.test.ts
index 93bfb19343..d040563c7b 100644
--- a/tests/favourites-demo-boundary.test.ts
+++ b/tests/favourites-demo-boundary.test.ts
@@ -21,10 +21,15 @@ const universalSearchSource = readFileSync(
   new URL("../src/components/clinical-dashboard/universal-search-command-surface.tsx", import.meta.url),
   "utf8",
 );
-const mobileCardSource = librarySource.slice(
-  librarySource.indexOf("function FavouriteMobileCard"),
-  librarySource.indexOf("function FavouritesTable"),
-);
+// End the slice at FavouriteMobileCard's own closing brace rather than at
+// whichever function happened to be declared next. The old form ran to
+// `function FavouritesTable`, so any component added between the two was
+// silently pulled into this window and failed the aria-pressed assertion below
+// for code that is not the mobile card at all (hit while retiring the library
+// nav for ledger #164).
+const mobileCardStart = librarySource.indexOf("function FavouriteMobileCard");
+const mobileCardEnd = librarySource.indexOf("\n}\n", mobileCardStart);
+const mobileCardSource = librarySource.slice(mobileCardStart, mobileCardEnd);
 
 describe("favourites demo-data boundary", () => {
   it("passes trusted server demo state and never merges prototype favourites into live mode unconditionally", () => {
diff --git a/tests/guard-push.test.ts b/tests/guard-push.test.ts
index 2dffb6d0a5..82ae1b70d5 100644
--- a/tests/guard-push.test.ts
+++ b/tests/guard-push.test.ts
@@ -154,6 +154,49 @@ describe("push-range parsing", () => {
     expect(parsePushRanges("\n  \n")).toHaveLength(0);
   });
 
+  it("compares a fast-forward push from its remote tip", () => {
+    const { root, git } = gitFixture();
+    git("update-ref", "refs/remotes/origin/main", "HEAD");
+    git("switch", "--quiet", "-c", "feature");
+    writeFileSync(join(root, "one.md"), "one\n");
+    git("add", "one.md");
+    git("commit", "--quiet", "-m", "one");
+    const remoteSha = git("rev-parse", "HEAD");
+    writeFileSync(join(root, "two.md"), "two\n");
+    git("add", "two.md");
+    git("commit", "--quiet", "-m", "two");
+    const localSha = git("rev-parse", "HEAD");
+
+    // Ordinary push: the remote tip is reachable, so it stays the base and only
+    // the newly pushed commit is in scope.
+    expect(guardBaseForRange({ localSha, remoteSha }, root)).toBe(remoteSha);
+    expect(changedFilesForRange({ localSha, remoteSha }, root)).toEqual(["two.md"]);
+  });
+
+  // A force-push abandons the old remote tip. Comparing against it makes every
+  // file the discarded history carried look deleted, which is unanswerable for
+  // transaction guards; the merge base is the question CI actually asks.
+  it("falls back to the merge base when the remote tip was discarded by a force-push", () => {
+    const { root, git, baseSha } = gitFixture();
+    git("update-ref", "refs/remotes/origin/main", "HEAD");
+    git("switch", "--quiet", "-c", "feature");
+    writeFileSync(join(root, "abandoned.md"), "abandoned\n");
+    git("add", "abandoned.md");
+    git("commit", "--quiet", "-m", "abandoned");
+    const discardedSha = git("rev-parse", "HEAD");
+
+    git("reset", "--quiet", "--hard", baseSha);
+    writeFileSync(join(root, "rebuilt.md"), "rebuilt\n");
+    git("add", "rebuilt.md");
+    git("commit", "--quiet", "-m", "rebuilt");
+    const localSha = git("rev-parse", "HEAD");
+
+    expect(discardedSha).not.toBe(localSha);
+    expect(guardBaseForRange({ localSha, remoteSha: discardedSha }, root)).toBe(baseSha);
+    // abandoned.md must not read as a deletion introduced by this push.
+    expect(changedFilesForRange({ localSha, remoteSha: discardedSha }, root)).toEqual(["rebuilt.md"]);
+  });
+
   it("keeps a Windows new-branch static command scoped to the PR side of an advanced main", () => {
     const { root, git, baseSha } = gitFixture();
     git("switch", "--quiet", "-c", "feature");
diff --git a/tests/guide-centre.dom.test.tsx b/tests/guide-centre.dom.test.tsx
index cf3f753b03..00e6226b93 100644
--- a/tests/guide-centre.dom.test.tsx
+++ b/tests/guide-centre.dom.test.tsx
@@ -42,6 +42,62 @@ describe("Clinical KB Guide Centre", () => {
     expect(within(dialog).getByRole("heading", { name: "How to verify an answer" })).toBeVisible();
   });
 
+  it("shows a useful verification example and hides the mobile tour action while scrolling down", () => {
+    vi.spyOn(window, "matchMedia").mockImplementation(
+      () =>
+        ({
+          matches: true,
+          addEventListener: vi.fn(),
+          removeEventListener: vi.fn(),
+        }) as unknown as MediaQueryList,
+    );
+    const { dialog } = renderGuide();
+    expect(within(dialog).getByText("Check each claim, not just the summary")).toBeVisible();
+    expect(within(dialog).getByLabelText("Neutral illustrative answer")).toHaveTextContent(
+      "place its citation beside the words it supports",
+    );
+
+    const scrollBody = dialog.querySelector<HTMLElement>(".polished-scroll");
+    const footer = dialog.querySelector<HTMLElement>("[data-guide-mobile-footer]");
+    const footerLayer = footer?.parentElement;
+    const content = dialog.querySelector<HTMLElement>("[data-guide-content]");
+    expect(scrollBody).not.toBeNull();
+    expect(footer).not.toBeNull();
+    expect(content).not.toBeNull();
+
+    Object.defineProperty(scrollBody, "scrollTop", { configurable: true, value: 80 });
+    fireEvent.scroll(scrollBody!);
+    expect(footerLayer).toHaveClass("translate-y-full");
+    expect(footer).toHaveAttribute("aria-hidden", "true");
+    expect(footer).toHaveAttribute("inert", "");
+    expect(within(footer!).queryByRole("button", { name: "Start guided tour" })).not.toBeInTheDocument();
+    expect(content).toHaveClass("pb-0");
+    expect(content).not.toHaveClass("pb-28");
+
+    Object.defineProperty(scrollBody, "scrollTop", { configurable: true, value: 0 });
+    fireEvent.scroll(scrollBody!);
+    expect(footerLayer).not.toHaveClass("translate-y-full");
+    expect(footer).toHaveAttribute("aria-hidden", "false");
+    expect(footer).not.toHaveAttribute("inert");
+    expect(content).toHaveClass("pb-28");
+  });
+
+  it("keeps the guide footer available while the desktop body scrolls", () => {
+    const { dialog } = renderGuide();
+    const scrollBody = dialog.querySelector<HTMLElement>(".polished-scroll");
+    const footer = dialog.querySelector<HTMLElement>("[data-guide-mobile-footer]");
+    const footerLayer = footer?.parentElement;
+    const content = dialog.querySelector<HTMLElement>("[data-guide-content]");
+
+    Object.defineProperty(scrollBody, "scrollTop", { configurable: true, value: 80 });
+    fireEvent.scroll(scrollBody!);
+
+    expect(footerLayer).not.toHaveClass("translate-y-full");
+    expect(footer).toHaveAttribute("aria-hidden", "false");
+    expect(footer).not.toHaveAttribute("inert");
+    expect(content).toHaveClass("pb-28");
+  });
+
   it("wires every quick task to its complete guide topic", async () => {
     const user = userEvent.setup();
     const { dialog } = renderGuide();
diff --git a/tests/header-scroll-hide-contract.test.ts b/tests/header-scroll-hide-contract.test.ts
index 3ce7fc070a..2e17cfa374 100644
--- a/tests/header-scroll-hide-contract.test.ts
+++ b/tests/header-scroll-hide-contract.test.ts
@@ -436,7 +436,7 @@ describe("shared header hide/reveal wiring", () => {
   it("uses one adaptive phone footer positioning owner", () => {
     expect(headerSource).toContain("phone-footer-layer");
     expect(documentViewerSource).toContain("phone-footer-layer document-viewer-composer");
-    expect(calculatorSearchSource).toContain("phone-footer-layer answer-footer-search-dock");
+    expect(calculatorSearchSource).not.toContain("phone-footer-layer");
   });
 
   it("exposes one stable diagnostic contract across each phone chrome owner", () => {
@@ -464,20 +464,18 @@ describe("shared header hide/reveal wiring", () => {
     expect(phoneFooterPortalSource).toContain("export function PhoneFooterLayerFrame");
     expect(shellSource).toContain("<PhoneFooterLayerFrame");
     expect(dashboardSource).toContain("<PhoneFooterLayerFrame");
-    expect(calculatorSearchSource).toContain("<PhoneFooterLayerPortal>");
+    expect(calculatorSearchSource).not.toContain("<PhoneFooterLayerPortal>");
     expect(documentViewerSource).toContain("<PhoneFooterLayerPortal>");
     expect(differentialPresentationSource).toContain("<PhoneFooterLayerPortal>");
     expect(differentialPresentationSource).toContain('data-testid="differential-presentation-phone-footer"');
   });
 
-  it("shares the frame's authoritative scroll decision with the calculator footer", () => {
+  it("keeps calculator results on the shell's authoritative scroll decision", () => {
     expect(phoneFooterPortalSource).toContain("export function usePhoneFooterLayerScrollHidden");
     expect(shellSource).toContain("scrollHidden={chromeScrollHide.hidden}");
     expect(dashboardSource).toContain("scrollHidden={chromeScrollHidden}");
-    expect(calculatorSearchSource).toContain("const frameScrollHidden = usePhoneFooterLayerScrollHidden()");
-    expect(calculatorSearchSource).toContain(
-      "const footerHidden = frameScrollHidden ?? (innerFooterHidden || documentFooterHidden)",
-    );
+    expect(calculatorSearchSource).not.toContain("usePhoneFooterLayerScrollHidden");
+    expect(calculatorSearchSource).not.toContain("useHideOnScroll");
   });
 
   it("releases the phone top safe-area with hidden chrome while retaining the wide inset", () => {
diff --git a/tests/helpers/phone-scroll.ts b/tests/helpers/phone-scroll.ts
index 20fe66f360..317a66a3be 100644
--- a/tests/helpers/phone-scroll.ts
+++ b/tests/helpers/phone-scroll.ts
@@ -36,6 +36,7 @@ export const modeHomeRoutes = [
   "/formulation",
   "/dsm",
   "/tools",
+  "/calculators",
   "/differentials",
   "/specifiers",
   "/factsheets",
@@ -52,6 +53,7 @@ export const longRoutes = [
   "/formulation/worry",
   "/formulation/builder?mechanism=rumination&template=5Ps",
   "/documents/search",
+  "/calculators?q=depression&run=1",
   // Demo-corpus document detail: DocumentViewer owns its composer here, and its
   // scroll container binding has its own failure mode (stale #main-content).
   "/documents/11111111-1111-4111-8111-111111111111?page=1",
@@ -69,6 +71,7 @@ export const appModeHeaderRoutes = [
   { mode: "Formulation", route: "/formulation" },
   { mode: "Medication", route: "/?mode=prescribing" },
   { mode: "Tools", route: "/tools" },
+  { mode: "Calculators", route: "/calculators" },
   { mode: "Therapy", route: "/therapy-compass" },
   { mode: "Factsheets", route: "/factsheets" },
 ];
@@ -122,14 +125,6 @@ export const pageOwnedHeaderRoutes = [
 ];
 
 export const standalonePageOwnedFooterRoutes = [
-  {
-    name: "calculator composer",
-    route: "/calculators",
-    selector: '[data-testid="calculators-phone-dock"]',
-    focusSelector: 'input[aria-label="Search calculators"]',
-    reserveSelector: '[data-testid="calculators-search-page"]',
-    flushBottom: true,
-  },
   {
     name: "document composer",
     route: "/documents/11111111-1111-4111-8111-111111111111?page=1",
diff --git a/tests/helpers/source-contract.ts b/tests/helpers/source-contract.ts
new file mode 100644
index 0000000000..e9a6898833
--- /dev/null
+++ b/tests/helpers/source-contract.ts
@@ -0,0 +1,129 @@
+/**
+ * Bounded windows for source-text contract tests.
+ *
+ * Several tests in this suite assert on the raw text of a component rather than
+ * its behaviour, scoped to a window between two marker strings. The idiom they
+ * all reached for is:
+ *
+ *     source.slice(source.indexOf(start), source.indexOf(end))
+ *
+ * which has a silent failure mode that is worse than the fragility it is
+ * usually blamed for. When `end` no longer matches — someone renamed a symbol,
+ * reflowed a line, changed a class string used as a delimiter — `indexOf`
+ * returns `-1`, and `slice(start, -1)` does not throw. It quietly returns
+ * *everything to the end of the file bar one character*. Every positive
+ * `toContain` in that window then passes for the wrong reason: the assertion
+ * silently stops being scoped and starts matching anywhere in the file.
+ *
+ * The mirror case is just as bad. A missing `start` gives `slice(-1, n)`, an
+ * empty or one-character window, so every `not.toContain` passes vacuously.
+ *
+ * So the danger is not "this test breaks when unrelated code moves" — a broken
+ * test is loud and gets fixed. The danger is a test that keeps passing while
+ * enforcing nothing. This helper converts both cases into an immediate, named
+ * failure.
+ *
+ * It also rejects an *ambiguous* start marker. A window anchored on a string
+ * that occurs more than once silently covers only the first occurrence, so a
+ * negative assertion ("this must not appear here") proves nothing about the
+ * others. That is not hypothetical: `{showUniversalAlsoMatches &&` appears
+ * twice in `ClinicalDashboard.tsx`, and the window anchored on it was checking
+ * one of the two while reading as though it covered the contract.
+ *
+ * Prefer a structural end marker where the language provides one — a matching
+ * closing tag, `$$;` in SQL, a closing brace you can see. `header-scroll-hide-
+ * contract.test.ts` anchoring on `</PhoneHeaderCollapsePortal>` is the model.
+ * An end marker that is merely "whatever is declared next" is adjacency, not
+ * structure, and will widen the day something is inserted between them.
+ */
+
+type SourceSegmentOptions = {
+  /**
+   * Label used in failure messages so a throw names the contract rather than
+   * just the markers. Optional, but a test that scopes a window usually has a
+   * name for what the window IS.
+   */
+  label?: string;
+  /**
+   * Set when the start marker legitimately occurs more than once and the first
+   * occurrence is the intended one. Opt-in, so ambiguity is a decision rather
+   * than an accident.
+   */
+  allowRepeatedStart?: boolean;
+};
+
+function describeMarker(marker: string) {
+  const collapsed = marker.replace(/\s+/g, " ").trim();
+  return collapsed.length > 60 ? `${collapsed.slice(0, 57)}…` : collapsed;
+}
+
+function requireNonEmptyMarker(marker: string, kind: "start" | "end", context: string) {
+  if (marker.length === 0) {
+    throw new Error(`${context}${kind} marker must not be empty`);
+  }
+}
+
+/**
+ * Slice the window between `startMarker` and the first `endMarker` after it.
+ *
+ * Throws — never returns a silently wrong window — when the start is missing,
+ * the end is missing, or the start is ambiguous.
+ */
+export function sourceSegment(
+  contents: string,
+  startMarker: string,
+  endMarker: string,
+  options: SourceSegmentOptions = {},
+): string {
+  const context = options.label ? `${options.label}: ` : "";
+  requireNonEmptyMarker(startMarker, "start", context);
+  requireNonEmptyMarker(endMarker, "end", context);
+  const start = contents.indexOf(startMarker);
+  if (start < 0) {
+    throw new Error(`${context}start marker not found: "${describeMarker(startMarker)}"`);
+  }
+
+  if (!options.allowRepeatedStart) {
+    const second = contents.indexOf(startMarker, start + 1);
+    if (second >= 0) {
+      throw new Error(
+        `${context}start marker "${describeMarker(startMarker)}" occurs more than once, so this window covers only ` +
+          "the first occurrence and proves nothing about the rest of the file. Anchor on something unique, widen the " +
+          "assertion to the whole file, or pass allowRepeatedStart if the first occurrence really is the contract.",
+      );
+    }
+  }
+
+  const end = contents.indexOf(endMarker, start + startMarker.length);
+  if (end < 0) {
+    throw new Error(
+      `${context}end marker not found after the start: "${describeMarker(endMarker)}". Without this guard the window ` +
+        "would have silently become the rest of the file and every assertion in it would pass for the wrong reason.",
+    );
+  }
+
+  return contents.slice(start, end);
+}
+
+/**
+ * Window from `startMarker` to the end of the file. Use only where the contract
+ * genuinely runs to EOF; otherwise give `sourceSegment` a real end marker.
+ */
+export function sourceFrom(contents: string, startMarker: string, options: SourceSegmentOptions = {}): string {
+  const context = options.label ? `${options.label}: ` : "";
+  requireNonEmptyMarker(startMarker, "start", context);
+  const start = contents.indexOf(startMarker);
+  if (start < 0) {
+    throw new Error(`${context}start marker not found: "${describeMarker(startMarker)}"`);
+  }
+  if (!options.allowRepeatedStart) {
+    const second = contents.indexOf(startMarker, start + 1);
+    if (second >= 0) {
+      throw new Error(
+        `${context}start marker "${describeMarker(startMarker)}" occurs more than once; anchor on something unique ` +
+          "or pass allowRepeatedStart.",
+      );
+    }
+  }
+  return contents.slice(start);
+}
diff --git a/tests/helpers/style-contracts.ts b/tests/helpers/style-contracts.ts
index 343a3feb5b..e48e9dae1e 100644
--- a/tests/helpers/style-contracts.ts
+++ b/tests/helpers/style-contracts.ts
@@ -368,10 +368,39 @@ export const STYLE_CONTRACT_EXEMPTIONS: Readonly<Record<string, string>> = {
   "patient-details-fab__button--active": "patient details dock pill, populated state — no effect contract yet (#094)",
   "patient-details-fab__count": "patient details count badge — no effect contract yet (#094)",
   "medication-mobile-result": "prescribing phone results — no effect contract yet (#094)",
-  "pwa-install-sheet": "install sheet — presence covered by ui-pwa, effect not contracted",
   "search-band-count": "count weight/colour; the zero-result state needs a deterministic empty fixture first",
   "search-band-rule": "gradient divider — forced-colors fallback covered by ui-accessibility",
 
+  // PWA notices. `ui-pwa` deterministically raises the browser install event
+  // and covers the sheet's geometry, reachability, short-viewport scrolling,
+  // composer clearance, reduced motion, and forced-colors fallbacks. These
+  // component effects are not yet individually asserted by the general
+  // computed-style journey.
+  "pwa-action-primary": "PWA primary action — target geometry covered by ui-pwa; effect not contracted yet (#094)",
+  "pwa-action-secondary": "PWA secondary action — target geometry covered by ui-pwa; effect not contracted yet (#094)",
+  "pwa-connection-restored": "PWA connectivity-recovery notice — no deterministic effect contract yet (#094)",
+  "pwa-install-benefits":
+    "PWA benefit list — install-sheet journey covered by ui-pwa; effect not contracted yet (#094)",
+  "pwa-install-body": "PWA install body — install-sheet journey covered by ui-pwa; effect not contracted yet (#094)",
+  "pwa-install-copy": "PWA install copy — install-sheet journey covered by ui-pwa; effect not contracted yet (#094)",
+  "pwa-install-compact-copy":
+    "PWA compact phone proposition — visibility and geometry covered across target widths by ui-pwa",
+  "pwa-install-dismiss": "PWA install dismissal — target geometry covered by ui-pwa; effect not contracted yet (#094)",
+  "pwa-install-grip":
+    "PWA phone-sheet grip — responsive sheet journey covered by ui-pwa; effect not contracted yet (#094)",
+  "pwa-install-header":
+    "PWA install header — install-sheet journey covered by ui-pwa; effect not contracted yet (#094)",
+  "pwa-install-native-sheet":
+    "selector scope for browser-native install prompts; descendant compact-card effects are covered by ui-pwa",
+  "pwa-install-steps":
+    "PWA manual-install steps — install-sheet journey covered by ui-pwa; effect not contracted yet (#094)",
+  "pwa-install-support":
+    "PWA install support copy — install-sheet journey covered by ui-pwa; effect not contracted yet (#094)",
+  "pwa-install-tagline":
+    "PWA install tagline — install-sheet journey covered by ui-pwa; effect not contracted yet (#094)",
+  "pwa-notice-card":
+    "PWA notice card — motion and forced-colors fallbacks covered by ui-pwa; effect not contracted yet (#094)",
+
   // Selector scopes, not effects. `.mode-nav` carries the density-profile/query
   // container context, while `.mode-nav__more` scopes the overflow slot's rules.
   // Neither class receives a visual declaration from these selectors; the
diff --git a/tests/in-page-nav-playwright-contract.test.ts b/tests/in-page-nav-playwright-contract.test.ts
index d2c0e06193..15722a8c89 100644
--- a/tests/in-page-nav-playwright-contract.test.ts
+++ b/tests/in-page-nav-playwright-contract.test.ts
@@ -1,6 +1,8 @@
 import { readFileSync } from "node:fs";
 import { describe, expect, it } from "vitest";
 
+import { sourceSegment } from "./helpers/source-contract";
+
 /**
  * Guards the Production UI failures that blocked PR #1781:
  *
@@ -20,9 +22,11 @@ const IN_PAGE_NAV_HEADER = "src/components/in-page-nav/in-page-nav-header.tsx";
 describe("in-page-nav Playwright contract", () => {
   it("prescribing smoke asserts the aria-label back name on both desktop and phone", () => {
     const source = readFileSync(UI_SMOKE, "utf8");
-    const prescribingBlock = source.slice(
-      source.indexOf('test("prescribing workflow uses in-app medication routes'),
-      source.indexOf('test("tablet document chrome keeps one new-chat action'),
+    const prescribingBlock = sourceSegment(
+      source,
+      'test("prescribing workflow uses in-app medication routes',
+      'test("tablet document chrome keeps one new-chat action',
+      { label: "prescribing smoke" },
     );
 
     expect(prescribingBlock).toContain('name: "Back to medications"');
@@ -36,9 +40,11 @@ describe("in-page-nav Playwright contract", () => {
     // Medications exact inside medication-page-*; the back control lives in
     // MedicationNavHeader with aria-label "Back to medications".
     const source = readFileSync(UI_SMOKE, "utf8");
-    const quickLinksBlock = source.slice(
-      source.indexOf('test("answer results surface cross-mode quick links"'),
-      source.indexOf('test("answer mode keeps prior turns visible for follow-up questions"'),
+    const quickLinksBlock = sourceSegment(
+      source,
+      'test("answer results surface cross-mode quick links"',
+      'test("answer mode keeps prior turns visible for follow-up questions"',
+      { label: "answer cross-mode quick-links smoke" },
     );
 
     expect(quickLinksBlock).toContain('name: "Back to medications"');
diff --git a/tests/in-page-nav-route-sections.dom.test.tsx b/tests/in-page-nav-route-sections.dom.test.tsx
index 8dc068d1c2..e841379caf 100644
--- a/tests/in-page-nav-route-sections.dom.test.tsx
+++ b/tests/in-page-nav-route-sections.dom.test.tsx
@@ -484,6 +484,24 @@ describe("in-page navigation panel-swap contracts", () => {
     expect(within(rail).getByRole("button", { name: /^Safety/ })).toHaveAttribute("aria-current", "true");
   });
 
+  it("opens every card when a medication category becomes active", async () => {
+    const user = userEvent.setup();
+    render(<MedicationRecordPage slug={medication!.slug} fallbackRecord={medication!} />);
+    const rail = screen.getByTestId("medication-section-rail");
+
+    for (const section of medicationNavSections) {
+      await user.click(within(rail).getByRole("button", { name: new RegExp(`^${section.label}`) }));
+      const panel = document.querySelector<HTMLElement>(`#medication-panel-${CSS.escape(section.id)}`);
+      const cards = Array.from(panel?.querySelectorAll<HTMLDetailsElement>(":scope > details") ?? []);
+
+      expect(cards.length, `the "${section.id}" panel renders no cards`).toBeGreaterThan(0);
+      expect(
+        cards.every((card) => card.open),
+        `the "${section.id}" panel contains a folded card`,
+      ).toBe(true);
+    }
+  });
+
   it("offers no dead segment: every declared tab holds at least one section", () => {
     // The track always draws four segments, so a tab that could never hold
     // content would be a permanently empty destination. This pins the grouping
diff --git a/tests/issues-report.test.ts b/tests/issues-report.test.ts
index 0484b5ebca..f73b24b41b 100644
--- a/tests/issues-report.test.ts
+++ b/tests/issues-report.test.ts
@@ -120,12 +120,12 @@ describe("issues report", () => {
       "| Order | ID(s) | Acuity | Capability | When | Estimate | Outcome, gate, verification, and stopping condition |",
       "| ----: | ---- | ---- | ---- | ---- | ---- | ---- |",
       "| 1 | `#001` | A1 | Operator | Now | 1 hour | Live action |",
-      "| 2 | `#002` | A2 | Standard | Next | 30 min | Offline guard |",
+      "| 2 | `#ABCDEF` | A2 | Standard | Next | 30 min | Offline guard |",
       "## Open items",
       "| ID | Pri | Type | Summary | Detail / next action | Source | Added |",
       "| ---- | --- | ---- | ---- | ---- | ---- | ---- |",
       "| #001 | P1 | task | urgent | detail | src | 2026-01-01 |",
-      "| #002 | P2 | task | safe | detail | src | 2026-01-01 |",
+      "| #ABCDEF <!-- issue-ulid:0000000000ABCDEF0000000000 --> | P2 | task | safe | detail | src | 2026-01-01 |",
       "## Resolved / archive",
       "| ID | Type | Summary | Outcome | Resolved |",
       "| ---- | ---- | ---- | ---- | ---- |",
@@ -134,7 +134,8 @@ describe("issues report", () => {
     const report = buildIssuesReport(markdown, { ref: "origin/main", revalidated: true });
     expect(report.counts).toEqual({ open: 2, recommended: 2 });
     expect(report.priorityBlockers[0].ids).toEqual(["#001"]);
-    expect(report.agentSafeWins.map((row: { ids: string[] }) => row.ids[0])).toEqual(["#002"]);
+    expect(report.agentSafeWins.map((row: { ids: string[] }) => row.ids[0])).toEqual(["#ABCDEF"]);
+    expect(report.open[1].id).toBe("#ABCDEF");
     expect(report.open[0].added).toBe("2026-01-01");
   });
 
diff --git a/tests/ledger-inbox-cancellation.test.ts b/tests/ledger-inbox-cancellation.test.ts
new file mode 100644
index 0000000000..06948733c6
--- /dev/null
+++ b/tests/ledger-inbox-cancellation.test.ts
@@ -0,0 +1,113 @@
+import { describe, expect, it } from "vitest";
+
+import { planRequestBatch } from "../scripts/ledger-inbox.mjs";
+
+const UPDATE_ID = "11111111-1111-4111-8111-111111111111";
+const CANCEL_ID = "22222222-2222-4222-8222-222222222222";
+const APPLIED_ID = "33333333-3333-4333-8333-333333333333";
+const UNKNOWN_ID = "44444444-4444-4444-8444-444444444444";
+
+function update(id: string, issueId = "#316") {
+  return {
+    version: 1,
+    id,
+    createdOn: "2026-08-14",
+    action: "update",
+    payload: { id: issueId, detail: `detail for ${issueId}` },
+  };
+}
+
+function cancel(id: string, requestId: string) {
+  return {
+    version: 1,
+    id,
+    createdOn: "2026-08-14",
+    action: "cancel",
+    payload: { requestId, reason: "superseded" },
+  };
+}
+
+// planRequestBatch reads the applied directory itself by default; every test here
+// injects the requests so the assertions do not depend on the repo's real inbox.
+function plan(requests: object[], appliedRequests: ReturnType<typeof update | typeof cancel>[] = []) {
+  const warnings: string[] = [];
+  const result = planRequestBatch(requests, {
+    appliedRequests: new Map(appliedRequests.map((request) => [request.id, request])),
+    warn: (message: string) => warnings.push(message),
+  });
+  return { ...result, warnings };
+}
+
+describe("ledger inbox cancellation planning", () => {
+  it("cancels a pending request in the same batch", () => {
+    const result = plan([update(UPDATE_ID), cancel(CANCEL_ID, UPDATE_ID)]);
+
+    expect(result.active).toHaveLength(0);
+    expect(result.cancelledIds).toEqual([UPDATE_ID]);
+    expect(result.cancellations).toEqual([{ requestId: CANCEL_ID, targetId: UPDATE_ID, reason: "superseded" }]);
+    expect(result.warnings).toHaveLength(0);
+    expect(result.ineffectiveCancellations).toHaveLength(0);
+  });
+
+  // The race this exists for: another branch reconciled first and applied the
+  // target, so this cancellation can no longer take effect. Throwing here wedges
+  // check:docs-links, check:ledger-write-discipline and reconcile at once, with no
+  // legal way out because write discipline forbids deleting the queued request.
+  it("does not throw when the cancelled target was already applied elsewhere", () => {
+    const result = plan([update(UPDATE_ID), cancel(CANCEL_ID, APPLIED_ID)], [update(APPLIED_ID)]);
+
+    expect(result.active).toHaveLength(1);
+    expect(result.cancelledIds).toHaveLength(0);
+    expect(result.ineffectiveCancellations).toEqual([{ requestId: CANCEL_ID, targetId: APPLIED_ID }]);
+  });
+
+  it("says loudly that an already-applied cancellation changed nothing", () => {
+    const result = plan([cancel(CANCEL_ID, APPLIED_ID)], [update(APPLIED_ID)]);
+
+    expect(result.warnings).toHaveLength(1);
+    expect(result.warnings[0]).toContain(CANCEL_ID);
+    expect(result.warnings[0]).toContain(APPLIED_ID);
+    expect(result.warnings[0]).toContain("did not take effect");
+    // The operator must be told to fix the row another way, not left assuming the
+    // cancellation did its job.
+    expect(result.warnings[0]).toContain("new update request");
+  });
+
+  it("still throws when the target never existed", () => {
+    expect(() => plan([cancel(CANCEL_ID, UNKNOWN_ID)], [update(APPLIED_ID)])).toThrow(
+      /targets missing pending request/,
+    );
+  });
+
+  it("still refuses to cancel another cancellation", () => {
+    expect(() => plan([update(UPDATE_ID), cancel(CANCEL_ID, UPDATE_ID), cancel(APPLIED_ID, CANCEL_ID)])).toThrow(
+      /cannot cancel another cancellation/,
+    );
+  });
+
+  it("still refuses to cancel a cancellation that was already applied", () => {
+    expect(() => plan([cancel(CANCEL_ID, APPLIED_ID)], [cancel(APPLIED_ID, UPDATE_ID)])).toThrow(
+      /cannot cancel another cancellation/,
+    );
+  });
+
+  it("still refuses to cancel the same request twice", () => {
+    expect(() => plan([update(UPDATE_ID), cancel(CANCEL_ID, UPDATE_ID), cancel(APPLIED_ID, UPDATE_ID)])).toThrow(
+      /cancelled more than once/,
+    );
+  });
+
+  it("keeps requiring a decision when two mutations target one row", () => {
+    expect(() => plan([update(UPDATE_ID), update(CANCEL_ID)])).toThrow(
+      /multiple pending mutations require an explicit cancellation decision/,
+    );
+  });
+
+  it("an ineffective cancellation does not resolve a competing-mutation conflict", () => {
+    // The cancellation lost its race, so both updates are still active and the
+    // conflict must still be raised rather than silently half-applied.
+    expect(() =>
+      plan([update(UPDATE_ID), update(CANCEL_ID), cancel(UNKNOWN_ID, APPLIED_ID)], [update(APPLIED_ID)]),
+    ).toThrow(/multiple pending mutations require an explicit cancellation decision/);
+  });
+});
diff --git a/tests/ledger-write-discipline.test.ts b/tests/ledger-write-discipline.test.ts
new file mode 100644
index 0000000000..1a5bbf64bb
--- /dev/null
+++ b/tests/ledger-write-discipline.test.ts
@@ -0,0 +1,69 @@
+import { describe, expect, it } from "vitest";
+
+import { dirtyGovernedPaths } from "../scripts/check-ledger-write-discipline.mjs";
+
+const ISSUES = "docs/outstanding-issues.md";
+const REVIEW = "docs/branch-review-ledger.md";
+const INBOX = "docs/outstanding-issues-inbox";
+const REQUEST = `${INBOX}/829597d4-698b-4cc2-9bf4-65310504cba3.json`;
+
+/** `git status --porcelain=v1 -z` emits NUL-terminated records, not lines. */
+const porcelain = (...records: string[]) => `${records.join("\0")}\0`;
+
+describe("ledger write discipline dirty-tree guard", () => {
+  it("reports nothing for a clean worktree", () => {
+    expect(dirtyGovernedPaths("")).toEqual([]);
+    expect(dirtyGovernedPaths(porcelain())).toEqual([]);
+  });
+
+  it("flags an uncommitted edit to the canonical ledger", () => {
+    // The #313 defect: both audit endpoints are commits, so this edit is
+    // invisible to the range and the gate used to print a pass over it.
+    const dirty = dirtyGovernedPaths(porcelain(` M ${ISSUES}`));
+    expect(dirty).toHaveLength(1);
+    expect(dirty[0].path).toBe(ISSUES);
+    expect(dirty[0].reason).toContain("uncommitted change");
+  });
+
+  it("does not shift paths when the status field's first column is a space", () => {
+    // An unstaged change is " M path". Trimming the porcelain output eats that
+    // leading space and slices one character off every path, which silently
+    // stops the governed-path match from ever firing.
+    expect(dirtyGovernedPaths(porcelain(` M ${ISSUES}`))[0].path).toBe(ISSUES);
+    expect(dirtyGovernedPaths(porcelain(`M  ${ISSUES}`))[0].path).toBe(ISSUES);
+    expect(dirtyGovernedPaths(porcelain(`MM ${ISSUES}`))[0].path).toBe(ISSUES);
+  });
+
+  it("flags an untracked inbox request and the frozen review ledger", () => {
+    expect(dirtyGovernedPaths(porcelain(`?? ${REQUEST}`))).toEqual([
+      { path: REQUEST, status: "??", reason: "an outstanding-issues inbox request is untracked" },
+    ]);
+    expect(dirtyGovernedPaths(porcelain(` M ${REVIEW}`))[0].reason).toContain("branch-review ledger");
+  });
+
+  it("reports both sides of a rename record", () => {
+    // Porcelain follows an R/C record with a second NUL field holding the origin.
+    const dirty = dirtyGovernedPaths(porcelain(`R  ${INBOX}/applied/a.json`, `${INBOX}/a.json`));
+    expect(dirty.map((entry) => entry.path)).toEqual([`${INBOX}/applied/a.json`, `${INBOX}/a.json`]);
+  });
+
+  it("consumes the rename origin field rather than reading it as a record", () => {
+    const dirty = dirtyGovernedPaths(porcelain(`R  ${INBOX}/applied/a.json`, `${INBOX}/a.json`, ` M ${ISSUES}`));
+    expect(dirty.map((entry) => entry.path)).toEqual([`${INBOX}/applied/a.json`, `${INBOX}/a.json`, ISSUES]);
+  });
+
+  it("ignores dirty files the gate does not govern", () => {
+    // The gate must not fail an ordinary product change; only ledger paths make
+    // its committed-range verdict meaningless.
+    expect(dirtyGovernedPaths(porcelain(" M src/lib/rag/rag.ts", "?? scratch.txt", " M package.json"))).toEqual([]);
+  });
+
+  it("does not treat a lookalike path outside the inbox as governed", () => {
+    expect(dirtyGovernedPaths(porcelain(" M docs/outstanding-issues-inbox-notes.md"))).toEqual([]);
+    expect(dirtyGovernedPaths(porcelain(" M docs/outstanding-issues.md.bak"))).toEqual([]);
+  });
+
+  it("reports each governed path once", () => {
+    expect(dirtyGovernedPaths(porcelain(` M ${ISSUES}`, `MM ${ISSUES}`))).toHaveLength(1);
+  });
+});
diff --git a/tests/live-drift-workflow.test.ts b/tests/live-drift-workflow.test.ts
new file mode 100644
index 0000000000..66c3ac8ef5
--- /dev/null
+++ b/tests/live-drift-workflow.test.ts
@@ -0,0 +1,311 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { describe, expect, it } from "vitest";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const workflowPath = path.join(repoRoot, ".github", "workflows", "live-drift.yml");
+const workflow = readFileSync(workflowPath, "utf8").replace(/\r\n/g, "\n");
+
+type Issue = { number: number; title: string };
+type RepositoryCoordinates = { owner: string; repo: string };
+
+type ScriptFunction = (
+  github: Record<string, unknown>,
+  context: Record<string, unknown>,
+  core: {
+    info: (message: string) => void;
+    warning: (message: string) => void;
+  },
+) => Promise<void>;
+
+const AsyncFunction = Object.getPrototypeOf(async () => undefined).constructor as new (
+  ...args: string[]
+) => ScriptFunction;
+
+// Same extraction shape as tests/codex-autofix-workflow.test.ts: the block is
+// `script: |` at ten spaces, so its body is everything indented twelve or more.
+function extractWorkflowScripts(source: string) {
+  const scriptMarker = "          script: |\n";
+  const scripts: string[] = [];
+  let searchFrom = 0;
+
+  while (true) {
+    const scriptStart = source.indexOf(scriptMarker, searchFrom);
+    if (scriptStart === -1) break;
+
+    const scriptLines = source.slice(scriptStart + scriptMarker.length).split("\n");
+    const extractedLines: string[] = [];
+
+    for (const line of scriptLines) {
+      if (line.length === 0) {
+        extractedLines.push("");
+        continue;
+      }
+      if (!line.startsWith("            ")) break;
+      extractedLines.push(line.slice(12));
+    }
+
+    scripts.push(extractedLines.join("\n"));
+    searchFrom = scriptStart + scriptMarker.length;
+  }
+
+  return scripts;
+}
+
+const [routingScriptSource, ...extraScripts] = extractWorkflowScripts(workflow);
+if (!routingScriptSource) {
+  throw new Error("Expected a github-script block for drift routing in .github/workflows/live-drift.yml.");
+}
+if (extraScripts.length > 0) {
+  throw new Error("Expected exactly one github-script block in live-drift.yml; update this test if that changes.");
+}
+
+const routingScript = new AsyncFunction("github", "context", "core", routingScriptSource);
+
+type Calls = {
+  closed: Array<RepositoryCoordinates & { issue_number: number; state?: string; state_reason?: string }>;
+  comments: Array<RepositoryCoordinates & { issue_number: number; body: string }>;
+  created: Array<RepositoryCoordinates & { title: string; labels: string[]; body: string }>;
+  listed: Array<RepositoryCoordinates & { labels: string; state: string }>;
+  updatedBodies: Array<RepositoryCoordinates & { issue_number: number; body: string }>;
+  warnings: string[];
+};
+
+async function runRoutingScript(options: { findings?: string; openIssues?: Issue[]; result: string }) {
+  const calls: Calls = { closed: [], comments: [], created: [], listed: [], updatedBodies: [], warnings: [] };
+
+  const github = {
+    rest: {
+      issues: {
+        create: async (request: RepositoryCoordinates & { body: string; labels: string[]; title: string }) => {
+          calls.created.push({
+            body: request.body,
+            labels: request.labels,
+            owner: request.owner,
+            repo: request.repo,
+            title: request.title,
+          });
+          return { data: { number: 4242 } };
+        },
+        createComment: async (request: RepositoryCoordinates & { body: string; issue_number: number }) => {
+          calls.comments.push({
+            body: request.body,
+            issue_number: request.issue_number,
+            owner: request.owner,
+            repo: request.repo,
+          });
+        },
+        listForRepo: async (request: RepositoryCoordinates & { labels: string; state: string }) => {
+          calls.listed.push({ labels: request.labels, owner: request.owner, repo: request.repo, state: request.state });
+          return { data: options.openIssues ?? [] };
+        },
+        update: async (
+          request: RepositoryCoordinates & {
+            body?: string;
+            issue_number: number;
+            state?: string;
+            state_reason?: string;
+          },
+        ) => {
+          if (request.state) {
+            calls.closed.push({
+              issue_number: request.issue_number,
+              owner: request.owner,
+              repo: request.repo,
+              state: request.state,
+              state_reason: request.state_reason,
+            });
+          }
+          if (typeof request.body === "string") {
+            calls.updatedBodies.push({
+              body: request.body,
+              issue_number: request.issue_number,
+              owner: request.owner,
+              repo: request.repo,
+            });
+          }
+        },
+      },
+    },
+  };
+
+  const context = {
+    eventName: "schedule",
+    repo: { owner: "BigSimmo", repo: "Database" },
+    runId: 99,
+    serverUrl: "https://github.com",
+  };
+
+  const core = {
+    info: () => undefined,
+    warning: (message: string) => {
+      calls.warnings.push(message);
+    },
+  };
+
+  const previous = { findings: process.env.DRIFT_FINDINGS, result: process.env.DRIFT_RESULT };
+  process.env.DRIFT_RESULT = options.result;
+  process.env.DRIFT_FINDINGS = options.findings ?? "";
+  try {
+    await routingScript(github, context, core);
+  } finally {
+    if (previous.result === undefined) delete process.env.DRIFT_RESULT;
+    else process.env.DRIFT_RESULT = previous.result;
+    if (previous.findings === undefined) delete process.env.DRIFT_FINDINGS;
+    else process.env.DRIFT_FINDINGS = previous.findings;
+  }
+
+  return calls;
+}
+
+const pinnedIssue: Issue = { number: 1234, title: "Live drift check failing" };
+const sampleFindings = "UNEXPECTED DRIFT (2):\n  ! [indexes] missing_live documents_title_trgm_idx";
+const repositoryCoordinates = { owner: "BigSimmo", repo: "Database" };
+
+function workflowJobPermissionMaps(source: string) {
+  const jobsStart = source.indexOf("jobs:\n");
+  if (jobsStart < 0) throw new Error("Expected a jobs map in .github/workflows/live-drift.yml.");
+
+  const jobsSection = source.slice(jobsStart);
+  const jobHeaders = [...jobsSection.matchAll(/^  ([a-z][\w-]*):$/gm)];
+  const jobs = Object.fromEntries(
+    jobHeaders.map((header, index) => {
+      const bodyStart = (header.index ?? 0) + header[0].length + 1;
+      const bodyEnd = jobHeaders[index + 1]?.index ?? jobsSection.length;
+      const body = jobsSection.slice(bodyStart, bodyEnd);
+      const permissions = Object.fromEntries(
+        [...body.matchAll(/^    permissions:\n((?:      [^\n]+\n?)*)/gm)].flatMap((permissionsMatch) =>
+          [...permissionsMatch[1].matchAll(/^      ([\w-]+): ([\w-]+)$/gm)].map((entry) => [entry[1], entry[2]]),
+        ),
+      );
+      return [header[1], { permissions }];
+    }),
+  );
+
+  return { jobs };
+}
+
+describe("live-drift workflow triggers and privileges", () => {
+  it("keeps the weekly schedule and manual dispatch", () => {
+    expect(workflow).toContain("workflow_dispatch:");
+    expect(workflow).toContain('- cron: "30 18 * * 0"');
+  });
+
+  it("also runs once a schema change reaches main, and never on pull requests", () => {
+    expect(workflow).toContain("branches: [main]");
+    expect(workflow).toContain('- "supabase/migrations/**"');
+    expect(workflow).toContain('- "supabase/schema.sql"');
+    expect(workflow).not.toMatch(/^on:[\s\S]*?^\s{2}pull_request/m);
+  });
+
+  it("never cancels an in-flight drift run", () => {
+    expect(workflow).toContain("group: live-drift-check");
+    expect(workflow).toContain("cancel-in-progress: false");
+  });
+
+  it("keeps the secret preflight so a missing key fails loudly rather than silently passing", () => {
+    expect(workflow).toContain("Preflight required secrets");
+    expect(workflow).toContain("Live drift check cannot run - missing repo secrets:");
+  });
+
+  it("grants issues: write only to the routing job", () => {
+    // Workflow-level permissions stay read-only, so no job inherits issue writes.
+    expect(workflow).toMatch(/^permissions:\n {2}contents: read\n/m);
+
+    const parsed = workflowJobPermissionMaps(workflow);
+    expect(parsed.jobs["drift-routing"]?.permissions).toEqual({ contents: "read", issues: "write" });
+    for (const [jobName, job] of Object.entries(parsed.jobs)) {
+      if (jobName !== "drift-routing") expect(job.permissions.issues).toBeUndefined();
+    }
+  });
+
+  it("keeps the service-role key out of the job that can write issues", () => {
+    const routingStart = workflow.indexOf("  drift-routing:");
+    expect(workflow.slice(routingStart)).not.toContain("SUPABASE_SERVICE_ROLE_KEY");
+  });
+
+  it("pins github-script to the reviewed immutable commit", () => {
+    expect(workflow).toContain("uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0");
+  });
+
+  it("captures findings even when the drift step failed", () => {
+    expect(workflow).toContain("set -o pipefail");
+    expect(workflow).toMatch(/id: findings\n\s+if: always\(\)/);
+  });
+
+  it("still routes when the drift job fails", () => {
+    expect(workflow).toContain("if: ${{ !cancelled() }}");
+  });
+});
+
+describe("live-drift failure routing", () => {
+  it("opens one labelled issue when the check fails and none is open", async () => {
+    const calls = await runRoutingScript({ findings: sampleFindings, result: "failure" });
+
+    expect(calls.listed).toEqual([{ ...repositoryCoordinates, labels: "live-drift-failure", state: "open" }]);
+    expect(calls.created).toHaveLength(1);
+    expect(calls.created[0].title).toBe("Live drift check failing");
+    expect(calls.created[0].labels).toEqual(["live-drift-failure"]);
+    expect(calls.created[0]).toMatchObject(repositoryCoordinates);
+    expect(calls.created[0].body).toContain("https://github.com/BigSimmo/Database/actions/runs/99");
+    expect(calls.created[0].body).toContain("documents_title_trgm_idx");
+    expect(calls.closed).toHaveLength(0);
+  });
+
+  it("updates the same issue on a repeat failure instead of stacking a second one", async () => {
+    const calls = await runRoutingScript({
+      findings: sampleFindings,
+      openIssues: [pinnedIssue],
+      result: "failure",
+    });
+
+    expect(calls.created).toHaveLength(0);
+    expect(calls.updatedBodies).toEqual([expect.objectContaining({ ...repositoryCoordinates, issue_number: 1234 })]);
+    expect(calls.comments).toHaveLength(1);
+    expect(calls.comments[0].issue_number).toBe(1234);
+    expect(calls.comments[0]).toMatchObject(repositoryCoordinates);
+    expect(calls.comments[0].body).toContain("Still failing");
+    expect(calls.closed).toHaveLength(0);
+    expect(calls.warnings.join(" ")).toContain("1234");
+  });
+
+  it("does not present a run that died before the comparison as a clean schema", async () => {
+    const calls = await runRoutingScript({ findings: "", result: "failure" });
+
+    expect(calls.created).toHaveLength(1);
+    expect(calls.created[0]).toMatchObject(repositoryCoordinates);
+    expect(calls.created[0].body).toContain("not** evidence of a clean schema");
+    expect(calls.created[0].body).not.toContain("UNEXPECTED DRIFT");
+  });
+
+  it("comments the resolution and closes the issue on the next green run", async () => {
+    const calls = await runRoutingScript({ openIssues: [pinnedIssue], result: "success" });
+
+    expect(calls.comments).toHaveLength(1);
+    expect(calls.comments[0].body).toContain("Resolved");
+    expect(calls.comments[0].body).toContain("https://github.com/BigSimmo/Database/actions/runs/99");
+    expect(calls.closed).toEqual([
+      { ...repositoryCoordinates, issue_number: 1234, state: "closed", state_reason: "completed" },
+    ]);
+    expect(calls.created).toHaveLength(0);
+    expect(calls.listed).toEqual([{ ...repositoryCoordinates, labels: "live-drift-failure", state: "open" }]);
+  });
+
+  it("writes nothing when the check is green and no issue is open", async () => {
+    const calls = await runRoutingScript({ result: "success" });
+
+    expect(calls.created).toHaveLength(0);
+    expect(calls.comments).toHaveLength(0);
+    expect(calls.closed).toHaveLength(0);
+    expect(calls.updatedBodies).toHaveLength(0);
+  });
+
+  it("treats an unknown job result as a failure rather than closing the issue", async () => {
+    const calls = await runRoutingScript({ openIssues: [pinnedIssue], result: "" });
+
+    expect(calls.closed).toHaveLength(0);
+    expect(calls.updatedBodies).toEqual([expect.objectContaining({ ...repositoryCoordinates, issue_number: 1234 })]);
+  });
+});
diff --git a/tests/medication-prescribing-workspace.dom.test.tsx b/tests/medication-prescribing-workspace.dom.test.tsx
index d646daf118..d9037e53e0 100644
--- a/tests/medication-prescribing-workspace.dom.test.tsx
+++ b/tests/medication-prescribing-workspace.dom.test.tsx
@@ -142,6 +142,14 @@ describe("MedicationPrescribingWorkspace — home vs submitted results", () => {
     expect(screen.queryByTestId("medication-home")).not.toBeInTheDocument();
     expect(screen.getAllByTestId("medication-result-clozapine-desktop").length).toBeGreaterThan(0);
   });
+
+  it("uses concise, interval-safe dose labels", () => {
+    renderWorkspace({ showHome: false });
+    expect(screen.getByText("Usual dose")).toBeInTheDocument();
+    expect(screen.getByText("Max dose")).toBeInTheDocument();
+    expect(screen.getAllByText("Max").length).toBeGreaterThan(0);
+    expect(screen.queryByText("Ceiling")).not.toBeInTheDocument();
+  });
 });
 
 describe("MedicationPrescribingWorkspace — query interpretation", () => {
diff --git a/tests/merge-loss-audit.test.ts b/tests/merge-loss-audit.test.ts
new file mode 100644
index 0000000000..c2078bc741
--- /dev/null
+++ b/tests/merge-loss-audit.test.ts
@@ -0,0 +1,292 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  classifyMergeLoss,
+  classifyRemoval,
+  isReconciliationMove,
+  parseLogEntries,
+  parsePullNumber,
+  parseTreeEntry,
+} from "../scripts/audit-merge-loss.mjs";
+
+const INBOX = "docs/outstanding-issues-inbox";
+
+/** Tree-entry table keyed `<ref>:<path>`; a missing key means the path does not exist. */
+const reader = (blobs: Record<string, string>) => (ref: string, file: string) => blobs[`${ref}:${file}`] ?? null;
+
+const landing = (pullNumber: number, files: string[]) => ({
+  sha: `sha${pullNumber}`,
+  date: "2026-08-11T00:00:00+00:00",
+  subject: `subject (#${pullNumber})`,
+  pullNumber,
+  preRef: "pre",
+  files,
+});
+
+describe("merge-loss subject parsing", () => {
+  it("reads a merge landing", () => {
+    expect(parsePullNumber("Merge pull request #1935 from BigSimmo/codex/fix-ecg")).toBe(1935);
+  });
+
+  it("reads a squash landing", () => {
+    expect(parsePullNumber("ci: speed iteration without weakening gates (#1926)")).toBe(1926);
+  });
+
+  it("prefers the trailing number when the subject also cites an issue", () => {
+    // GitHub appends the PR number, so the last parenthesised number wins.
+    expect(parsePullNumber("docs(issues): close #170 and (#309) partially (#1925)")).toBe(1925);
+  });
+
+  it("returns undefined for a commit that is not a pull request landing", () => {
+    expect(parsePullNumber("Merge branch 'main' into claude/feature")).toBeUndefined();
+    expect(parsePullNumber("wip")).toBeUndefined();
+    expect(parsePullNumber("")).toBeUndefined();
+  });
+
+  it("parses tab-delimited log lines and keeps a subject containing tabs", () => {
+    const entries = parseLogEntries("abc\t2026-08-14T06:00:11+08:00\tfix: thing\there (#12)\n\n");
+    expect(entries).toHaveLength(1);
+    expect(entries[0]).toMatchObject({ sha: "abc", pullNumber: 12 });
+    expect(entries[0].subject).toBe("fix: thing\there (#12)");
+  });
+});
+
+describe("merge-loss classification", () => {
+  it("does not flag a file whose change is still present", () => {
+    const entryAt = reader({ "pre:kept.ts": "aaa", "head:kept.ts": "bbb" });
+    expect(classifyMergeLoss({ ref: "head", entryAt, landings: [landing(1, ["kept.ts"])] }).findings).toEqual([]);
+  });
+
+  it("flags a file that reverted to its pre-merge blob", () => {
+    // The acf78bf case: the landing's contribution to this file is gone.
+    const entryAt = reader({ "pre:lost.ts": "ccc", "head:lost.ts": "ccc" });
+    const { findings } = classifyMergeLoss({ ref: "head", entryAt, landings: [landing(1803, ["lost.ts"])] });
+    expect(findings).toHaveLength(1);
+    expect(findings[0].pullNumber).toBe(1803);
+    expect(findings[0].revertedFiles).toEqual([{ file: "lost.ts", absent: false }]);
+  });
+
+  it("flags a file the pull request added that is absent again", () => {
+    // Absent before and absent now: the addition was undone.
+    const { findings } = classifyMergeLoss({ ref: "head", entryAt: reader({}), landings: [landing(1, ["added.ts"])] });
+    expect(findings[0].revertedFiles).toEqual([{ file: "added.ts", absent: true }]);
+  });
+
+  it("does not flag a deletion that survived", () => {
+    // Present before, absent now — the pull request deleted it and it stayed deleted.
+    const entryAt = reader({ "pre:removed.ts": "ddd" });
+    expect(classifyMergeLoss({ ref: "head", entryAt, landings: [landing(1, ["removed.ts"])] }).findings).toEqual([]);
+  });
+
+  it("does not flag a surviving mode-only change", () => {
+    const entryAt = reader({
+      "pre:script.sh": "100644 blob aaa",
+      "head:script.sh": "100755 blob aaa",
+    });
+    expect(classifyMergeLoss({ ref: "head", entryAt, landings: [landing(1, ["script.sh"])] }).findings).toEqual([]);
+  });
+
+  it("skips commits with no pull request number instead of dropping them silently", () => {
+    const result = classifyMergeLoss({
+      ref: "head",
+      entryAt: reader({}),
+      landings: [
+        { sha: "x", date: "d", subject: "Merge branch 'main'", pullNumber: undefined, preRef: "pre", files: [] },
+      ],
+    });
+    expect(result.findings).toEqual([]);
+    expect(result.skipped).toHaveLength(1);
+    expect(result.scannedLandings).toBe(0);
+  });
+
+  it("orders findings by how much of the landing is missing", () => {
+    const entryAt = reader({ "pre:a.ts": "1", "head:a.ts": "1", "pre:b.ts": "2", "head:b.ts": "2" });
+    const { findings } = classifyMergeLoss({
+      ref: "head",
+      entryAt,
+      landings: [landing(10, ["a.ts"]), landing(20, ["a.ts", "b.ts"])],
+    });
+    expect(findings.map((finding) => finding.pullNumber)).toEqual([20, 10]);
+  });
+});
+
+describe("merge-loss reconciliation exemption", () => {
+  const request = `${INBOX}/11111111-1111-4111-8111-111111111111.json`;
+  const applied = `${INBOX}/applied/11111111-1111-4111-8111-111111111111.json`;
+
+  it("does not report an inbox request that reconcile moved to applied/", () => {
+    // issues:reconcile moves the request verbatim; that is its lifecycle, not a loss.
+    const result = classifyMergeLoss({
+      ref: "head",
+      entryAt: reader({ [`sha1915:${request}`]: "100644 blob eee", [`head:${applied}`]: "100644 blob eee" }),
+      landings: [landing(1915, [request])],
+    });
+    expect(result.findings).toEqual([]);
+    expect(result.filesExempted).toBe(1);
+  });
+
+  it("still reports an inbox request that vanished without an audit record", () => {
+    // No applied/ counterpart means the request was genuinely lost.
+    const result = classifyMergeLoss({ ref: "head", entryAt: reader({}), landings: [landing(1915, [request])] });
+    expect(result.findings).toHaveLength(1);
+    expect(result.filesExempted).toBe(0);
+  });
+
+  it("credits only a verbatim move to the matching request filename", () => {
+    const entryAt = reader({ [`landing:${request}`]: "100644 blob eee", [`head:${applied}`]: "100644 blob eee" });
+    expect(isReconciliationMove(request, "landing", "head", entryAt)).toBe(true);
+    expect(isReconciliationMove(`${INBOX}/22222222-2222-4222-8222-222222222222.json`, "landing", "head", entryAt)).toBe(
+      false,
+    );
+    expect(isReconciliationMove("src/lib/rag/rag.ts", "landing", "head", entryAt)).toBe(false);
+    expect(isReconciliationMove(applied, "landing", "head", entryAt)).toBe(false);
+  });
+
+  it("reports a missing request when its applied record has different contents", () => {
+    const result = classifyMergeLoss({
+      ref: "head",
+      entryAt: reader({ [`sha1915:${request}`]: "100644 blob original", [`head:${applied}`]: "100644 blob changed" }),
+      landings: [landing(1915, [request])],
+    });
+    expect(result.findings).toHaveLength(1);
+    expect(result.filesExempted).toBe(0);
+  });
+
+  it("exempts a reconciled request when entries come from real ls-tree output", () => {
+    // The guard the `"\\t"` bug needed. Every other test in this file injects bare
+    // entries, which compare equal whether or not the path was stripped; only a
+    // realistic entry exposes a cross-path comparison that can never match.
+    const lsTree = (file: string) => parseTreeEntry(`100644 blob eee\t${file}`);
+    const result = classifyMergeLoss({
+      ref: "head",
+      entryAt: reader({ [`sha1915:${request}`]: lsTree(request)!, [`head:${applied}`]: lsTree(applied)! }),
+      landings: [landing(1915, [request])],
+    });
+    expect(result.findings).toEqual([]);
+    expect(result.filesExempted).toBe(1);
+  });
+});
+
+describe("merge-loss tree-entry parsing", () => {
+  it("strips the path from an ls-tree line", () => {
+    // `<mode> SP <type> SP <oid> TAB <path>` — the separator is a real tab.
+    expect(parseTreeEntry("100644 blob aa5bc159018775a3ba075fa846ff4c1fda01e236\tpackage.json")).toBe(
+      "100644 blob aa5bc159018775a3ba075fa846ff4c1fda01e236",
+    );
+  });
+
+  it("gives two paths sharing a blob the same entry", () => {
+    // This is what the reconciliation exemption depends on.
+    const inbox = parseTreeEntry("100644 blob eee\tdocs/outstanding-issues-inbox/x.json");
+    const moved = parseTreeEntry("100644 blob eee\tdocs/outstanding-issues-inbox/applied/x.json");
+    expect(inbox).toBe(moved);
+  });
+
+  it("keeps a mode difference visible", () => {
+    expect(parseTreeEntry("100644 blob aaa\ts.sh")).not.toBe(parseTreeEntry("100755 blob aaa\ts.sh"));
+  });
+
+  it("treats a missing path as null", () => {
+    expect(parseTreeEntry(undefined)).toBeNull();
+    expect(parseTreeEntry("")).toBeNull();
+  });
+});
+
+describe("merge-loss removal mechanism", () => {
+  const walk = (commits: Array<{ sha: string; subject: string }>, merges: string[] = []) => ({
+    historyOf: () => commits,
+    entryAt: () => "pre-entry" as string | null,
+    isMergeCommit: (sha: string) => merges.includes(sha),
+  });
+  const base = { file: "lost.ts", landingSha: "s1", preEntry: "pre-entry", ref: "head" };
+
+  it("classifies a merge commit as a merge resolution", () => {
+    const removal = classifyRemoval({
+      ...base,
+      ...walk(
+        [{ sha: "acf78bf4", subject: "Merge remote-tracking branch 'origin/main' into probe2-1815" }],
+        ["acf78bf4"],
+      ),
+    });
+    expect(removal).toMatchObject({ mechanism: "merge-resolution", sha: "acf78bf4" });
+  });
+
+  it("classifies a single-parent commit as deliberate", () => {
+    const removal = classifyRemoval({
+      ...base,
+      ...walk([{ sha: "8ca147d5", subject: "ci: speed iteration without weakening gates (#1926)" }]),
+    });
+    expect(removal).toMatchObject({
+      mechanism: "deliberate-commit",
+      subject: "ci: speed iteration without weakening gates (#1926)",
+    });
+  });
+
+  it("blames the oldest matching commit, not a later one carrying the absence forward", () => {
+    const removal = classifyRemoval({
+      ...base,
+      historyOf: () => [
+        { sha: "culprit", subject: "Merge branch 'main'" },
+        { sha: "later", subject: "unrelated touch" },
+      ],
+      entryAt: () => "pre-entry",
+      isMergeCommit: (sha: string) => sha === "culprit",
+    });
+    expect(removal).toMatchObject({ mechanism: "merge-resolution", sha: "culprit" });
+  });
+
+  it("reports unknown rather than guessing when no commit matches the pre-merge entry", () => {
+    const removal = classifyRemoval({
+      ...base,
+      historyOf: () => [{ sha: "c1", subject: "something else" }],
+      entryAt: () => "a-different-entry",
+      isMergeCommit: () => false,
+    });
+    expect(removal.mechanism).toBe("unknown");
+    expect(removal.sha).toBeUndefined();
+  });
+
+  it("reports unknown for an empty history", () => {
+    expect(classifyRemoval({ ...base, ...walk([]) }).mechanism).toBe("unknown");
+  });
+});
+
+describe("merge-loss mechanism reporting", () => {
+  const entryAt = reader({ "pre:a.ts": "1", "head:a.ts": "1", "pre:b.ts": "2", "head:b.ts": "2" });
+
+  it("leaves the finding shape and order untouched when no mechanism reader is given", () => {
+    const result = classifyMergeLoss({ ref: "head", entryAt, landings: [landing(10, ["a.ts"])] });
+    expect(result.findings[0].revertedFiles).toEqual([{ file: "a.ts", absent: false }]);
+    expect(result.mechanismCounts).toEqual({ "merge-resolution": 0, "deliberate-commit": 0, unknown: 0 });
+  });
+
+  it("attaches the mechanism and counts it", () => {
+    const result = classifyMergeLoss({
+      ref: "head",
+      entryAt,
+      landings: [landing(10, ["a.ts"])],
+      removalOf: () => ({ mechanism: "merge-resolution", sha: "acf78bf4", subject: "Merge origin/main" }),
+    });
+    expect(result.findings[0].revertedFiles[0]).toMatchObject({
+      file: "a.ts",
+      removal: { mechanism: "merge-resolution", sha: "acf78bf4" },
+    });
+    expect(result.mechanismCounts["merge-resolution"]).toBe(1);
+  });
+
+  it("lists merge-resolution findings before larger deliberate ones", () => {
+    // #1800 lost 6 files to acf78bf; #1815 lost 47 to a re-land. The accidental
+    // case must not be buried under the bigger deliberate one.
+    const result = classifyMergeLoss({
+      ref: "head",
+      entryAt,
+      landings: [landing(1815, ["a.ts", "b.ts"]), landing(1800, ["a.ts"])],
+      removalOf: ({ landingSha }: { landingSha: string }) =>
+        landingSha === "sha1800"
+          ? { mechanism: "merge-resolution", sha: "acf78bf4", subject: "Merge origin/main" }
+          : { mechanism: "deliberate-commit", sha: "f89fbcc7", subject: "Re-land the retirement" },
+    });
+    expect(result.findings.map((finding) => finding.pullNumber)).toEqual([1800, 1815]);
+    expect(result.mechanismCounts).toEqual({ "merge-resolution": 1, "deliberate-commit": 2, unknown: 0 });
+  });
+});
diff --git a/tests/mobile-chrome-paint-contract.test.ts b/tests/mobile-chrome-paint-contract.test.ts
index 50ef4249b7..2306b6bfc6 100644
--- a/tests/mobile-chrome-paint-contract.test.ts
+++ b/tests/mobile-chrome-paint-contract.test.ts
@@ -57,15 +57,11 @@ describe("mobile chrome paint baseline", () => {
     }
   });
 
-  it("registers the calculator page reserve with the shared hide and transition contracts", () => {
-    expect(calculatorsSource).toContain("useReserveTransitionMarker(dockHidden, activeCalc)");
-    expect(calculatorsSource).toContain("if (!activeCalc) return;");
-    expect(calculatorsSource).toContain("queueMicrotask(() =>");
-    expect(calculatorsSource).toContain("setDockFocused(false)");
-    expect(calculatorsSource).not.toContain("if (!cancelled) setDockFocused(false)");
-    expect(calculatorsSource).toContain('reserveOwner="calculator"');
-    expect(calculatorsSource).toContain('reserveHiddenPad="0rem"');
-    expect(calculatorsSource).toContain("reserveTransitioning={reserveTransitioning}");
+  it("keeps calculator results free of a second phone dock and page reserve", () => {
+    expect(calculatorsSource).not.toContain("useReserveTransitionMarker");
+    expect(calculatorsSource).not.toContain('reserveOwner="calculator"');
+    expect(calculatorsSource).not.toContain('data-testid="calculators-phone-dock"');
+    expect(calculatorsSource).not.toContain("PhoneFooterLayerPortal");
     expect(globalStylesSource).toContain('[data-reserve-owner][data-reserve-transitioning="true"]');
     expect(scrollHideSource).toContain('querySelectorAll("[data-reserve-owner]")');
     expect(scrollHideSource).toContain("dataset.reserveHiddenPad");
diff --git a/tests/mobile-composer-reserve.test.ts b/tests/mobile-composer-reserve.test.ts
index f2756d62d3..deb59201cf 100644
--- a/tests/mobile-composer-reserve.test.ts
+++ b/tests/mobile-composer-reserve.test.ts
@@ -4,7 +4,6 @@ import { resolve } from "node:path";
 import { describe, expect, it } from "vitest";
 
 import {
-  isCalculatorsOwnedRoute,
   isDocumentViewerOwnedRoute,
   isPageOwnedComposerRoute,
   mobileComposerDifferentialsCompareReserve,
@@ -44,7 +43,7 @@ describe("mobile composer reserve contract", () => {
       resolveShellVisibleMobileComposerReserve({
         shouldShowSearchComposer: false,
         documentViewerOwnedRoute: true,
-        isStandaloneModeHome: false,
+        heroOwnsPhoneComposer: false,
         searchMode: "documents",
         differentialsCompareAddonActive: false,
       }),
@@ -56,13 +55,25 @@ describe("mobile composer reserve contract", () => {
       resolveShellVisibleMobileComposerReserve({
         shouldShowSearchComposer: true,
         documentViewerOwnedRoute: false,
-        isStandaloneModeHome: true,
+        heroOwnsPhoneComposer: true,
         searchMode: "services",
         differentialsCompareAddonActive: false,
       }),
     ).toBe(mobileComposerIdleReserve);
   });
 
+  it("uses the shared compact dock reserve when a standalone home delegates phones to the footer", () => {
+    expect(
+      resolveShellVisibleMobileComposerReserve({
+        shouldShowSearchComposer: true,
+        documentViewerOwnedRoute: false,
+        heroOwnsPhoneComposer: false,
+        searchMode: "tools",
+        differentialsCompareAddonActive: false,
+      }),
+    ).toBe(mobileComposerVisibleReserve.shellDock);
+  });
+
   it("uses the compact dock reserve for non-answer dashboard docks when the hero does not own phones", () => {
     for (const searchMode of ["documents", "services", "forms", "tools", "favourites"]) {
       expect(
@@ -102,16 +113,19 @@ describe("mobile composer reserve contract", () => {
     ).toBe(mobileComposerIdleReserve);
   });
 
-  it("derives hero phone ownership from the mounted hero slot; any mode home uses all-widths breakpoint", () => {
-    // Any mounted mode home (answer, documents, prescribing, tools, favourites)
-    // needs "all" (phones keep the in-flow hero pill) per the page-ownership
-    // contract. Only result/submitted views use "sm-up" so phones get the compact
-    // bottom dock. desktopHomeComposerSlotId is undefined on result views, so
-    // heroOwnsPhoneComposer stays false there regardless of the breakpoint value.
+  it("derives hero phone ownership from the mounted hero slot while Tools delegates phones to the footer", () => {
+    // Most mounted mode homes keep the in-flow hero pill on phones. Tools is the
+    // deliberate exception: its content-rich directory delegates phones to the
+    // compact footer while retaining the hero from sm upward. Result/submitted
+    // views also use "sm-up"; desktopHomeComposerSlotId is undefined there, so
+    // heroOwnsPhoneComposer stays false regardless of the breakpoint value.
     const dashboard = source("src/components/ClinicalDashboard.tsx");
     const header = source("src/components/clinical-dashboard/master-search-header.tsx");
     expect(dashboard).toContain('(activeModeResultKind === "favourites" && favouritesAccessible)');
-    expect(dashboard).toContain('const heroComposerBreakpoint = showDesktopHomeComposer ? "all" : "sm-up";');
+    expect(dashboard).toMatch(
+      /const heroComposerBreakpoint =\s*showDesktopHomeComposer && activeModeResultKind !== "tools" \? "all" : "sm-up";/,
+    );
+    expect(dashboard).not.toContain('const heroComposerBreakpoint = showDesktopHomeComposer ? "all" : "sm-up";');
     expect(dashboard).toContain(
       'const heroOwnsPhoneComposer = Boolean(desktopHomeComposerSlotId) && heroComposerBreakpoint === "all";',
     );
@@ -189,7 +203,7 @@ describe("mobile composer reserve contract", () => {
       resolveShellVisibleMobileComposerReserve({
         shouldShowSearchComposer: true,
         documentViewerOwnedRoute: false,
-        isStandaloneModeHome: false,
+        heroOwnsPhoneComposer: false,
         searchMode: "differentials",
         differentialsCompareAddonActive: true,
       }),
@@ -205,18 +219,16 @@ describe("mobile composer reserve contract", () => {
     expect(isDocumentViewerOwnedRoute("/forms")).toBe(false);
   });
 
-  it("classifies calculators as a page-owned composer route", () => {
-    expect(isCalculatorsOwnedRoute("/calculators")).toBe(true);
-    expect(isCalculatorsOwnedRoute("/calculators/phq-9")).toBe(true);
-    expect(isCalculatorsOwnedRoute("/tools")).toBe(false);
-    expect(isPageOwnedComposerRoute("/calculators")).toBe(true);
+  it("keeps calculators shell-owned and document viewers page-owned", () => {
+    expect(isPageOwnedComposerRoute("/calculators")).toBe(false);
+    expect(isPageOwnedComposerRoute("/calculators/phq-9")).toBe(false);
     expect(isPageOwnedComposerRoute("/documents/source")).toBe(true);
     expect(isPageOwnedComposerRoute("/tools")).toBe(false);
     expect(
       resolveShellVisibleMobileComposerReserve({
         shouldShowSearchComposer: false,
         pageOwnedComposerRoute: true,
-        isStandaloneModeHome: false,
+        heroOwnsPhoneComposer: false,
         searchMode: "tools",
         differentialsCompareAddonActive: false,
       }),
diff --git a/tests/mobile-sheet-safe-area-contract.test.ts b/tests/mobile-sheet-safe-area-contract.test.ts
new file mode 100644
index 0000000000..f3cd5616f7
--- /dev/null
+++ b/tests/mobile-sheet-safe-area-contract.test.ts
@@ -0,0 +1,31 @@
+import { readFileSync } from "node:fs";
+
+import { describe, expect, it } from "vitest";
+
+function source(relativePath: string) {
+  return readFileSync(new URL(`../${relativePath}`, import.meta.url), "utf8");
+}
+
+describe("mobile sheet top safe-area ownership", () => {
+  it("routes fullscreen and near-full Sheet headers through the shared contract", () => {
+    const sheet = source("src/components/ui/sheet.tsx");
+    const accountSetup = source("src/components/clinical-dashboard/account-setup-dialog.tsx");
+    const sidebar = source("src/components/clinical-dashboard/ClinicalSidebar.tsx");
+    const masterHeader = source("src/components/clinical-dashboard/master-search-header.tsx");
+
+    expect(sheet).toContain('mobileHeaderSafeArea ?? (defaultSheetIsFullscreen ? "padding" : "none")');
+    expect(sheet).toContain('"pt-[max(1rem,var(--safe-area-top))] sm:pt-5"');
+    expect(sheet).toContain('"top-[max(0.75rem,var(--safe-area-top))] sm:top-4"');
+    expect(accountSetup).toContain('mobileHeaderSafeArea="offset"');
+    expect(accountSetup).toContain("pt-[max(1.5rem,var(--safe-area-top))]");
+    expect(sidebar).toContain('mobileHeaderSafeArea="padding"');
+    expect(masterHeader).toContain('mobileHeaderSafeArea="padding"');
+  });
+
+  it("keeps the standalone calculator sheet below the unsafe top band on phones", () => {
+    const calculatorSheet = source("src/components/calculators/calculator-sheet.tsx");
+
+    expect(calculatorSheet).toContain("max-h-[calc(100dvh-max(0.75rem,var(--safe-area-top)))]");
+    expect(calculatorSheet).toContain("sm:max-h-[92dvh]");
+  });
+});
diff --git a/tests/mode-menu-prefetch.dom.test.tsx b/tests/mode-menu-prefetch.dom.test.tsx
index 0efbf9a962..1a12cf09d1 100644
--- a/tests/mode-menu-prefetch.dom.test.tsx
+++ b/tests/mode-menu-prefetch.dom.test.tsx
@@ -2,9 +2,11 @@
 
 import { render, screen, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
+import { useState } from "react";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 import { MasterSearchHeader } from "@/components/clinical-dashboard/master-search-header";
+import { LAST_APP_MODE_STORAGE_KEY } from "@/components/clinical-dashboard/use-last-app-mode";
 import { appModeSelectionHref, visibleAppModeDefinitionsForSession, type AppModeId } from "@/lib/app-modes";
 
 /**
@@ -85,6 +87,73 @@ describe("mode menu destination prefetch", () => {
     router.push.mockReset();
     router.replace.mockReset();
     router.prefetch.mockReset();
+    window.localStorage.clear();
+  });
+
+  it("keeps calculator submission enabled when document data is unavailable", async () => {
+    const user = userEvent.setup();
+    const onAsk = vi.fn();
+
+    render(
+      <MasterSearchHeader
+        {...headerProps()}
+        searchMode="calculators"
+        query="PHQ-9"
+        realDataReady={false}
+        onAsk={onAsk}
+      />,
+    );
+
+    const submit = screen.getByRole("button", { name: "Search clinical calculators" });
+    expect(submit).toBeEnabled();
+    await user.click(submit);
+    expect(onAsk).toHaveBeenCalledTimes(1);
+  });
+
+  it("submits the selected calculator suggestion rather than the previous query state", async () => {
+    const user = userEvent.setup();
+    const onAsk = vi.fn();
+    vi.stubGlobal(
+      "matchMedia",
+      vi.fn(() => ({ matches: true, addEventListener: vi.fn(), removeEventListener: vi.fn() })),
+    );
+
+    try {
+      function CalculatorHeader() {
+        const [query, setQuery] = useState("depression");
+        return (
+          <MasterSearchHeader
+            {...headerProps()}
+            searchMode="calculators"
+            query={query}
+            onQueryChange={setQuery}
+            onAsk={onAsk}
+          />
+        );
+      }
+
+      render(<CalculatorHeader />);
+      const input = screen.getByTestId("global-search-input");
+      await user.clear(input);
+      await user.type(input, "depression");
+      await user.click(await screen.findByRole("option", { name: /depression severity.*PHQ-9/i }));
+
+      expect(onAsk).toHaveBeenCalledWith("depression severity");
+    } finally {
+      vi.unstubAllGlobals();
+    }
+  });
+
+  it("shows calculator-specific actions instead of Answer actions", async () => {
+    const user = userEvent.setup();
+
+    render(<MasterSearchHeader {...headerProps()} searchMode="calculators" />);
+    await user.click(screen.getByRole("button", { name: "Open calculators options" }));
+
+    const actions = await screen.findByRole("menu", { name: "Useful actions" });
+    expect(within(actions).getByRole("menuitem", { name: "Browse calculators" })).toBeVisible();
+    expect(within(actions).queryByRole("menuitem", { name: "New question" })).toBeNull();
+    expect(within(actions).queryByRole("menuitem", { name: "Add document" })).toBeNull();
   });
 
   it("prefetches the shared-home selection URL when the user points at a mode", async () => {
@@ -106,6 +175,26 @@ describe("mode menu destination prefetch", () => {
     expect(prefetched.size).toBeLessThan(guestModeHomes().length);
   });
 
+  it("prefetches and opens the canonical all-tools directory from the mode menu", async () => {
+    const user = userEvent.setup();
+    const onSearchModeChange = vi.fn();
+
+    render(<MasterSearchHeader {...headerProps()} onSearchModeChange={onSearchModeChange} />);
+    await user.click(screen.getByRole("button", { name: /Mode Answer/i }));
+    const toolsOption = within(await screen.findByRole("menu", { name: "Choose app mode" })).getByRole(
+      "menuitemradio",
+      { name: /Tools/i },
+    );
+
+    await user.hover(toolsOption);
+    expect(router.prefetch.mock.calls.some(([href]) => href === "/tools")).toBe(true);
+
+    await user.click(toolsOption);
+    expect(router.push).toHaveBeenCalledWith("/tools");
+    expect(onSearchModeChange).not.toHaveBeenCalled();
+    expect(window.localStorage.getItem(LAST_APP_MODE_STORAGE_KEY)).toBe("tools");
+  });
+
   it("warms a mode again after Next invalidates its cached payload", async () => {
     const user = userEvent.setup();
     const documentsHref = modeSelectionHref("documents");
@@ -165,6 +254,26 @@ describe("mode menu destination prefetch", () => {
     });
   });
 
+  it("restores mode-trigger focus when re-opening the active Tools directory", async () => {
+    const user = userEvent.setup();
+    const onSearchModeChange = vi.fn();
+    render(<MasterSearchHeader {...headerProps()} searchMode="tools" onSearchModeChange={onSearchModeChange} />);
+
+    const trigger = screen.getByRole("button", { name: /Mode Tools/i });
+    await user.click(trigger);
+    const toolsOption = within(await screen.findByRole("menu", { name: "Choose app mode" })).getByRole(
+      "menuitemradio",
+      { name: /Tools/i },
+    );
+    await user.click(toolsOption);
+
+    expect(router.push).toHaveBeenCalledWith("/tools");
+    expect(onSearchModeChange).not.toHaveBeenCalled();
+    await vi.waitFor(() => {
+      expect(trigger).toHaveFocus();
+    });
+  });
+
   it("does not steal focus when the user moves elsewhere during same-mode restore", async () => {
     const user = userEvent.setup();
     render(
diff --git a/tests/mode-secondary-navigation.test.ts b/tests/mode-secondary-navigation.test.ts
index 597617e00a..bb5af111ab 100644
--- a/tests/mode-secondary-navigation.test.ts
+++ b/tests/mode-secondary-navigation.test.ts
@@ -11,7 +11,7 @@ import {
   routedModeSecondaryNavigationCount,
 } from "@/lib/mode-secondary-navigation";
 
-/** Seven modes intentionally register no destinations at all — see `emptyRegistryModes`. */
+/** Eight modes intentionally register no destinations at all — see `emptyRegistryModes`. */
 const expectedLabels: Record<AppModeId, string[]> = {
   answer: [],
   documents: [],
@@ -24,6 +24,7 @@ const expectedLabels: Record<AppModeId, string[]> = {
   formulation: ["Find", "Build", "Compare", "Map"],
   prescribing: [],
   tools: [],
+  calculators: [],
   "therapy-compass": ["Search", "Recommend", "Compare", "Pathways", "Brief Intervention", "Patient Sheets"],
   factsheets: ["Topics", "Search"],
 };
@@ -40,6 +41,7 @@ const cleanLandingPath: Record<AppModeId, string> = {
   formulation: "/formulation",
   prescribing: "/medications",
   tools: "/tools",
+  calculators: "/calculators",
   "therapy-compass": "/therapy-compass",
   factsheets: "/factsheets",
 };
@@ -59,12 +61,13 @@ const emptyRegistryModes = [
   "favourites",
   "prescribing",
   "tools",
+  "calculators",
 ] as const satisfies readonly AppModeId[];
 
 describe("mode secondary navigation registry", () => {
-  it("covers all 13 modes with the approved destinations and no Home item", () => {
+  it("covers all 14 modes with the approved destinations and no Home item", () => {
     expect(Object.keys(modeSecondaryNavigationRegistry).sort()).toEqual([...appModeIds].sort());
-    expect(appModeIds).toHaveLength(13);
+    expect(appModeIds).toHaveLength(14);
 
     for (const modeId of appModeIds) {
       const labels = modeSecondaryNavigationRegistry[modeId].map((item) => item.label);
@@ -73,7 +76,7 @@ describe("mode secondary navigation registry", () => {
     }
   });
 
-  it("registers no destinations at all for the seven single-surface modes", () => {
+  it("registers no destinations at all for the eight single-surface modes", () => {
     // Empty is a real answer, pinned rather than left incidental: a future edit
     // that re-adds a lone focus-the-composer button should have to argue with
     // this test rather than slip back in.
diff --git a/tests/outstanding-issues-writer.test.ts b/tests/outstanding-issues-writer.test.ts
index 6cdd1b3dd8..c1f5b7bd49 100644
--- a/tests/outstanding-issues-writer.test.ts
+++ b/tests/outstanding-issues-writer.test.ts
@@ -1,10 +1,13 @@
 import { describe, expect, it } from "vitest";
 
 import { parseIssues } from "../scripts/check-outstanding-issues.mjs";
+import { displayIdForUlid, issueUlid } from "../scripts/issue-id.mjs";
 import { addIssue, escapeCell, resolveIssue, splitCells, updateIssue } from "../scripts/outstanding-issues.mjs";
 
 const OPEN_CELLS = 7;
 const ARCHIVE_CELLS = 5;
+const TEST_ULID = issueUlid(Date.UTC(2026, 1, 2), Buffer.from([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]));
+const TEST_ID = displayIdForUlid(TEST_ULID);
 
 const ledger = [
   "# Outstanding",
@@ -32,21 +35,26 @@ describe("outstanding-issues writer", () => {
   it("appends into the open table, never the archive", () => {
     // The defect this writer exists for: hand edits anchored on an id that had
     // been archived, so the new row landed in the archive table.
-    const next = addIssue(ledger, { pri: "P1", type: "rec", summary: "third" }, { date: "2026-02-02" });
-    const row = rowFor(next, "#007");
+    const next = addIssue(
+      ledger,
+      { pri: "P1", type: "rec", summary: "third" },
+      { date: "2026-02-02", issueUlid: TEST_ULID },
+    );
+    const row = rowFor(next, TEST_ID);
     expect(row?.table).toBe("open");
-    expect(next.indexOf("| #007 ")).toBeLessThan(next.indexOf("## Resolved / archive"));
+    expect(row?.ulid).toBe(TEST_ULID);
+    expect(next.indexOf(`| ${TEST_ID} `)).toBeLessThan(next.indexOf("## Resolved / archive"));
   });
 
-  it("allocates the marker's id and bumps it", () => {
-    const next = addIssue(ledger, { summary: "third" }, { date: "2026-02-02" });
-    expect(rowFor(next, "#007")).toBeDefined();
-    expect(parseIssues(next).nextId).toBe(8);
+  it("derives a permanent display id and leaves the deprecated marker untouched", () => {
+    const next = addIssue(ledger, { summary: "third" }, { date: "2026-02-02", issueUlid: TEST_ULID });
+    expect(rowFor(next, TEST_ID)?.ulid).toBe(TEST_ULID);
+    expect(parseIssues(next).nextId).toBe(7);
   });
 
   it("escapes pipes in prose instead of creating columns", () => {
-    const next = addIssue(ledger, { summary: "a | b", detail: "c | d" }, { date: "2026-02-02" });
-    const row = rowFor(next, "#007");
+    const next = addIssue(ledger, { summary: "a | b", detail: "c | d" }, { date: "2026-02-02", issueUlid: TEST_ULID });
+    const row = rowFor(next, TEST_ID);
     expect(splitCells(row!.raw)).toHaveLength(OPEN_CELLS);
     expect(row!.raw).toContain("a \\| b");
   });
@@ -68,6 +76,21 @@ describe("outstanding-issues writer", () => {
     expect(row!.raw).toContain("replaced \\| detail");
   });
 
+  it("extends a colliding display id and preserves it through update and archive", () => {
+    const firstUlid = "0000000000ABCDEF0000000000";
+    const secondUlid = "0000000000ABCDEF1000000000";
+    const first = addIssue(ledger, { summary: "first modern" }, { date: "2026-02-02", issueUlid: firstUlid });
+    const second = addIssue(first, { summary: "second modern" }, { date: "2026-02-03", issueUlid: secondUlid });
+    expect(rowFor(second, "#ABCDEF")?.ulid).toBe(firstUlid);
+    expect(rowFor(second, "#ABCDEF1")?.ulid).toBe(secondUlid);
+
+    const updated = updateIssue(second, "#ABCDEF1", { detail: "retained identity" });
+    const archived = resolveIssue(updated, "#ABCDEF1", "done", { date: "2026-03-03" });
+    const row = rowFor(archived, "#ABCDEF1");
+    expect(row?.table).toBe("archive");
+    expect(row?.ulid).toBe(secondUlid);
+  });
+
   it("refuses edits that would not survive the gate", () => {
     expect(() => resolveIssue(ledger, "#999", "x")).toThrow(/not in/);
     expect(() => addIssue(ledger, { pri: "P9", summary: "x" })).toThrow(/--pri/);
diff --git a/tests/phone-dock-addon-contract.test.ts b/tests/phone-dock-addon-contract.test.ts
index 6f45f7a8cb..f776c0f43b 100644
--- a/tests/phone-dock-addon-contract.test.ts
+++ b/tests/phone-dock-addon-contract.test.ts
@@ -107,7 +107,7 @@ describe("reserve resolvers honour the patient-details addon", () => {
     expect(
       resolveShellVisibleMobileComposerReserve({
         shouldShowSearchComposer: true,
-        isStandaloneModeHome: false,
+        heroOwnsPhoneComposer: false,
         searchMode: "prescribing",
         differentialsCompareAddonActive: false,
         patientDetailsAddonActive: true,
@@ -119,7 +119,7 @@ describe("reserve resolvers honour the patient-details addon", () => {
     expect(
       resolveShellVisibleMobileComposerReserve({
         shouldShowSearchComposer: true,
-        isStandaloneModeHome: false,
+        heroOwnsPhoneComposer: false,
         searchMode: "differentials",
         differentialsCompareAddonActive: true,
         patientDetailsAddonActive: true,
@@ -133,7 +133,7 @@ describe("reserve resolvers honour the patient-details addon", () => {
     expect(
       resolveShellVisibleMobileComposerReserve({
         shouldShowSearchComposer: true,
-        isStandaloneModeHome: true,
+        heroOwnsPhoneComposer: true,
         searchMode: "prescribing",
         differentialsCompareAddonActive: false,
         patientDetailsAddonActive: true,
diff --git a/tests/pwa-lifecycle.dom.test.tsx b/tests/pwa-lifecycle.dom.test.tsx
index 4d10313dec..429c9488a9 100644
--- a/tests/pwa-lifecycle.dom.test.tsx
+++ b/tests/pwa-lifecycle.dom.test.tsx
@@ -132,10 +132,8 @@ describe("PwaLifecycle", () => {
 
     Object.defineProperty(navigator, "onLine", { configurable: true, value: false });
     fireEvent.offline(window);
-    expect(await screen.findByRole("region", { name: "You appear to be offline" })).toBeInTheDocument();
-    expect(
-      screen.getByText(/clinical search, answers, private documents, uploads, and account data require a connection/i),
-    ).toBeInTheDocument();
+    expect(await screen.findByRole("region", { name: "You’re offline" })).toBeInTheDocument();
+    expect(screen.getByText("Clinical search and private features need a connection.")).toBeInTheDocument();
 
     Object.defineProperty(navigator, "onLine", { configurable: true, value: true });
     fireEvent.online(window);
@@ -148,16 +146,16 @@ describe("PwaLifecycle", () => {
 
     Object.defineProperty(navigator, "onLine", { configurable: true, value: false });
     fireEvent.offline(window);
-    expect(await screen.findByRole("region", { name: "You appear to be offline" })).toBeInTheDocument();
+    expect(await screen.findByRole("region", { name: "You’re offline" })).toBeInTheDocument();
 
     await user.click(screen.getByRole("button", { name: "Dismiss offline notice" }));
-    expect(screen.queryByRole("region", { name: "You appear to be offline" })).not.toBeInTheDocument();
+    expect(screen.queryByRole("region", { name: "You’re offline" })).not.toBeInTheDocument();
 
     Object.defineProperty(navigator, "onLine", { configurable: true, value: true });
     fireEvent.online(window);
     Object.defineProperty(navigator, "onLine", { configurable: true, value: false });
     fireEvent.offline(window);
-    expect(await screen.findByRole("region", { name: "You appear to be offline" })).toBeInTheDocument();
+    expect(await screen.findByRole("region", { name: "You’re offline" })).toBeInTheDocument();
   });
 
   it("shows install UI only after browser eligibility and invokes the deferred prompt from a user action", async () => {
@@ -168,6 +166,15 @@ describe("PwaLifecycle", () => {
     const prompt = dispatchInstallEligibility();
     const installRegion = await screen.findByRole("region", { name: "Install Clinical KB" });
     expect(installRegion).toBeInTheDocument();
+    expect(installRegion).toHaveTextContent("Clinical guidelines on your home screen.");
+    expect(installRegion).toHaveTextContent(
+      "Open it from your device like an app. Private clinical features still require a connection.",
+    );
+    expect(installRegion).toHaveTextContent("Free · No app store · Takes a few seconds");
+    expect(screen.getByRole("list", { name: "Install benefits" })).toHaveTextContent(
+      "Quick accessApp-like launchFamiliar workspace",
+    );
+    expect(screen.getByRole("button", { name: "Dismiss install prompt" })).toHaveTextContent("Dismiss");
 
     await user.click(screen.getByRole("button", { name: "Install app" }));
     expect(prompt).toHaveBeenCalledTimes(1);
@@ -181,12 +188,12 @@ describe("PwaLifecycle", () => {
     const user = userEvent.setup();
     render(<PwaLifecycle />);
 
-    expect(await screen.findByText("An update is ready")).toBeInTheDocument();
+    expect(await screen.findByText("Update available")).toBeInTheDocument();
     dispatchInstallEligibility();
     expect(screen.queryByRole("region", { name: "Install Clinical KB" })).not.toBeInTheDocument();
     expect(waitingWorker.postMessage).not.toHaveBeenCalled();
 
-    await user.click(screen.getByRole("button", { name: "Refresh now" }));
+    await user.click(screen.getByRole("button", { name: "Reload" }));
     expect(waitingWorker.postMessage).toHaveBeenCalledWith({ type: "SKIP_WAITING" });
   });
 
@@ -200,8 +207,9 @@ describe("PwaLifecycle", () => {
       container.dispatchEvent(new Event("controllerchange"));
     });
 
-    expect(await screen.findByRole("region", { name: "An update is ready" })).toBeInTheDocument();
-    expect(screen.getByRole("button", { name: "Refresh now" })).toBeInTheDocument();
+    expect(await screen.findByRole("region", { name: "Update available" })).toBeInTheDocument();
+    expect(screen.getByText("Reload when convenient to use the latest version.")).toBeInTheDocument();
+    expect(screen.getByRole("button", { name: "Reload" })).toBeInTheDocument();
     expect(screen.getByRole("button", { name: "Later" })).toBeInTheDocument();
   });
 
@@ -215,7 +223,7 @@ describe("PwaLifecycle", () => {
       container.dispatchEvent(new Event("controllerchange"));
     });
 
-    expect(screen.queryByRole("region", { name: "An update is ready" })).not.toBeInTheDocument();
+    expect(screen.queryByRole("region", { name: "Update available" })).not.toBeInTheDocument();
   });
 
   it("shows the one-time iOS Add to Home Screen hint and honours its dismissal window", async () => {
@@ -229,8 +237,12 @@ describe("PwaLifecycle", () => {
       const { unmount } = render(<PwaLifecycle />);
 
       const hint = await screen.findByRole("region", { name: "Install Clinical KB" });
-      expect(hint).toHaveTextContent(/tap Share, then Add to Home Screen/i);
-      expect(hint).toHaveTextContent(/still require a connection/i);
+      expect(hint).toHaveTextContent("In Safari, tap Share, then Add to Home Screen.");
+      expect(hint).toHaveTextContent("Private clinical features still require a connection.");
+      expect(screen.getByRole("list", { name: "Add Clinical KB to your Home Screen" })).toHaveTextContent(
+        "1. Tap Share2. Add to Home Screen",
+      );
+      expect(screen.queryByRole("button", { name: "Install app" })).not.toBeInTheDocument();
 
       await user.click(screen.getByRole("button", { name: "Not now" }));
       await waitFor(() =>
diff --git a/tests/rag-retrieval-row-contract.test.ts b/tests/rag-retrieval-row-contract.test.ts
new file mode 100644
index 0000000000..ac1b7a0467
--- /dev/null
+++ b/tests/rag-retrieval-row-contract.test.ts
@@ -0,0 +1,295 @@
+import { describe, expect, it, vi } from "vitest";
+import {
+  RetrievalRowShapeError,
+  assertEmbeddingFieldRows,
+  assertIndexUnitRows,
+  assertRetrievalRows,
+  buildDocumentSummaryResults,
+} from "@/lib/rag/rag-row-contracts";
+import { searchEmbeddingFieldCandidates, searchIndexUnitCandidates } from "@/lib/rag/rag-candidate-sources";
+
+vi.mock("@/lib/logger", () => ({
+  logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() },
+}));
+
+// A realistic `match_document_chunks_hybrid_v2` row. Column list mirrors the RPC's
+// `returns table (...)` in supabase/migrations/20260713020000_owner_plus_public_retrieval.sql.
+/** A row with one column dropped, standing in for an RPC whose shape has drifted. */
+function withoutColumn(column: string, overrides: Record<string, unknown> = {}) {
+  const row: Record<string, unknown> = hybridRow(overrides);
+  delete row[column];
+  return row;
+}
+
+function hybridRow(overrides: Record<string, unknown> = {}) {
+  return {
+    id: "3f1a2b6c-1111-4aaa-8bbb-000000000001",
+    document_id: "3f1a2b6c-2222-4aaa-8bbb-000000000002",
+    title: "RANZCP Mood Disorders Guideline",
+    file_name: "ranzcp-mood.pdf",
+    page_number: 14,
+    chunk_index: 7,
+    section_heading: "Lithium monitoring",
+    content: "Check serum lithium 5 days after any dose change.",
+    retrieval_synopsis: null,
+    image_ids: [],
+    source_metadata: { document_status: "current" },
+    similarity: 0.91,
+    text_rank: 0.42,
+    hybrid_score: 0.88,
+    rrf_score: 0.031,
+    images: [],
+    ...overrides,
+  };
+}
+
+describe("retrieval row shape contract", () => {
+  it("accepts a realistic hybrid RPC row without mutating it", () => {
+    const rows: unknown = [hybridRow()];
+    const before = structuredClone(rows);
+    const firstRowReference = (rows as unknown[])[0];
+
+    expect(() => assertRetrievalRows(rows, "match_document_chunks_hybrid")).not.toThrow();
+
+    // Assert, do not transform: ranking is a live-validated protected surface, so a valid
+    // row must reach it byte-identical and by the same reference.
+    expect(rows).toEqual(before);
+    expect((rows as unknown[])[0]).toBe(firstRowReference);
+  });
+
+  it("builds valid document-summary rows outside the retrieval monolith", () => {
+    const chunk = hybridRow({ title: "stale", file_name: "stale.pdf", similarity: 0.2 });
+
+    const rows = buildDocumentSummaryResults([chunk], {
+      title: "Current title",
+      file_name: "current.pdf",
+      metadata: { document_status: "current" },
+    });
+
+    expect(rows[0]).toMatchObject({
+      id: chunk.id,
+      title: "Current title",
+      file_name: "current.pdf",
+      similarity: 1,
+      source_metadata: expect.objectContaining({ document_status: "current" }),
+    });
+  });
+
+  it("preserves unknown columns so an RPC version difference is not data loss", () => {
+    const rows: unknown = [hybridRow({ document_labels: [{ id: "l1" }], a_future_column: 42 })];
+
+    assertRetrievalRows(rows, "match_document_chunks_v2");
+
+    expect(rows[0]).toMatchObject({ document_labels: [{ id: "l1" }], a_future_column: 42 });
+  });
+
+  it("rejects a numeric score returned as a string", () => {
+    const rows: unknown = [hybridRow({ similarity: "0.91" })];
+
+    expect(() => assertRetrievalRows(rows, "match_document_chunks_hybrid")).toThrow(RetrievalRowShapeError);
+  });
+
+  it("rejects a row missing its chunk identity", () => {
+    const rows: unknown = [withoutColumn("id")];
+
+    expect(() => assertRetrievalRows(rows, "match_document_chunks_hybrid")).toThrow(RetrievalRowShapeError);
+    expect(() => assertRetrievalRows([hybridRow({ document_id: "" })], "x")).toThrow(RetrievalRowShapeError);
+  });
+
+  it("rejects malformed provenance and visual fields before they can miscite or crash rendering", () => {
+    expect(() => assertRetrievalRows([withoutColumn("title")], "match_document_chunks_hybrid")).toThrow(
+      RetrievalRowShapeError,
+    );
+    expect(() =>
+      assertRetrievalRows([hybridRow({ image_ids: "not-an-array" })], "match_document_chunks_hybrid"),
+    ).toThrow(RetrievalRowShapeError);
+    expect(() => assertRetrievalRows([hybridRow({ images: [{}] })], "match_document_chunks_hybrid")).toThrow(
+      RetrievalRowShapeError,
+    );
+  });
+
+  it("accepts absent or null scores, which downstream already coalesces to 0", () => {
+    expect(() => assertRetrievalRows([withoutColumn("text_rank")], "match_document_chunks")).not.toThrow();
+    expect(() => assertRetrievalRows([hybridRow({ rrf_score: null })], "match_document_chunks")).not.toThrow();
+    expect(() => assertRetrievalRows([], "match_document_chunks")).not.toThrow();
+  });
+
+  it("names the RPC and leaks no row content in the error", () => {
+    const secret = "Check serum lithium 5 days after any dose change.";
+    let thrown: RetrievalRowShapeError | null = null;
+    try {
+      assertRetrievalRows([hybridRow({ hybrid_score: "0.88" })], "match_document_chunks_hybrid");
+    } catch (error) {
+      thrown = error as RetrievalRowShapeError;
+    }
+
+    expect(thrown).toBeInstanceOf(RetrievalRowShapeError);
+    expect(thrown?.rpc).toBe("match_document_chunks_hybrid");
+    expect(thrown?.message).toContain("match_document_chunks_hybrid");
+    expect(thrown?.message).toContain("hybrid_score");
+    // Retrieval rows carry clinical document text; it must never reach a log or a response.
+    expect(thrown?.message).not.toContain(secret);
+    expect(thrown?.message).not.toContain("ranzcp-mood.pdf");
+  });
+
+  it("caps the reported issues so a wholesale shape change stays readable", () => {
+    const rows = Array.from({ length: 20 }, () => hybridRow({ similarity: "nope" }));
+
+    let thrown: RetrievalRowShapeError | null = null;
+    try {
+      assertRetrievalRows(rows, "match_document_chunks_hybrid");
+    } catch (error) {
+      thrown = error as RetrievalRowShapeError;
+    }
+
+    expect(thrown?.issues).toHaveLength(6);
+    expect(thrown?.issues.at(-1)).toBe("and 15 more");
+  });
+
+  it("rejects a payload that is not an array of rows", () => {
+    expect(() => assertRetrievalRows({ rows: [] }, "match_document_chunks_hybrid")).toThrow(RetrievalRowShapeError);
+    expect(() => assertRetrievalRows(null, "match_document_chunks_hybrid")).toThrow(RetrievalRowShapeError);
+  });
+});
+
+// Signal rows carry a chunk id plus scores; loadChunksForSignalMatches then loads the real
+// chunk. Column lists mirror the RPCs' `returns table (...)` in
+// supabase/migrations/20260713020000_owner_plus_public_retrieval.sql.
+function embeddingFieldRow(overrides: Record<string, unknown> = {}) {
+  return {
+    id: "9c1e0000-1111-4aaa-8bbb-000000000001",
+    document_id: "9c1e0000-2222-4aaa-8bbb-000000000002",
+    source_chunk_id: "9c1e0000-3333-4aaa-8bbb-000000000003",
+    field_type: "section_context",
+    content: "Monitoring schedule after a dose change.",
+    similarity: 0.74,
+    text_rank: 0.21,
+    hybrid_score: 0.68,
+    ...overrides,
+  };
+}
+
+function indexUnitRow(overrides: Record<string, unknown> = {}) {
+  return {
+    id: "4b2d0000-1111-4aaa-8bbb-000000000001",
+    document_id: "4b2d0000-2222-4aaa-8bbb-000000000002",
+    source_chunk_id: "4b2d0000-3333-4aaa-8bbb-000000000003",
+    source_image_id: null,
+    unit_type: "threshold",
+    title: "Serum lithium target range",
+    content: "0.6–0.8 mmol/L for maintenance.",
+    page_start: 12,
+    page_end: 12,
+    heading_path: ["Monitoring", "Lithium"],
+    normalized_terms: ["lithium", "serum level"],
+    source_span: { start: 10, end: 240 },
+    quality_score: 0.86,
+    extraction_mode: "deterministic",
+    metadata: { producer: "deterministic-v3" },
+    similarity: 0.81,
+    text_rank: 0.33,
+    hybrid_score: 0.77,
+    ...overrides,
+  };
+}
+
+describe("signal row shape contracts", () => {
+  it("accepts realistic embedding-field and index-unit rows without mutating them", () => {
+    const fieldRows: unknown = [embeddingFieldRow()];
+    const unitRows: unknown = [indexUnitRow()];
+    const fieldsBefore = structuredClone(fieldRows);
+    const unitsBefore = structuredClone(unitRows);
+
+    assertEmbeddingFieldRows(fieldRows, "match_document_embedding_fields_hybrid");
+    assertIndexUnitRows(unitRows, "match_document_index_units_hybrid");
+
+    expect(fieldRows).toEqual(fieldsBefore);
+    expect(unitRows).toEqual(unitsBefore);
+  });
+
+  it("rejects a stringified score, which Number() would otherwise coerce silently", () => {
+    // `Number("0.74")` is 0.74 and `Number("high")` is NaN — neither fails today, and both
+    // reach the ranking pool as a score nobody computed.
+    expect(() =>
+      assertEmbeddingFieldRows([embeddingFieldRow({ hybrid_score: "0.68" })], "match_document_embedding_fields_hybrid"),
+    ).toThrow(RetrievalRowShapeError);
+    expect(() =>
+      assertIndexUnitRows([indexUnitRow({ similarity: "0.81" })], "match_document_index_units_hybrid"),
+    ).toThrow(RetrievalRowShapeError);
+  });
+
+  it("rejects a signal row whose chunk pointer is the wrong type", () => {
+    expect(() =>
+      assertEmbeddingFieldRows([embeddingFieldRow({ source_chunk_id: 12 })], "match_document_embedding_fields_hybrid"),
+    ).toThrow(RetrievalRowShapeError);
+    expect(() => assertIndexUnitRows([indexUnitRow({ id: "" })], "match_document_index_units_hybrid")).toThrow(
+      RetrievalRowShapeError,
+    );
+  });
+
+  it("accepts a null chunk pointer, which the caller filters out itself", () => {
+    expect(() =>
+      assertEmbeddingFieldRows(
+        [embeddingFieldRow({ source_chunk_id: null })],
+        "match_document_embedding_fields_hybrid",
+      ),
+    ).not.toThrow();
+    expect(() =>
+      assertIndexUnitRows([indexUnitRow({ source_chunk_id: null })], "match_document_index_units_hybrid"),
+    ).not.toThrow();
+  });
+
+  it("pins extraction_mode to the values its check constraint allows", () => {
+    expect(() =>
+      assertIndexUnitRows([indexUnitRow({ extraction_mode: "model_heavy" })], "match_document_index_units_hybrid"),
+    ).not.toThrow();
+    expect(() =>
+      assertIndexUnitRows([indexUnitRow({ extraction_mode: "guessed" })], "match_document_index_units_hybrid"),
+    ).toThrow(RetrievalRowShapeError);
+  });
+
+  it("tolerates null collection columns the caller already coalesces", () => {
+    expect(() =>
+      assertIndexUnitRows(
+        [indexUnitRow({ heading_path: null, normalized_terms: null, source_span: null, metadata: null })],
+        "match_document_index_units_hybrid",
+      ),
+    ).not.toThrow();
+  });
+
+  it("accepts array and scalar provenance from unconstrained jsonb columns", () => {
+    expect(() =>
+      assertIndexUnitRows(
+        [indexUnitRow({ source_span: ["page", 12], metadata: "legacy-provenance" })],
+        "match_document_index_units_hybrid",
+      ),
+    ).not.toThrow();
+  });
+
+  it("preserves unknown columns on signal rows too", () => {
+    const rows: unknown = [indexUnitRow({ a_future_column: "kept" })];
+
+    assertIndexUnitRows(rows, "match_document_index_units_hybrid");
+
+    expect(rows[0]).toMatchObject({ a_future_column: "kept" });
+  });
+
+  it.each([
+    ["embedding-field", "match_document_embedding_fields_hybrid_v2", searchEmbeddingFieldCandidates],
+    ["index-unit", "match_document_index_units_hybrid_v2", searchIndexUnitCandidates],
+  ])("degrades an invalid optional %s signal instead of rejecting the whole search", async (_layer, rpc, search) => {
+    const supabase = {
+      rpc: vi.fn(async () => ({ data: [embeddingFieldRow({ hybrid_score: "0.68" })], error: null })),
+    };
+
+    await expect(
+      search({
+        supabase: supabase as never,
+        query: "lithium monitoring",
+        queryEmbedding: [0.1, 0.2],
+        matchCount: 8,
+      }),
+    ).resolves.toEqual([]);
+    expect(supabase.rpc).toHaveBeenCalledWith(rpc, expect.any(Object));
+  });
+});
diff --git a/tests/registry-service-facets.test.ts b/tests/registry-service-facets.test.ts
new file mode 100644
index 0000000000..7cb3b818d6
--- /dev/null
+++ b/tests/registry-service-facets.test.ts
@@ -0,0 +1,68 @@
+import { describe, expect, it } from "vitest";
+
+import { defaultServiceRecords } from "@/lib/registry-fixtures";
+import { recordToRow, rowToServiceRecord, type RegistryRecordRow } from "@/lib/registry-records";
+import { serviceCatalogTags, serviceFacetDimensions } from "@/lib/service-facets";
+import type { ServiceRecord } from "@/lib/services";
+
+const ownerId = "11111111-1111-4111-8111-111111111111";
+const tagDimensions = [...serviceFacetDimensions, "substance_flags"] as const;
+
+function roundTrip(record: ServiceRecord): ServiceRecord {
+  const row = recordToRow(record, ownerId, "service");
+  return rowToServiceRecord(row as RegistryRecordRow);
+}
+
+describe("registry service facet payloads", () => {
+  it("preserves all six tag dimensions for the 219 default service records", () => {
+    const records = defaultServiceRecords();
+
+    expect(records).toHaveLength(219);
+    for (const record of records) {
+      const row = recordToRow(record, ownerId, "service");
+      const restored = rowToServiceRecord(row as RegistryRecordRow);
+
+      expect(row.catalog_payload).toEqual(record.catalogPayload);
+      // Compare with the raw fixture payload rather than parsing both sides
+      // through the same helper, which could let a parser regression agree
+      // with itself.
+      expect(serviceCatalogTags(restored)).toEqual(record.catalogPayload?.tags);
+    }
+  });
+
+  it("degrades absent and malformed payloads to only their valid string-array values", () => {
+    const absent = roundTrip({ slug: "absent", title: "Absent payload" });
+    const malformedTags = roundTrip({
+      slug: "malformed-tags",
+      title: "Malformed tags",
+      catalogPayload: { tags: "not-an-object" },
+    });
+    const partiallyMalformed = roundTrip({
+      slug: "partially-malformed",
+      title: "Partially malformed tags",
+      catalogPayload: {
+        tags: {
+          catchments: [" Metro-wide ", "", 7, null],
+          age_groups: "youth",
+          setting_flags: null,
+          acuity_flags: { value: "high" },
+          substance_flags: [false, " aod "],
+          housing_flags: [null, " home_based "],
+        },
+      },
+    });
+
+    for (const record of [absent, malformedTags]) {
+      const tags = serviceCatalogTags(record);
+      for (const dimension of tagDimensions) expect(tags[dimension]).toEqual([]);
+    }
+    expect(serviceCatalogTags(partiallyMalformed)).toEqual({
+      catchments: ["Metro-wide"],
+      age_groups: [],
+      setting_flags: [],
+      acuity_flags: [],
+      substance_flags: ["aod"],
+      housing_flags: ["home_based"],
+    });
+  });
+});
diff --git a/tests/repo-hygiene.test.ts b/tests/repo-hygiene.test.ts
index ca6c4d38ae..8b417f5070 100644
--- a/tests/repo-hygiene.test.ts
+++ b/tests/repo-hygiene.test.ts
@@ -641,7 +641,15 @@ describe("outstanding-issues inbox", () => {
       payload: { pri: "P2", type: "issue", summary: "queued" },
     };
     expect(validateRequest(add)).toEqual([]);
+    const currentAdd = {
+      ...add,
+      version: 2,
+      payload: { ...add.payload, issueUlid: "0000000000ABCDEF0000000000" },
+    };
+    expect(validateRequest(currentAdd)).toEqual([]);
+    expect(validateRequest({ ...currentAdd, payload: { ...currentAdd.payload, issueUlid: "bad" } })).not.toEqual([]);
     expect(validateRequest({ ...add, action: "done", payload: { outcome: "no id" } })).not.toEqual([]);
+    expect(validateRequest({ ...add, action: "done", payload: { id: "#ABCDEF", outcome: "done" } })).toEqual([]);
 
     const ledger = [
       "<!-- issues:next-id=2 -->",
@@ -671,7 +679,9 @@ describe("outstanding-issues inbox", () => {
       "| #000 | issue | old | done | 2026-01-01 |",
       "",
     ].join("\n");
-    expect(applyRequest(ledger, add)).toContain("| #002 | P2 | issue | queued |");
+    const applied = applyRequest(ledger, currentAdd);
+    expect(applied).toContain("| #ABCDEF <!-- issue-ulid:0000000000ABCDEF0000000000 --> | P2 | issue | queued |");
+    expect(applied).toContain("<!-- issues:next-id=2 -->");
   });
 
   it("rejects stale done/update requests when the row hash changed after queueing", () => {
diff --git a/tests/search-command-surface.test.ts b/tests/search-command-surface.test.ts
index b2d351ba3f..86bef4ef45 100644
--- a/tests/search-command-surface.test.ts
+++ b/tests/search-command-surface.test.ts
@@ -6,6 +6,7 @@ import {
   commandDropdownCanDisplay,
   commandDropdownMinimumWidthMediaQuery,
   commandDropdownPointerMediaQuery,
+  commandSurfaceRemoteSearchEnabled,
   differentialRedFlagTerms,
   filteredSuggestions,
   isFormCodeQuery,
@@ -46,6 +47,12 @@ describe("search command surface", () => {
     expect(specifiers?.crossModes).toContain("formulation");
   });
 
+  it("keeps calculator suggestions local while preserving remote typeahead elsewhere", () => {
+    expect(commandSurfaceRemoteSearchEnabled("calculators")).toBe(false);
+    expect(commandSurfaceRemoteSearchEnabled("documents")).toBe(true);
+    expect(commandSurfaceRemoteSearchEnabled("therapy-compass")).toBe(false);
+  });
+
   it("detects form code queries", () => {
     expect(isFormCodeQuery("form 3A")).toBe(true);
     expect(isFormCodeQuery("form 12")).toBe(true);
diff --git a/tests/search-results-band-adoption.test.ts b/tests/search-results-band-adoption.test.ts
index 6cc94f140f..977b43bd11 100644
--- a/tests/search-results-band-adoption.test.ts
+++ b/tests/search-results-band-adoption.test.ts
@@ -152,8 +152,8 @@ function routePathname(routeAbs: string): string {
  * the band through their own page:
  * - `isAlwaysStandaloneShellPath` — never mounts the dashboard (services, forms, …)
  * - `isStandaloneModeHomePath` — mode homes with their own results page, including
- *   `/tools`, whose page switches between `ApplicationsLauncherPage` and its
- *   route-owned submitted-results component
+ *   `/tools`, whose default and submitted states both mount its route-owned
+ *   `ToolsSearchResultsPage`
  */
 function reachabilityRoots(routeAbs: string): string[] {
   const pathname = routePathname(routeAbs);
diff --git a/tests/search-route-ownership.test.ts b/tests/search-route-ownership.test.ts
index 5bc195271b..b62eb3704f 100644
--- a/tests/search-route-ownership.test.ts
+++ b/tests/search-route-ownership.test.ts
@@ -2,6 +2,8 @@ import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { describe, expect, it } from "vitest";
 
+import { sourceFrom, sourceSegment } from "./helpers/source-contract";
+
 import {
   isAlwaysStandaloneShellPath,
   isDashboardModeHref,
@@ -23,6 +25,7 @@ describe("shared-search route ownership", () => {
       "formulation",
       "therapy-compass",
       "tools",
+      "calculators",
     ] as const) {
       expect(shouldRenderDashboardSearch({ hasSubmittedSearch: true, mode, pathname: `/${mode}` })).toBe(false);
     }
@@ -65,6 +68,7 @@ describe("shared-search route ownership", () => {
       "/factsheets",
       "/therapy-compass",
       "/tools",
+      "/calculators",
       "/documents",
       "/medications",
     ]) {
@@ -227,13 +231,18 @@ describe("shared-search route ownership", () => {
 
   it("keeps the mode pill from navigating while the shared home is showing", () => {
     const dashboardSource = readFileSync(resolve(process.cwd(), "src/components/ClinicalDashboard.tsx"), "utf8");
-    const selectSearchMode = dashboardSource.slice(dashboardSource.indexOf("function selectSearchMode("));
+    const selectSearchMode = sourceFrom(dashboardSource, "function selectSearchMode(", {
+      label: "selectSearchMode",
+    });
 
     // Isolate the shared-home branch so the negative assertions below cannot be
-    // satisfied by unrelated code further down selectSearchMode.
-    const branchStart = selectSearchMode.indexOf("if (showSharedHome) {");
-    expect(branchStart).toBeGreaterThan(-1);
-    const sharedHomeBranch = selectSearchMode.slice(branchStart, selectSearchMode.indexOf("\n    }", branchStart));
+    // satisfied by unrelated code further down selectSearchMode. The end marker
+    // is an indentation depth, which is why it goes through the guarded helper:
+    // unguarded, a reformat would turn every negative assertion below into a
+    // vacuous pass rather than a failure.
+    const sharedHomeBranch = sourceSegment(selectSearchMode, "if (showSharedHome) {", "\n    }", {
+      label: "selectSearchMode shared-home branch",
+    });
 
     // `/` is the single home page. On it the pill only retargets the composer:
     // rewrite `?mode=` in place, never push a route and never re-render the page.
@@ -253,14 +262,18 @@ describe("shared-search route ownership", () => {
     // Returning home must invalidate the in-flight search before clearing UI —
     // the dashboard stays mounted, so a late applySearchResult would otherwise
     // restore the old answer and rewrite run=1 over the draft home.
-    const leaveResultsBranch = selectSearchMode.slice(
-      selectSearchMode.indexOf("// Outside the shared home"),
-      selectSearchMode.indexOf("function stageAnswerFollowUpDraft"),
+    const leaveResultsBranch = sourceSegment(
+      selectSearchMode,
+      "// Outside the shared home",
+      "function stageAnswerFollowUpDraft",
+      { label: "selectSearchMode leave-results branch" },
     );
     expect(leaveResultsBranch).toMatch(/stopSearch\(\);\s*clearModeResultState\(\);/);
-    expect(selectSearchMode.slice(0, selectSearchMode.indexOf("function stageAnswerFollowUpDraft"))).not.toContain(
-      "crossModeSearch(mode, carriedQuery)",
-    );
+    expect(
+      sourceSegment(selectSearchMode, "function selectSearchMode(", "function stageAnswerFollowUpDraft", {
+        label: "selectSearchMode before stageAnswerFollowUpDraft",
+      }),
+    ).not.toContain("crossModeSearch(mode, carriedQuery)");
     expect(dashboardSource).toContain('if (pathname === "/" && !submittedUrlRunRequested) return;');
     expect(dashboardSource).toContain("if (modeChangeFromUiRef.current && !submittedUrlModeMatchesActive) return;");
     // Ask-this / cross-mode into Answer must not depend solely on auto-run: the
@@ -269,7 +282,7 @@ describe("shared-search route ownership", () => {
       /if \(mode === "answer" \|\| mode === "documents"\) \{[\s\S]*?void executeSearch\(crossQuery, mode/,
     );
     expect(dashboardSource).toMatch(
-      /const showSharedHome =\s*isHomeRoute &&\s*!submittedUrlRunRequested &&[\s\S]*?!submittedAnswerSearchActive;/,
+      /const showSharedHome = shouldShowSharedHome\(\{[\s\S]*?pathname,[\s\S]*?mode: searchParams\.get\("mode"\),[\s\S]*?submittedAnswerSearchActive,[\s\S]*?\}\);/,
     );
   });
 
diff --git a/tests/search-shell-props.test.ts b/tests/search-shell-props.test.ts
index 9f4d247dc1..b39b076779 100644
--- a/tests/search-shell-props.test.ts
+++ b/tests/search-shell-props.test.ts
@@ -28,6 +28,17 @@ describe("searchShellPropsForPathname", () => {
     });
   });
 
+  it("keeps tools in the hero from tablet up and uses the shared phone footer", () => {
+    const expectedToolsShell = {
+      initialMode: "tools",
+      desktopSearchPlacement: "hero",
+      mobileHomeComposerPlacement: "footer",
+    } as const;
+
+    expect(searchShellPropsForPathname("/tools")).toEqual(expectedToolsShell);
+    expect(searchShellPropsForPathname("/tools/interaction-checker")).toEqual(expectedToolsShell);
+  });
+
   it("maps therapy and home fallbacks", () => {
     expect(searchShellPropsForPathname("/therapy-compass/search")).toEqual({
       initialMode: "therapy-compass",
@@ -35,10 +46,10 @@ describe("searchShellPropsForPathname", () => {
     expect(searchShellPropsForPathname("/")).toEqual({ initialMode: "answer" });
   });
 
-  it("hides the shell composer on calculators (page-owned)", () => {
+  it("assigns calculator home and results search to the shared shell", () => {
     expect(searchShellPropsForPathname("/calculators")).toEqual({
-      initialMode: "tools",
-      searchComposerVisible: false,
+      initialMode: "calculators",
+      desktopSearchPlacement: "hero",
     });
   });
 });
diff --git a/tests/services-bookmark-readiness.dom.test.tsx b/tests/services-bookmark-readiness.dom.test.tsx
new file mode 100644
index 0000000000..953c3ea8b5
--- /dev/null
+++ b/tests/services-bookmark-readiness.dom.test.tsx
@@ -0,0 +1,145 @@
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { describe, expect, it, vi } from "vitest";
+
+import { loadServicesSnapshot } from "@/lib/service-catalog";
+import { mapCatalogToServiceRecords } from "@/lib/service-catalog-mapper";
+
+const registryRecords = mapCatalogToServiceRecords(loadServicesSnapshot().services).slice(0, 3);
+
+const accountState = vi.hoisted(() => ({ ready: true, loadError: null as string | null, saved: [] as string[] }));
+const setFavourite = vi.hoisted(() => vi.fn(async () => true));
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: vi.fn(), replace: vi.fn() }),
+  useSearchParams: () => new URLSearchParams(""),
+}));
+
+vi.mock("next/link", () => ({
+  default: ({ children, href, ...rest }: { children: ReactNode; href: string }) => (
+    <a href={href} {...rest}>
+      {children}
+    </a>
+  ),
+}));
+
+vi.mock("@/lib/use-registry-records", () => ({
+  useRegistryRecords: () => ({
+    status: "ready",
+    records: registryRecords,
+    total: registryRecords.length,
+    demoMode: true,
+    governance: {},
+    refetch: vi.fn(),
+  }),
+}));
+
+vi.mock("@/components/use-result-sort", () => ({
+  useResultSort: () => ["relevance", vi.fn()] as const,
+}));
+
+vi.mock("@/components/clinical-dashboard/universal-search-also-matches", () => ({
+  UniversalSearchAlsoMatches: () => null,
+}));
+
+vi.mock("@/components/account-data-provider", () => ({
+  useAccountData: () => ({
+    favourites: { service: accountState.saved, form: [], differential: [] },
+    ready: accountState.ready,
+    loadError: accountState.loadError,
+    error: null,
+    isAuthenticated: true,
+    isSaved: (_type: string, key: string) => accountState.saved.includes(key),
+    setFavourite,
+    clearFavourites: vi.fn(async () => true),
+    reload: vi.fn(),
+  }),
+}));
+
+import { ServicesNavigatorPage } from "@/components/services/services-navigator-page";
+
+/**
+ * Regression cover for the readiness half of the bookmark control.
+ *
+ * `AccountDataProvider` initialises `ready` to `auth.status !== "authenticated"`,
+ * so for a signed-in reader it is FALSE until the favourites GET resolves, and
+ * `favourites` is empty for that whole window. `isSaved()` therefore answers
+ * "no" for every service — not because nothing is saved, but because nothing has
+ * been read yet. Without a readiness gate the row asserts "Save X to favourites"
+ * on a service the reader has already saved, and a tap issues a redundant write
+ * inverting a state that was never loaded.
+ */
+describe("services result bookmark readiness", () => {
+  it("does not assert a saved state while the account read is still in flight", () => {
+    accountState.ready = false;
+    accountState.saved = [registryRecords[0]!.slug];
+    render(<ServicesNavigatorPage />);
+
+    const control = screen.getByRole("button", { name: `Loading saved state for ${registryRecords[0]!.title}` });
+    expect(control).toBeDisabled();
+    // The critical assertion: it must not claim "not saved" for a service that
+    // IS saved. No aria-pressed at all beats a confidently wrong one.
+    expect(control).not.toHaveAttribute("aria-pressed");
+    expect(
+      screen.queryByRole("button", { name: `Save ${registryRecords[0]!.title} to favourites` }),
+    ).not.toBeInTheDocument();
+  });
+
+  it("reports the real saved state once the read settles", () => {
+    accountState.ready = true;
+    accountState.loadError = null;
+    accountState.saved = [registryRecords[0]!.slug];
+    render(<ServicesNavigatorPage />);
+
+    const saved = screen.getByRole("button", { name: `Remove ${registryRecords[0]!.title} from favourites` });
+    expect(saved).toBeEnabled();
+    expect(saved).toHaveAttribute("aria-pressed", "true");
+
+    const unsaved = screen.getByRole("button", { name: `Save ${registryRecords[1]!.title} to favourites` });
+    expect(unsaved).toHaveAttribute("aria-pressed", "false");
+  });
+
+  it("does not assert or mutate saved state after the account read fails", () => {
+    accountState.ready = true;
+    accountState.loadError = "Saved items could not be loaded.";
+    accountState.saved = [];
+    render(<ServicesNavigatorPage />);
+
+    const control = screen.getByRole("button", {
+      name: `Saved state unavailable for ${registryRecords[0]!.title}`,
+    });
+    expect(control).toBeDisabled();
+    expect(control).not.toHaveAttribute("aria-pressed");
+    fireEvent.click(control);
+    expect(setFavourite).not.toHaveBeenCalled();
+  });
+
+  it("serializes in-flight mutations across result rows", async () => {
+    accountState.ready = true;
+    accountState.loadError = null;
+    accountState.saved = [];
+    let finishSave: ((saved: boolean) => void) | undefined;
+    setFavourite.mockImplementationOnce(
+      () =>
+        new Promise<boolean>((resolve) => {
+          finishSave = resolve;
+        }),
+    );
+    render(<ServicesNavigatorPage />);
+
+    const control = screen.getByRole("button", { name: `Save ${registryRecords[0]!.title} to favourites` });
+    const siblingControl = screen.getByRole("button", {
+      name: `Save ${registryRecords[1]!.title} to favourites`,
+    });
+    fireEvent.click(control);
+
+    await waitFor(() => expect(control).toBeDisabled());
+    expect(siblingControl).toBeDisabled();
+    fireEvent.click(control);
+    fireEvent.click(siblingControl);
+    expect(setFavourite).toHaveBeenCalledTimes(1);
+
+    finishSave?.(true);
+    await waitFor(() => expect(control).toBeEnabled());
+  });
+});
diff --git a/tests/services-catalog.test.ts b/tests/services-catalog.test.ts
index 9372e9e80e..9f769f6052 100644
--- a/tests/services-catalog.test.ts
+++ b/tests/services-catalog.test.ts
@@ -3,7 +3,14 @@ import { describe, expect, it } from "vitest";
 import { compactBestUseTitle, compactCatalogField, parseLabeledReferralDetails } from "@/lib/compact-best-use-title";
 import { catalogToServiceRecord, mapCatalogToServiceRecords } from "@/lib/service-catalog-mapper";
 import { loadServicesSnapshot, normalizeCatalogServices } from "@/lib/service-catalog";
-import { readServiceCoreGroup, serviceCoreGroupIds, serviceMatchesCoreGroup } from "@/lib/service-core-groups";
+import {
+  readServiceCoreGroup,
+  readServiceCoreGroupSelection,
+  serviceCoreGroupIds,
+  serviceMatchesCoreGroup,
+  serviceMatchesCoreGroupSelection,
+  writeServiceCoreGroupSelectionToParams,
+} from "@/lib/service-core-groups";
 import {
   getServiceRecord,
   loadServiceRecords,
@@ -240,6 +247,25 @@ describe("services catalogue", () => {
     expect(crossFieldOnly).toBe(false);
   });
 
+  it("round-trips overlapping browse groups as a multi-select filter", () => {
+    const selection = readServiceCoreGroupSelection("urgent,public,unknown,urgent");
+    expect([...selection]).toEqual(["urgent", "public"]);
+
+    const yarn = loadServiceRecords().find((service) => service.slug === "13yarn");
+    expect(yarn).toBeDefined();
+    expect(serviceMatchesCoreGroupSelection(yarn!, selection)).toBe(true);
+    expect(serviceMatchesCoreGroupSelection(yarn!, new Set())).toBe(true);
+
+    const params = new URLSearchParams("q=13YARN&run=1");
+    writeServiceCoreGroupSelectionToParams(params, readServiceCoreGroupSelection("aod,urgent"));
+    expect(params.get("group")).toBe("urgent,aod");
+    expect(params.get("q")).toBe("13YARN");
+
+    writeServiceCoreGroupSelectionToParams(params, new Set());
+    expect(params.has("group")).toBe(false);
+    expect(params.get("q")).toBe("13YARN");
+  });
+
   it("normalizes service lookup", () => {
     expect(getServiceRecord(" 13YARN ")?.title).toBe("13YARN");
     expect(getServiceRecord("missing-service")).toBeNull();
diff --git a/tests/services-navigator-scope-empty-state.dom.test.tsx b/tests/services-navigator-scope-empty-state.dom.test.tsx
index d9a6d27e7a..6036ff522b 100644
--- a/tests/services-navigator-scope-empty-state.dom.test.tsx
+++ b/tests/services-navigator-scope-empty-state.dom.test.tsx
@@ -47,6 +47,23 @@ vi.mock("@/components/clinical-dashboard/universal-search-also-matches", () => (
   UniversalSearchAlsoMatches: () => null,
 }));
 
+// The result row's bookmark reads account favourites. Stubbed rather than
+// wrapped in the real provider so this file keeps testing scope/facet
+// behaviour without also exercising the account fetch.
+vi.mock("@/components/account-data-provider", () => ({
+  useAccountData: () => ({
+    favourites: { service: [], form: [], differential: [] },
+    ready: true,
+    loadError: null,
+    error: null,
+    isAuthenticated: false,
+    isSaved: () => false,
+    setFavourite: vi.fn(async () => true),
+    clearFavourites: vi.fn(async () => true),
+    reload: vi.fn(),
+  }),
+}));
+
 import { ServicesNavigatorPage } from "@/components/services/services-navigator-page";
 
 describe("services scope segment vs the query-empty state", () => {
diff --git a/tests/shared-home-empty-state.dom.test.tsx b/tests/shared-home-empty-state.dom.test.tsx
index a573e05236..4dec57d65d 100644
--- a/tests/shared-home-empty-state.dom.test.tsx
+++ b/tests/shared-home-empty-state.dom.test.tsx
@@ -66,6 +66,11 @@ const expectedPresentations = [
     title: "Clinical Tools",
     iconClass: "lucide-wrench",
   },
+  {
+    modeId: "calculators",
+    title: "Clinical Calculators",
+    iconClass: "lucide-calculator",
+  },
   {
     modeId: "therapy-compass",
     title: "Therapy Compass",
diff --git a/tests/sheet.dom.test.tsx b/tests/sheet.dom.test.tsx
index 803d15eada..311caf86ce 100644
--- a/tests/sheet.dom.test.tsx
+++ b/tests/sheet.dom.test.tsx
@@ -236,6 +236,63 @@ describe("Sheet stacked-overlay coordination", () => {
     expect(classes).not.toContain("sm:max-h-[88dvh]");
   });
 
+  it("protects fullscreen and opted-in near-full headers without padding short bottom sheets", () => {
+    const { rerender } = render(
+      <Sheet open onClose={vi.fn()} title="Fullscreen" mobilePlacement="fullscreen">
+        <p>Body</p>
+      </Sheet>,
+    );
+
+    let dialog = screen.getByRole("dialog");
+    let header = dialog.querySelector<HTMLElement>('[data-sheet-header="true"]');
+    expect(dialog).toHaveAttribute("data-mobile-header-safe-area", "padding");
+    expect(header).not.toBeNull();
+    expect(header!.classList).toContain("pt-[max(1rem,var(--safe-area-top))]");
+
+    rerender(
+      <Sheet open onClose={vi.fn()} title="Short bottom sheet">
+        <p>Body</p>
+      </Sheet>,
+    );
+    dialog = screen.getByRole("dialog");
+    header = dialog.querySelector<HTMLElement>('[data-sheet-header="true"]');
+    expect(dialog).toHaveAttribute("data-mobile-header-safe-area", "none");
+    expect(header!.classList).not.toContain("pt-[max(1rem,var(--safe-area-top))]");
+
+    rerender(
+      <Sheet open onClose={vi.fn()} title="Near-full bottom sheet" mobileHeaderSafeArea="padding">
+        <p>Body</p>
+      </Sheet>,
+    );
+    dialog = screen.getByRole("dialog");
+    header = dialog.querySelector<HTMLElement>('[data-sheet-header="true"]');
+    expect(dialog).toHaveAttribute("data-mobile-header-safe-area", "padding");
+    expect(header!.classList).toContain("pt-[max(1rem,var(--safe-area-top))]");
+    expect(header!.classList).toContain("sm:pt-5");
+  });
+
+  it("offsets an absolutely positioned header below the phone safe area", () => {
+    render(
+      <Sheet
+        open
+        onClose={vi.fn()}
+        title="Overlay header"
+        mobileHeaderSafeArea="offset"
+        headerClassName="absolute right-3 top-3 p-0 sm:right-4 sm:top-4"
+      >
+        <p>Body</p>
+      </Sheet>,
+    );
+
+    const dialog = screen.getByRole("dialog");
+    const header = dialog.querySelector<HTMLElement>('[data-sheet-header="true"]');
+    expect(dialog).toHaveAttribute("data-mobile-header-safe-area", "offset");
+    expect(header).not.toBeNull();
+    expect(header!.classList).toContain("top-[max(0.75rem,var(--safe-area-top))]");
+    expect(header!.classList).toContain("sm:top-4");
+    expect(header!.classList).not.toContain("top-3");
+  });
+
   it("keeps the dialog mounted in production when the title resolves empty", () => {
     vi.stubEnv("NODE_ENV", "production");
     try {
diff --git a/tests/source-contract-helper.test.ts b/tests/source-contract-helper.test.ts
new file mode 100644
index 0000000000..944a9e05b8
--- /dev/null
+++ b/tests/source-contract-helper.test.ts
@@ -0,0 +1,63 @@
+import { describe, expect, it } from "vitest";
+
+import { sourceFrom, sourceSegment } from "./helpers/source-contract";
+
+const file = ["const before = 1;", "function target() {", "  return inner;", "}", "const after = 2;"].join("\n");
+
+describe("sourceSegment", () => {
+  it("returns the window between the markers", () => {
+    expect(sourceSegment(file, "function target()", "const after")).toContain("return inner;");
+    expect(sourceSegment(file, "function target()", "const after")).not.toContain("const before");
+  });
+
+  it("throws instead of silently widening to the rest of the file when the end marker is gone", () => {
+    // This is the whole point of the helper. The raw idiom
+    // `slice(indexOf(start), indexOf(missing))` becomes `slice(n, -1)` — the
+    // rest of the file — and every positive assertion in the window then
+    // passes for the wrong reason.
+    expect(() => sourceSegment(file, "function target()", "const renamed")).toThrow(/end marker not found/);
+
+    // Demonstrating the raw idiom's behaviour so the hazard is pinned, not
+    // just described: `slice(n, -1)` reaches the end of the file bar the final
+    // character, so content far outside the intended window is now in scope.
+    const silentlyWrong = file.slice(file.indexOf("function target()"), file.indexOf("const renamed"));
+    expect(silentlyWrong).toContain("const after = 2");
+  });
+
+  it("throws instead of returning a vacuous window when the start marker is gone", () => {
+    expect(() => sourceSegment(file, "function missing()", "const after")).toThrow(/start marker not found/);
+  });
+
+  it("rejects an ambiguous start marker, which would scope the window to the first hit only", () => {
+    const twice = ["render(<Panel />);", "const x = 1;", "render(<Panel />);", "const y = 2;"].join("\n");
+    expect(() => sourceSegment(twice, "render(<Panel />);", "const y")).toThrow(/occurs more than once/);
+    expect(sourceSegment(twice, "render(<Panel />);", "const y", { allowRepeatedStart: true })).toContain("const x");
+  });
+
+  it("rejects overlapping repeated start markers", () => {
+    expect(() => sourceSegment("aaa END", "aa", " END")).toThrow(/occurs more than once/);
+  });
+
+  it("rejects an empty marker instead of returning a misleading window", () => {
+    expect(() => sourceSegment(file, "function target()", "")).toThrow(/end marker must not be empty/);
+    expect(() => sourceSegment(file, "", "const after")).toThrow(/start marker must not be empty/);
+  });
+
+  it("names the contract in the failure when a label is given", () => {
+    expect(() => sourceSegment(file, "function missing()", "const after", { label: "mode menu focus" })).toThrow(
+      /^mode menu focus: start marker not found/,
+    );
+  });
+});
+
+describe("sourceFrom", () => {
+  it("runs to end of file and still guards the start marker", () => {
+    expect(sourceFrom(file, "function target()")).toContain("const after = 2;");
+    expect(() => sourceFrom(file, "function missing()")).toThrow(/start marker not found/);
+  });
+
+  it("rejects overlapping and empty start markers", () => {
+    expect(() => sourceFrom("aaa END", "aa")).toThrow(/occurs more than once/);
+    expect(() => sourceFrom(file, "")).toThrow(/start marker must not be empty/);
+  });
+});
diff --git a/tests/therapy-compass-responsive-contract.test.ts b/tests/therapy-compass-responsive-contract.test.ts
index 5232610d24..c1ac7efec8 100644
--- a/tests/therapy-compass-responsive-contract.test.ts
+++ b/tests/therapy-compass-responsive-contract.test.ts
@@ -2,6 +2,8 @@ import { existsSync, readFileSync } from "node:fs";
 
 import { describe, expect, it } from "vitest";
 
+import { sourceSegment } from "./helpers/source-contract";
+
 const read = (relativePath: string) => readFileSync(new URL(`../${relativePath}`, import.meta.url), "utf8");
 const therapyPath = "src/components/therapy-compass";
 
@@ -146,10 +148,9 @@ describe("Therapy Compass responsive contract", () => {
   });
 
   it("lets result-card evidence and actions use the phone width without forcing the desktop grid", () => {
-    const resultCardSource = therapyCardSource.slice(
-      therapyCardSource.indexOf("export function ResultCard"),
-      therapyCardSource.indexOf("function CardCell"),
-    );
+    const resultCardSource = sourceSegment(therapyCardSource, "export function ResultCard", "function CardCell", {
+      label: "therapy ResultCard",
+    });
 
     expect(resultCardSource).toContain("data-therapy-result-card");
     expect(resultCardSource).toContain("md:grid-cols-[minmax(240px,1fr)_minmax(320px,1.35fr)]");
diff --git a/tests/tools-search-directions-mockups.test.ts b/tests/tools-search-directions-mockups.test.ts
index 5f09bfffa7..d0068cf764 100644
--- a/tests/tools-search-directions-mockups.test.ts
+++ b/tests/tools-search-directions-mockups.test.ts
@@ -5,6 +5,7 @@ import { describe, expect, it } from "vitest";
 import { submittedToolIdsForMockup } from "../src/components/tools-search-directions-mockups";
 import { normalizeSearchText } from "../src/lib/catalog-search";
 import { toolCatalogRecords, toolSearchText } from "../src/lib/tools-catalog";
+import { sourceSegment } from "./helpers/source-contract";
 
 const source = readFileSync(new URL("../src/components/tools-search-directions-mockups.tsx", import.meta.url), "utf8");
 
@@ -23,7 +24,9 @@ describe("tools search direction mockup evidence", () => {
   });
 
   it("shows both representative queries at both widths for every direction", () => {
-    const showcase = source.slice(source.indexOf("function DirectionShowcase"), source.indexOf("const currentDefects"));
+    const showcase = sourceSegment(source, "function DirectionShowcase", "const currentDefects", {
+      label: "direction showcase frames",
+    });
     expect(showcase).toContain('<DeviceFrame direction={direction.id} query="monitoring" device="phone" />');
     expect(showcase).toContain('<DeviceFrame direction={direction.id} query="compare" device="phone" />');
     expect(showcase).toContain('<DeviceFrame direction={direction.id} query="monitoring" device="desktop" />');
@@ -35,10 +38,9 @@ describe("tools search direction mockup evidence", () => {
   });
 
   it("keeps the ranked filter only for multi-match frames at both widths", () => {
-    const brief = source.slice(
-      source.indexOf("function BriefDirection"),
-      source.indexOf("function SegmentedCountBand"),
-    );
+    const brief = sourceSegment(source, "function BriefDirection", "function SegmentedCountBand", {
+      label: "brief direction ranked filter",
+    });
     expect(brief).toContain('device === "desktop" && matches.length > 1');
     expect(brief).toContain('device === "phone" && matches.length > 1');
     expect(brief).not.toContain('device === "desktop" ? <AreaFilterRow');
diff --git a/tests/ui-forms-section-nav.spec.ts b/tests/ui-forms-section-nav.spec.ts
index 3579c4a040..af3ba84732 100644
--- a/tests/ui-forms-section-nav.spec.ts
+++ b/tests/ui-forms-section-nav.spec.ts
@@ -26,6 +26,30 @@ const FORM_ROUTE = "/forms/transport-crisis-form";
 
 // Adoption evidence: these browser regressions exercise DisclosureGroup.items[].extendDescription.
 test.describe("Forms section navigation", () => {
+  test("keeps information rows inside the mobile viewport", async ({ page }) => {
+    for (const width of [320, 390, 639]) {
+      await page.setViewportSize({ width, height: 844 });
+      await page.goto(FORM_ROUTE, { waitUntil: "domcontentloaded" });
+
+      const section = page.getByRole("region", { name: "Form information" });
+      await expect(section).toBeVisible({ timeout: 20_000 });
+
+      const geometry = await section.locator('[data-testid="disclosure"]').evaluateAll((rows) =>
+        rows.map((row) => {
+          const bounds = row.getBoundingClientRect();
+          return { left: bounds.left, right: bounds.right, width: bounds.width };
+        }),
+      );
+
+      expect(geometry.length).toBeGreaterThan(0);
+      for (const row of geometry) {
+        expect(row.left, `${width}px row must not cross the left viewport edge`).toBeGreaterThanOrEqual(0);
+        expect(row.right, `${width}px row must not cross the right viewport edge`).toBeLessThanOrEqual(width + 1);
+        expect(row.width, `${width}px row must retain a usable width`).toBeGreaterThan(0);
+      }
+    }
+  });
+
   test("expands information previews into one continuous answer", async ({ page }) => {
     await page.setViewportSize({ width: 390, height: 844 });
     await page.goto(FORM_ROUTE, { waitUntil: "domcontentloaded" });
diff --git a/tests/ui-overlay-css-contract.test.ts b/tests/ui-overlay-css-contract.test.ts
index 20bd27e860..1fa4b81e73 100644
--- a/tests/ui-overlay-css-contract.test.ts
+++ b/tests/ui-overlay-css-contract.test.ts
@@ -215,7 +215,7 @@ describe("overlay and global CSS contracts", () => {
     expect(browserMediaBlock).toContain("var(--mobile-composer-reserve, 0rem)");
     expect(masterSearchHeaderSource).toContain("phone-footer-layer");
     expect(documentViewerSource).toContain("phone-footer-layer document-viewer-composer");
-    expect(calculatorSearchSource).toContain("phone-footer-layer answer-footer-search-dock");
+    expect(calculatorSearchSource).not.toContain("phone-footer-layer");
     expect(differentialPresentationSource).toContain("phone-footer-layer inset-x-0 bottom-0");
     expect(differentialPresentationSource).not.toContain('className="fixed inset-x-0 bottom-0');
     expect(globalSearchShellSource).toContain("phone-viewport-shell");
diff --git a/tests/ui-phone-scroll-page-owned.spec.ts b/tests/ui-phone-scroll-page-owned.spec.ts
index b147b8e626..baffbede31 100644
--- a/tests/ui-phone-scroll-page-owned.spec.ts
+++ b/tests/ui-phone-scroll-page-owned.spec.ts
@@ -17,7 +17,7 @@ import { expectSingleSettledOwner } from "./playwright-settlement";
 
 /**
  * Page-owned phone chrome: the document viewer's own composer, the standalone
- * frame-owned footers, the calculators dock, and the Services result canvas.
+ * frame-owned footers and the Services result canvas.
  *
  * These surfaces own their composer instead of using the shell's, so their
  * hide/reveal and reserve behaviour is independent of the shared header swept in
@@ -837,10 +837,20 @@ test("Services results keep a continuous browser viewport after shared chrome re
   );
 });
 
-test("calculator results stay inside narrow phone viewports", async ({ page }) => {
-  for (const width of [320, 390]) {
-    await page.setViewportSize({ width, height: 844 });
-    await gotoPhoneSurface(page, "/calculators", 112);
+test("calculator results stay usable across the responsive and accessibility matrix", async ({ page }) => {
+  const viewports = [
+    { width: 320, height: 740 },
+    { width: 390, height: 844 },
+    { width: 639, height: 900 },
+    { width: 768, height: 1024 },
+    { width: 1440, height: 900 },
+    { width: 1920, height: 1080 },
+  ] as const;
+
+  for (const { width, height } of viewports) {
+    await page.emulateMedia({ colorScheme: "light", forcedColors: "none", reducedMotion: "no-preference" });
+    await page.setViewportSize({ width, height });
+    await gotoPhoneSurface(page, "/calculators?q=depression&run=1", 112);
 
     const pageSurface = page.getByTestId("calculators-search-page");
     const geometry = await pageSurface.evaluate((element) => ({
@@ -851,10 +861,10 @@ test("calculator results stay inside narrow phone viewports", async ({ page }) =
       geometry.clientWidth + 1,
     );
 
-    for (const control of [
-      page.getByRole("button", { name: "Filters" }),
-      page.getByRole("button", { name: /^Open PHQ-9/ }),
-    ]) {
+    const filterTrigger = page.getByTestId(
+      width < 640 ? "calculators-filter-trigger-phone" : "calculators-filter-trigger-desktop",
+    );
+    for (const control of [filterTrigger, page.getByRole("button", { name: /^Open PHQ-9/ })]) {
       const box = await control.boundingBox();
       expect(box, `${width}px calculator control should be rendered`).not.toBeNull();
       expect(box!.x, `${width}px calculator control starts inside the viewport`).toBeGreaterThanOrEqual(0);
@@ -862,351 +872,35 @@ test("calculator results stay inside narrow phone viewports", async ({ page }) =
         width + 1,
       );
     }
-  }
-});
-
-test("calculators page-owned phone dock uses localized glass and releases its reserve when hidden", async ({
-  page,
-}) => {
-  await page.emulateMedia({ reducedMotion: "no-preference" });
-  await page.setViewportSize(phoneViewport);
-  await gotoPhoneSurface(page, "/calculators", 112);
-
-  const dock = page.getByTestId("calculators-phone-dock");
-  const pageSurface = page.getByTestId("calculators-search-page");
-  await expect(dock).toBeVisible();
-
-  const visible = await dock.evaluate((element) => {
-    const backdrop = element.querySelector<HTMLElement>(".answer-footer-search-backdrop");
-    const dockRect = element.getBoundingClientRect();
-    const backdropStyle = backdrop ? getComputedStyle(backdrop) : null;
-    return {
-      background: getComputedStyle(element).backgroundColor,
-      left: dockRect.left,
-      right: dockRect.right,
-      bottom: dockRect.bottom,
-      backdropDisplay: backdropStyle?.display ?? "missing",
-      backdropPosition: backdropStyle?.position ?? "missing",
-      backdropPaint: backdropStyle?.backgroundImage ?? "",
-      backdropHasTranslucentStop: /transparent|\/\s*(?:0?\.)\d+/.test(backdropStyle?.backgroundImage ?? ""),
-    };
-  });
-  expect(visible.background).toBe("rgba(0, 0, 0, 0)");
-  expect(visible.left).toBeCloseTo(0, 0);
-  expect(visible.right).toBeCloseTo(phoneViewport.width, 0);
-  expect(visible.bottom).toBeCloseTo(phoneViewport.height, 0);
-  expect(visible.backdropDisplay).toBe("block");
-  expect(visible.backdropPosition).toBe("absolute");
-  expect(visible.backdropPaint).toContain("gradient");
-  expect(visible.backdropHasTranslucentStop).toBe(true);
-  await expect
-    .poll(async () =>
-      Number.parseFloat(await pageSurface.evaluate((element) => getComputedStyle(element).paddingBottom)),
-    )
-    .toBeGreaterThan(112);
-
-  // This journey owns the visible/hidden paint contract. Give it explicit
-  // runway so the separate near-bottom tests remain the sole owner of the
-  // intentional anti-clamp behavior on naturally short calculator pages.
-  await addPhoneScrollRunway(page);
-  const geometry = await readGeometry(page);
-  await dragScrollBy(page, Math.min(Math.max(geometry.maxOffset, 500), 900), 24);
-  await expect(dock).toHaveAttribute("data-scroll-hidden", "true");
-  await page.waitForTimeout(300);
-
-  const hidden = await dock.evaluate((element) => {
-    const rect = element.getBoundingClientRect();
-    return { opacity: getComputedStyle(element).opacity, top: rect.top, viewportHeight: window.innerHeight };
-  });
-  expect(hidden.opacity).toBe("0");
-  expect(hidden.top).toBeGreaterThanOrEqual(hidden.viewportHeight - 1);
-  await expect
-    .poll(async () =>
-      Number.parseFloat(await pageSurface.evaluate((element) => getComputedStyle(element).paddingBottom)),
-    )
-    .toBeLessThanOrEqual(1);
-
-  await dragScrollBy(page, -48, 8);
-  await expect(dock).not.toHaveAttribute("data-scroll-hidden", "true");
-});
-
-test("calculator dock clears its focus pin after a focused submit opens and closes a sheet", async ({ page }) => {
-  await page.setViewportSize(phoneViewport);
-  await gotoPhoneSurface(page, "/calculators", 112);
-
-  const dock = page.getByTestId("calculators-phone-dock");
-  const input = dock.getByRole("searchbox", { name: "Search calculators" });
-  await input.fill("PHQ-9");
-  await input.press("Enter");
-  await expect(page.getByRole("button", { name: "Close", exact: true })).toBeVisible();
-  await page.getByRole("button", { name: "Close", exact: true }).click();
-  await expect(dock).toBeVisible();
-  await expect(input).not.toBeFocused();
-
-  await addPhoneScrollRunway(page);
-  await dragScrollUntilHidden(page, 900, 24);
-  await expect(dock).toHaveAttribute("data-scroll-hidden", "true");
-});
-
-test("page-owned focus clearance places a below-fold calculator control above the visible dock", async ({ page }) => {
-  await page.setViewportSize(phoneViewport);
-  await gotoPhoneSurface(page, "/calculators", 112);
-  await expect(page.getByTestId("calculators-phone-dock")).toBeVisible();
-
-  const geometry = await page.evaluate(() => {
-    const owner = document.querySelector<HTMLElement>('[data-reserve-owner="calculator"]');
-    const dock = document.querySelector<HTMLElement>('[data-testid="calculators-phone-dock"]');
-    if (!owner || !dock) throw new Error("calculator focus-clearance owners were not rendered");
-    const runway = document.createElement("div");
-    runway.style.height = "1400px";
-    runway.setAttribute("aria-hidden", "true");
-    const target = document.createElement("button");
-    target.type = "button";
-    target.textContent = "Focus clearance probe";
-    target.dataset.testid = "phone-focus-clearance-probe";
-    const tail = document.createElement("div");
-    tail.style.height = "400px";
-    tail.setAttribute("aria-hidden", "true");
-    owner.append(runway, target, tail);
-    window.scrollTo(0, 0);
-    target.focus({ preventScroll: true });
-    target.scrollIntoView({ block: "nearest" });
-    const targetRect = target.getBoundingClientRect();
-    const dockRect = dock.getBoundingClientRect();
-    return {
-      targetBottom: targetRect.bottom,
-      dockTop: dockRect.top,
-      scrollMarginBottom: Number.parseFloat(getComputedStyle(target).scrollMarginBottom),
-      dockHidden: dock.getAttribute("data-scroll-hidden") === "true",
-    };
-  });
-
-  expect(geometry.dockHidden, "measure before hide-on-scroll can release the visible dock").toBe(false);
-  expect(geometry.scrollMarginBottom, "the page-owned reserve must reach focused descendants").toBeGreaterThan(100);
-  expect(geometry.targetBottom, "focused content must land above the visible page-owned dock").toBeLessThanOrEqual(
-    geometry.dockTop + 1,
-  );
-});
 
-// Renamed 2026-07-30: the old title said "96px of near-bottom runway", but 96 is
-// `collapseRunwaySlack`, which only exists on the in-flow branch of
-// `computeScrollHideUpdate`. Reserve-only overlay has no slack term at all — its
-// near-bottom refusal is `offset <= postCollapseMaxOffset + bottomClampTolerance`.
-// One test covers both owners, so the title names the behaviour rather than one
-// motion's constant. No flake-ledger or allowlist entry referenced the old name.
-test("calculator combined chrome refuses a near-bottom hide that would clamp the reader", async ({ page }) => {
-  await page.emulateMedia({ reducedMotion: "no-preference" });
-  await page.setViewportSize(phoneViewport);
-  await gotoPhoneSurface(page, "/calculators", 112);
-  await addPhoneScrollRunway(page);
-
-  const { frames, diag } = await page.evaluate(async () => {
-    const main = document.getElementById("main-content");
-    const dock = document.querySelector<HTMLElement>('[data-testid="calculators-phone-dock"]');
-    const reserve = document.querySelector<HTMLElement>('[data-testid="calculators-search-page"]');
-    if (!main || !dock || !reserve) throw new Error("calculator reserve geometry was not rendered");
-    const mainOwnsScroll =
-      /^(?:auto|scroll|overlay)$/.test(getComputedStyle(main).overflowY) && main.scrollHeight > main.clientHeight + 1;
-    const scrollOwner = mainOwnsScroll ? main : (document.scrollingElement ?? document.documentElement);
-    const read = () => ({
-      dockHidden: dock.getAttribute("data-scroll-hidden") === "true",
-      headerHidden:
-        document.querySelector('[data-testid="universal-header-collapse"]')?.getAttribute("data-scroll-hidden") ===
-        "true",
-      scrollTop: scrollOwner.scrollTop,
-      maxOffset: scrollOwner.scrollHeight - scrollOwner.clientHeight,
-    });
-    const collapse = document.querySelector<HTMLElement>('[data-testid="universal-header-collapse"]');
-    const safeArea = document.querySelector<HTMLElement>('[data-testid="chrome-safe-area-top"]');
-    // Match `readChromeCollapseMetrics`: overlay charges zero top release, so
-    // the near-bottom gate is reserve-only. Including the still-present header
-    // height here overstates the budget and scrolls into a zone where
-    // reserve-only policy *allows* hide — the opposite of this regression guard.
-    const phoneOverlayMotion = collapse?.dataset.phoneMotion === "overlay";
-    const headerRelease =
-      !phoneOverlayMotion && collapse && getComputedStyle(collapse).display === "grid"
-        ? collapse.getBoundingClientRect().height
-        : 0;
-    const safeAreaRelease = headerRelease > 0 && safeArea ? safeArea.getBoundingClientRect().height : 0;
-    const reserveRelease = Math.max(0, Number.parseFloat(getComputedStyle(reserve).paddingBottom) || 0);
-    const collapseBudget = headerRelease + safeAreaRelease + reserveRelease;
-    // Both target offsets are derived from `computeScrollHideUpdate`'s own
-    // refusal clauses (use-hide-on-scroll.ts) rather than from a chosen number,
-    // because the two motions refuse for genuinely different reasons:
-    //
-    //   in-flow       refuse while runwayAfterCollapse <= revealIntentDistance
-    //                 + collapseRunwaySlack  (12 + 96)
-    //   reserve-only  refuse while offset > postCollapseMaxOffset
-    //                 + bottomClampTolerance
-    //
-    // Mirrored constants — keep in step with use-hide-on-scroll.ts.
-    const revealIntentDistance = 12;
-    const collapseRunwaySlack = 96;
-    const bottomClampTolerance = 1;
-    const maxOffset = Math.max(0, scrollOwner.scrollHeight - scrollOwner.clientHeight);
-    const postCollapseMaxOffset = Math.max(0, maxOffset - collapseBudget);
-    // Reserve-only: land strictly inside the refusal band but not at the very
-    // bottom, so this stays a boundary case rather than the trivial one.
-    const overlayTarget = Math.min(
-      maxOffset,
-      postCollapseMaxOffset + bottomClampTolerance + Math.max(1, Math.round(reserveRelease / 3)),
-    );
-    const inFlowTarget = Math.max(0, maxOffset - collapseBudget - collapseRunwaySlack);
-    scrollOwner.scrollTop = phoneOverlayMotion ? overlayTarget : inFlowTarget;
-    // Capture the offset we actually landed on BEFORE dispatching, and never
-    // re-read it afterwards. If the policy regresses and the hide is wrongly
-    // allowed, the reserve collapses, maxOffset shrinks and the browser clamps
-    // scrollTop — so a post-loop read reports the offset after the bug rather
-    // than the offset under test. Asserting the band against that clamped value
-    // made a policy regression surface as "the test setup is wrong", which is
-    // the opposite of a useful failure. Found by removing the refusal clause and
-    // watching this test fail for the wrong reason (2026-07-30).
-    const targetScrollTop = scrollOwner.scrollTop;
-    (mainOwnsScroll ? main : window).dispatchEvent(new Event("scroll", { bubbles: true }));
-    const frames = [read()];
-    for (let index = 0; index < 18; index += 1) {
-      await new Promise((resolve) => requestAnimationFrame(() => resolve(undefined)));
-      frames.push(read());
-    }
-    return {
-      frames,
-      diag: {
-        phoneOverlayMotion,
-        reserveRelease,
-        collapseBudget,
-        maxOffset,
-        postCollapseMaxOffset,
-        targetScrollTop,
-        // The other reserve-only clause. If the post-collapse range were shorter
-        // than this, hide would be refused for being too short overall and the
-        // near-bottom clause would never be reached — the test would pass
-        // without testing anything.
-        minimumRangeForHide: 8 + 24,
-        inFlowRunwayAfterCollapse: maxOffset - targetScrollTop - collapseBudget,
-        inFlowRefusalCeiling: revealIntentDistance + collapseRunwaySlack,
-      },
-    };
-  });
-
-  // Non-vacuity first. "Chrome stayed visible" is only evidence of a refusal if
-  // the scroll position actually sat inside the refusal band AND the other
-  // clauses were satisfied — otherwise chrome stays visible for an unrelated
-  // reason and this test silently guards nothing. Added 2026-07-30: the overlay
-  // branch previously used chosen offsets, so nothing checked that it landed
-  // anywhere meaningful.
-  expect(diag.collapseBudget, "chrome must have geometry to release, or nothing can be refused").toBeGreaterThan(1);
-  if (diag.phoneOverlayMotion) {
-    expect(
-      diag.postCollapseMaxOffset,
-      "post-collapse range must clear the short-range clause, so the near-bottom clause is what refuses",
-    ).toBeGreaterThanOrEqual(diag.minimumRangeForHide);
-    expect(diag.targetScrollTop, "reserve-only offset must sit inside the near-bottom refusal band").toBeGreaterThan(
-      diag.postCollapseMaxOffset + 1,
-    );
-  } else {
-    expect(
-      diag.inFlowRunwayAfterCollapse,
-      "in-flow runway after collapse must sit inside the slack refusal band",
-    ).toBeLessThanOrEqual(diag.inFlowRefusalCeiling);
-  }
-
-  expect(frames.every((frame) => !frame.headerHidden && !frame.dockHidden)).toBe(true);
-  for (let index = 1; index < frames.length; index += 1) {
-    expect(frames[index].scrollTop, "rejected near-bottom collapse cannot clamp scrollTop").toBeCloseTo(
-      frames[0].scrollTop,
-      0,
+    await filterTrigger.click();
+    const filterSheet = page.getByTestId("calculators-filter-sheet");
+    await expect(filterSheet).toBeVisible();
+    const filterGeometry = await filterSheet.evaluate((element) => ({
+      clientWidth: element.clientWidth,
+      scrollWidth: element.scrollWidth,
+      right: element.getBoundingClientRect().right,
+    }));
+    expect(filterGeometry.scrollWidth, `${width}px calculator filters must not overflow`).toBeLessThanOrEqual(
+      filterGeometry.clientWidth + 1,
     );
-    expect(frames[index].maxOffset, "rejected near-bottom collapse keeps the scroll range stable").toBeCloseTo(
-      frames[0].maxOffset,
-      0,
+    expect(filterGeometry.right, `${width}px calculator filters stay inside the viewport`).toBeLessThanOrEqual(
+      width + 1,
     );
+    await page.keyboard.press("Escape");
+    await expect(filterSheet).toBeHidden();
+    await expect(filterTrigger).toBeFocused();
   }
-});
 
-test("calculator reserve and dock hide and reveal monotonically with sufficient near-bottom runway", async ({
-  page,
-}) => {
-  await page.emulateMedia({ reducedMotion: "no-preference" });
-  await page.setViewportSize(phoneViewport);
-  await gotoPhoneSurface(page, "/calculators", 112);
-  await addPhoneScrollRunway(page);
-
-  const frames = await page.evaluate(async () => {
-    const main = document.getElementById("main-content");
-    const dock = document.querySelector<HTMLElement>('[data-testid="calculators-phone-dock"]');
-    const reserve = document.querySelector<HTMLElement>('[data-testid="calculators-search-page"]');
-    if (!main || !dock || !reserve) throw new Error("calculator reserve geometry was not rendered");
-    const mainOwnsScroll =
-      /^(?:auto|scroll|overlay)$/.test(getComputedStyle(main).overflowY) && main.scrollHeight > main.clientHeight + 1;
-    const scrollOwner = mainOwnsScroll ? main : (document.scrollingElement ?? document.documentElement);
-    const read = () => ({
-      hidden: dock.getAttribute("data-scroll-hidden") === "true",
-      dockTop: dock.getBoundingClientRect().top,
-      paddingBottom: Number.parseFloat(getComputedStyle(reserve).paddingBottom),
-      scrollTop: scrollOwner.scrollTop,
-      maxOffset: scrollOwner.scrollHeight - scrollOwner.clientHeight,
-      scrollAnchor: getComputedStyle(scrollOwner).overflowAnchor,
-      transitionDuration: getComputedStyle(reserve).transitionDuration,
-    });
-    const collapse = document.querySelector<HTMLElement>('[data-testid="universal-header-collapse"]');
-    const safeArea = document.querySelector<HTMLElement>('[data-testid="chrome-safe-area-top"]');
-    const collapseBudget =
-      (collapse?.getBoundingClientRect().height ?? 0) +
-      (safeArea?.getBoundingClientRect().height ?? 0) +
-      Number.parseFloat(getComputedStyle(reserve).paddingBottom);
-    const targetOffset = Math.max(0, scrollOwner.scrollHeight - scrollOwner.clientHeight - collapseBudget - 256);
-    scrollOwner.scrollTop = Math.max(0, targetOffset - 24);
-    (mainOwnsScroll ? main : window).dispatchEvent(new Event("scroll", { bubbles: true }));
-    await new Promise((resolve) => requestAnimationFrame(() => resolve(undefined)));
-    scrollOwner.scrollTop = targetOffset;
-    (mainOwnsScroll ? main : window).dispatchEvent(new Event("scroll", { bubbles: true }));
-    const hiding = [read()];
-    for (let index = 0; index < 18; index += 1) {
-      await new Promise((resolve) => requestAnimationFrame(() => resolve(undefined)));
-      hiding.push(read());
-    }
-    scrollOwner.scrollTop -= 12;
-    (mainOwnsScroll ? main : window).dispatchEvent(new Event("scroll", { bubbles: true }));
-    const reveal = [read()];
-    for (let index = 0; index < 16; index += 1) {
-      await new Promise((resolve) => requestAnimationFrame(() => resolve(undefined)));
-      reveal.push(read());
-    }
-    return { hiding, reveal };
-  });
-
-  const firstHidden = frames.hiding.findIndex((frame) => frame.hidden);
-  expect(firstHidden, "sufficient-runway downward intent hides the calculator dock").toBeGreaterThan(-1);
-  const hiding = frames.hiding.slice(firstHidden);
-  expect(hiding.some((frame) => frame.transitionDuration.includes("0.24s"))).toBe(true);
-  expect(
-    hiding.some((frame) => frame.scrollAnchor === "none"),
-    "page-owned reserve transition disables anchoring",
-  ).toBe(true);
-  for (let index = 1; index < hiding.length; index += 1) {
-    expect(hiding[index].paddingBottom, "calculator reserve never reverses during hide").toBeLessThanOrEqual(
-      hiding[index - 1].paddingBottom + 1,
-    );
-    expect(hiding[index].dockTop, "dock never reverses during hide").toBeGreaterThanOrEqual(
-      hiding[index - 1].dockTop - 1,
-    );
-    expect(
-      hiding[index].scrollTop,
-      `scroll remains monotonic during hide at frame ${index}: ${JSON.stringify({ previous: hiding[index - 1], current: hiding[index] })}`,
-    ).toBeGreaterThanOrEqual(hiding[index - 1].scrollTop - 1);
-  }
-  const firstRevealed = frames.reveal.findIndex((frame) => !frame.hidden);
-  expect(firstRevealed, "upward intent reveals the calculator dock").toBeGreaterThan(-1);
-  const revealing = frames.reveal.slice(firstRevealed);
-  for (let index = 1; index < revealing.length; index += 1) {
-    expect(revealing[index].paddingBottom, "calculator reserve never reverses during reveal").toBeGreaterThanOrEqual(
-      revealing[index - 1].paddingBottom - 1,
-    );
-    expect(revealing[index].dockTop, "dock never reverses during reveal").toBeLessThanOrEqual(
-      revealing[index - 1].dockTop + 1,
-    );
-    expect(revealing[index].scrollTop, "scroll remains monotonic during reveal").toBeLessThanOrEqual(
-      revealing[index - 1].scrollTop + 1,
-    );
+  await page.setViewportSize({ width: 390, height: 844 });
+  for (const media of [
+    { colorScheme: "dark" as const, forcedColors: "none" as const, reducedMotion: "no-preference" as const },
+    { colorScheme: "light" as const, forcedColors: "none" as const, reducedMotion: "reduce" as const },
+    { colorScheme: "light" as const, forcedColors: "active" as const, reducedMotion: "no-preference" as const },
+  ]) {
+    await page.emulateMedia(media);
+    await gotoPhoneSurface(page, "/calculators?q=depression&run=1", 112);
+    await expect(page.getByTestId("calculators-search-page")).toBeVisible();
+    await expect(page.getByTestId("calculators-filter-trigger-phone")).toBeVisible();
   }
 });
diff --git a/tests/ui-pwa.spec.ts b/tests/ui-pwa.spec.ts
index 8bb66bfc7b..d5232414b9 100644
--- a/tests/ui-pwa.spec.ts
+++ b/tests/ui-pwa.spec.ts
@@ -244,6 +244,187 @@ test.describe("Clinical KB PWA", () => {
       .toEqual([]);
   });
 
+  test("keeps the install surface polished, reachable, and clear of search at every target width", async ({ page }) => {
+    const viewports = [
+      { name: "compact phone", width: 320, height: 720 },
+      { name: "phone", width: 390, height: 844 },
+      { name: "wide phone", width: 639, height: 900 },
+      { name: "small tablet", width: 768, height: 1024 },
+      { name: "tablet", width: 820, height: 1180 },
+      { name: "desktop", width: 1440, height: 1000 },
+      { name: "wide desktop", width: 1920, height: 1080 },
+    ] as const;
+
+    for (const viewport of viewports) {
+      await test.step(viewport.name, async () => {
+        await page.setViewportSize({ width: viewport.width, height: viewport.height });
+        await page.goto("/?mode=answer&pwa-dev=0", { waitUntil: "domcontentloaded" });
+        await expect(page.locator("header#search").first()).toBeVisible({ timeout: 20_000 });
+        await page.waitForFunction(() => document.documentElement.dataset.pwaDisplayMode === "browser");
+
+        await page.evaluate(() => {
+          (window as typeof window & { __pwaPromptLayoutShift?: number }).__pwaPromptLayoutShift = 0;
+          new PerformanceObserver((list) => {
+            for (const entry of list.getEntries()) {
+              const shift = entry as PerformanceEntry & { hadRecentInput: boolean; value: number };
+              if (!shift.hadRecentInput) {
+                (window as typeof window & { __pwaPromptLayoutShift?: number }).__pwaPromptLayoutShift! += shift.value;
+              }
+            }
+          }).observe({ type: "layout-shift" });
+
+          const event = new Event("beforeinstallprompt", { cancelable: true });
+          Object.assign(event, {
+            prompt: () => Promise.resolve(),
+            userChoice: Promise.resolve({ outcome: "accepted", platform: "web" }),
+          });
+          window.dispatchEvent(event);
+        });
+
+        const install = page.getByRole("region", { name: "Install Clinical KB" });
+        await expect(install).toBeVisible();
+        await page.evaluate(
+          () => new Promise<void>((resolve) => requestAnimationFrame(() => requestAnimationFrame(() => resolve()))),
+        );
+        await expect(install).toContainText("Clinical guidelines on your home screen.");
+        await expect(install).toContainText(
+          "Open it from your device like an app. Private clinical features still require a connection.",
+        );
+        await expect(install).toContainText("Free · No app store · Takes a few seconds");
+        if (viewport.width < 640) {
+          await expect(install.getByText("Quick access · No app store")).toBeVisible();
+        } else {
+          await expect(install.getByRole("list", { name: "Install benefits" })).toContainText(
+            "Quick accessApp-like launchFamiliar workspace",
+          );
+        }
+
+        const geometry = await install.evaluate((surface) => {
+          const rect = surface.getBoundingClientRect();
+          const installAction = surface.querySelector<HTMLElement>(".pwa-install-primary")?.getBoundingClientRect();
+          const secondaryAction = surface.querySelector<HTMLElement>(".pwa-install-secondary")?.getBoundingClientRect();
+          const dismissAction = surface.querySelector<HTMLElement>(".pwa-install-dismiss")?.getBoundingClientRect();
+          const visibleSearch = Array.from(
+            document.querySelectorAll<HTMLElement>('[data-testid="global-search-input"]'),
+          ).find((node) => {
+            const candidate = node.getBoundingClientRect();
+            return candidate.width > 0 && candidate.height > 0;
+          });
+          const searchRect =
+            visibleSearch?.closest<HTMLElement>(".chat-composer-shell-base")?.getBoundingClientRect() ??
+            visibleSearch?.getBoundingClientRect();
+          const overlap = searchRect
+            ? Math.max(0, Math.min(rect.right, searchRect.right) - Math.max(rect.left, searchRect.left)) *
+              Math.max(0, Math.min(rect.bottom, searchRect.bottom) - Math.max(rect.top, searchRect.top))
+            : 0;
+
+          return {
+            left: rect.left,
+            right: rect.right,
+            top: rect.top,
+            bottom: rect.bottom,
+            width: rect.width,
+            height: rect.height,
+            installActionHeight: installAction?.height ?? 0,
+            secondaryActionHeight: secondaryAction?.height ?? 0,
+            dismissActionHeight: dismissAction?.height ?? 0,
+            overlap,
+            hasInternalScroll: surface.scrollHeight > surface.clientHeight + 1,
+            pageScrollWidth: document.documentElement.scrollWidth,
+            viewportWidth: window.innerWidth,
+            promptLayoutShift:
+              (window as typeof window & { __pwaPromptLayoutShift?: number }).__pwaPromptLayoutShift ?? 0,
+          };
+        });
+
+        expect(geometry.left, `${viewport.name}: left inset`).toBeGreaterThanOrEqual(7);
+        expect(geometry.right, `${viewport.name}: right inset`).toBeLessThanOrEqual(viewport.width - 7);
+        expect(geometry.top, `${viewport.name}: top clearance`).toBeGreaterThanOrEqual(8);
+        expect(geometry.bottom, `${viewport.name}: bottom clearance`).toBeLessThanOrEqual(viewport.height - 8);
+        expect(geometry.installActionHeight, `${viewport.name}: Install app target`).toBeGreaterThanOrEqual(48);
+        expect(geometry.secondaryActionHeight, `${viewport.name}: Not now target`).toBeGreaterThanOrEqual(48);
+        expect(geometry.dismissActionHeight, `${viewport.name}: Dismiss target`).toBeGreaterThanOrEqual(48);
+        expect(geometry.overlap, `${viewport.name}: install surface must not overlap search`).toBe(0);
+        expect(geometry.promptLayoutShift, `${viewport.name}: prompt must not shift page content`).toBeLessThanOrEqual(
+          0.02,
+        );
+        expect(geometry.hasInternalScroll, `${viewport.name}: complete value proposition should fit`).toBe(false);
+        expect(geometry.pageScrollWidth, `${viewport.name}: no horizontal overflow`).toBeLessThanOrEqual(
+          geometry.viewportWidth,
+        );
+
+        if (viewport.width >= 640) {
+          expect(geometry.width, `${viewport.name}: restrained card width`).toBeGreaterThanOrEqual(380);
+          expect(geometry.width, `${viewport.name}: restrained card width`).toBeLessThanOrEqual(440);
+          expect(geometry.right, `${viewport.name}: right-corner anchor`).toBeGreaterThanOrEqual(viewport.width - 32);
+        } else {
+          expect(geometry.height, `${viewport.name}: compact phone sheet`).toBeLessThan(viewport.height * 0.7);
+        }
+      });
+    }
+  });
+
+  test("keeps constrained install actions reachable in a short phone viewport", async ({ page }) => {
+    await page.setViewportSize({ width: 390, height: 400 });
+    await page.goto("/?mode=answer&pwa-dev=0", { waitUntil: "domcontentloaded" });
+    await expect(page.locator("header#search").first()).toBeVisible({ timeout: 20_000 });
+    await page.waitForFunction(() => document.documentElement.dataset.pwaDisplayMode === "browser");
+
+    await page.evaluate(() => {
+      const event = new Event("beforeinstallprompt", { cancelable: true });
+      Object.assign(event, {
+        prompt: () => Promise.resolve(),
+        userChoice: Promise.resolve({ outcome: "accepted", platform: "web" }),
+      });
+      window.dispatchEvent(event);
+    });
+
+    const install = page.getByRole("region", { name: "Install Clinical KB" });
+    await expect(install).toBeVisible();
+    const scrollState = await install.evaluate((surface) => ({
+      clientHeight: surface.clientHeight,
+      scrollHeight: surface.scrollHeight,
+      overflowY: getComputedStyle(surface).overflowY,
+    }));
+    expect(scrollState.scrollHeight).toBeLessThanOrEqual(scrollState.clientHeight + 1);
+    expect(scrollState.overflowY).toMatch(/auto|scroll/);
+    await expect(install.getByRole("button", { name: "Install app" })).toBeInViewport();
+    await expect(install.getByRole("button", { name: "Not now" })).toBeInViewport();
+  });
+
+  test("keeps the install surface clear of the submitted answer composer", async ({ page }) => {
+    await page.setViewportSize({ width: 1440, height: 1000 });
+    await page.goto("/?mode=answer&q=lithium&run=1&pwa-dev=0", { waitUntil: "domcontentloaded" });
+    await expect(page.locator("header#search").first()).toBeVisible({ timeout: 20_000 });
+    await page.waitForFunction(() => document.documentElement.dataset.pwaDisplayMode === "browser");
+
+    await page.evaluate(() => {
+      const event = new Event("beforeinstallprompt", { cancelable: true });
+      Object.assign(event, {
+        prompt: () => Promise.resolve(),
+        userChoice: Promise.resolve({ outcome: "accepted", platform: "web" }),
+      });
+      window.dispatchEvent(event);
+    });
+
+    const install = page.getByRole("region", { name: "Install Clinical KB" });
+    const composer = page.locator("form.answer-footer-search-edge:visible").first();
+    await expect(install).toBeVisible();
+    await expect(composer).toBeVisible();
+
+    const overlap = await install.evaluate((surface, selector) => {
+      const composerSurface = document.querySelector<HTMLElement>(selector);
+      if (!composerSurface) return -1;
+      const card = surface.getBoundingClientRect();
+      const dock = composerSurface.getBoundingClientRect();
+      return (
+        Math.max(0, Math.min(card.right, dock.right) - Math.max(card.left, dock.left)) *
+        Math.max(0, Math.min(card.bottom, dock.bottom) - Math.max(card.top, dock.top))
+      );
+    }, "form.answer-footer-search-edge");
+    expect(overlap).toBe(0);
+  });
+
   test("serves a cold offline fallback, recovers online, and keeps private URLs out of CacheStorage", async ({
     context,
     page,
diff --git a/tests/ui-smoke.spec.ts b/tests/ui-smoke.spec.ts
index e675520546..60dd158652 100644
--- a/tests/ui-smoke.spec.ts
+++ b/tests/ui-smoke.spec.ts
@@ -907,6 +907,19 @@ function accountSetupDialog(page: Page) {
   return page.getByRole("dialog", { name: "Account setup" });
 }
 
+async function expectControlsBelowPhoneTopSafeArea(page: Page, controls: Locator[]) {
+  const safeAreaTop = await page.evaluate(() =>
+    Number.parseFloat(getComputedStyle(document.documentElement).getPropertyValue("--safe-area-top")),
+  );
+  expect(safeAreaTop).toBeGreaterThan(0);
+
+  for (const control of controls) {
+    const bounds = await control.boundingBox();
+    expect(bounds).not.toBeNull();
+    expect(bounds!.y).toBeGreaterThanOrEqual(safeAreaTop);
+  }
+}
+
 async function expectAccountSettingsSurface(settings: Locator) {
   await expect(settings.getByRole("heading", { name: "Account & app" })).toBeVisible();
   await expect(settings.getByRole("heading", { name: "Account", exact: true })).toBeVisible();
@@ -1587,6 +1600,9 @@ test.describe("Clinical KB UI smoke coverage", () => {
     await settings.getByRole("button", { name: "Close settings" }).click();
     await expect(settings).toBeHidden();
     await page.setViewportSize({ width: 390, height: 820 });
+    await page.evaluate(() => {
+      document.documentElement.style.setProperty("--safe-area-top", "59px");
+    });
 
     const escapeMenu = await openMobileClinicalGuideMenu(page);
     await escapeMenu.getByRole("button", { name: "Settings", exact: true }).click();
@@ -1601,14 +1617,26 @@ test.describe("Clinical KB UI smoke coverage", () => {
     await expectAccountSetupSurface(setup);
     await expectAccountProviderLayout(setup, "stack");
     await expect(setup.getByLabel("Work email")).toBeFocused();
+    const setupClose = setup.getByRole("button", { name: "Close account setup" });
+    const workspaceMark = setup.getByTestId("account-workspace-mark");
+    await expectControlsBelowPhoneTopSafeArea(page, [setupClose, workspaceMark]);
     const setupBox = await setup.boundingBox();
     expect(setupBox).not.toBeNull();
     expect(setupBox!.x).toBeGreaterThanOrEqual(-1);
     expect(setupBox!.width + fullscreenTolerance).toBeLessThanOrEqual(viewport.width + fullscreenTolerance);
     await expectNoPageHorizontalOverflow(page);
 
+    for (const viewportSize of [
+      { width: 320, height: 700 },
+      { width: 430, height: 820 },
+      { width: 639, height: 820 },
+    ]) {
+      await page.setViewportSize(viewportSize);
+      await expectControlsBelowPhoneTopSafeArea(page, [setupClose, workspaceMark]);
+      await expectNoPageHorizontalOverflow(page);
+    }
+
     await page.setViewportSize({ width: 320, height: 700 });
-    const setupClose = setup.getByRole("button", { name: "Close account setup" });
     const setupEmail = setup.getByLabel("Work email");
     await setupEmail.scrollIntoViewIfNeeded();
     await expect(setupEmail).toBeInViewport();
@@ -1739,6 +1767,9 @@ test.describe("Clinical KB UI smoke coverage", () => {
 
     const appModeTrigger = page.getByRole("button", { name: "Mode Answer" });
     await waitForReactEventHandler(appModeTrigger, "onClick");
+    await page.evaluate(() => {
+      document.documentElement.style.setProperty("--safe-area-top", "59px");
+    });
     await appModeTrigger.click();
 
     const modeSheet = page.getByTestId("app-mode-menu-sheet");
@@ -1748,6 +1779,10 @@ test.describe("Clinical KB UI smoke coverage", () => {
     await expect(appModeMenu).toBeVisible();
     await expect(appModeTrigger).toHaveAttribute("aria-expanded", "true");
     await expect(appModeTrigger).toHaveAttribute("aria-controls", "app-mode-menu");
+    await expectControlsBelowPhoneTopSafeArea(page, [
+      modeSheet.getByRole("heading", { name: "Choose mode" }),
+      modeSheet.getByRole("button", { name: "Close mode menu" }),
+    ]);
 
     // The full catalogue remains in one radio menu, but the phone presentation
     // now groups it into the three clinical jobs clinicians scan for first.
@@ -1793,7 +1828,7 @@ test.describe("Clinical KB UI smoke coverage", () => {
     expect(Number.parseFloat(closeGeometry.radius)).toBeGreaterThanOrEqual(22);
 
     // A lower group remains reachable through the sheet's own scroll owner.
-    // Selecting a mode closes the sheet and retargets the shared home.
+    // Tools is browse-first, so selecting it opens the canonical directory.
     const toolsMode = appModeMenu.getByRole("menuitemradio", { name: /^Tools\b/ });
     await toolsMode.scrollIntoViewIfNeeded();
     await expect(toolsMode).toBeVisible();
@@ -1801,10 +1836,11 @@ test.describe("Clinical KB UI smoke coverage", () => {
 
     await expect(modeSheet).toHaveCount(0);
     await expect(appModeMenu).toHaveCount(0);
-    await expect(page).toHaveURL(/\/\?mode=tools\b/);
+    await expect(page).toHaveURL(/\/tools$/);
     const toolsTrigger = page.getByRole("button", { name: "Mode Tools" });
     await expect(toolsTrigger).toBeVisible();
-    await expect(visibleByTestId(page, "shared-home-empty-state")).toBeVisible();
+    await expect(page.getByTestId("tools-search-results-page")).toBeVisible();
+    await expect(page.getByRole("heading", { level: 1, name: "All tools" })).toBeVisible();
     await expectNoPageHorizontalOverflow(page);
 
     // Reopening on a mode in a lower group must position that selected row in
@@ -3195,7 +3231,7 @@ test.describe("Clinical KB UI smoke coverage", () => {
     await gotoApp(page, "/?mode=favourites&q=lithium%20set&focus=1&run=1");
     await expect(page).toHaveURL(/\/favourites\?q=lithium\+set&focus=1&run=1$/);
     await expectSingleSettledOwner(page.getByTestId("favourites-hub"), { message: "favourites hub owner" });
-    await expect(page.getByRole("heading", { name: "Favourites command library" })).toBeVisible();
+    await expect(page.getByRole("heading", { level: 1, name: "Favourites", exact: true })).toBeVisible();
   });
 
   test("dashboard differentials selection stays on the shared home; submitted links open Differentials", async ({
@@ -3458,7 +3494,7 @@ test.describe("Clinical KB UI smoke coverage", () => {
     await gotoApp(page, "/favourites?q=lithium%20set&focus=1&run=1");
 
     await expectSingleSettledOwner(page.getByTestId("favourites-hub"), { message: "favourites hub owner" });
-    await expect(page.getByRole("heading", { name: "Favourites command library" })).toBeVisible();
+    await expect(page.getByRole("heading", { level: 1, name: "Favourites", exact: true })).toBeVisible();
     const queryRibbon = page.getByTestId("search-query-ribbon");
     await expect(queryRibbon.getByRole("heading", { name: "lithium set" })).toBeVisible();
     await expect(page.getByTestId("favourites-active-filters")).toHaveCount(0);
@@ -3475,7 +3511,7 @@ test.describe("Clinical KB UI smoke coverage", () => {
     await expect(globalSearchInput).toHaveAttribute("placeholder", "Search favourites...");
     await expect(globalSearchInput).toHaveValue("lithium set");
     await expectSingleSettledOwner(page.getByTestId("favourites-hub"), { message: "favourites hub owner" });
-    await expect(page.getByRole("heading", { name: "Favourites command library" })).toBeVisible();
+    await expect(page.getByRole("heading", { level: 1, name: "Favourites", exact: true })).toBeVisible();
     const queryRibbon = page.getByTestId("search-query-ribbon");
     await expect(queryRibbon.getByRole("heading", { name: "lithium set" })).toBeVisible();
     await expect(page.getByTestId("favourites-active-filters")).toHaveCount(0);
@@ -3520,7 +3556,7 @@ test.describe("Clinical KB UI smoke coverage", () => {
     await mockDemoApi(page);
     await gotoApp(page, "/favourites");
 
-    await expect(page.getByRole("heading", { name: "Favourites command library" })).toBeVisible();
+    await expect(page.getByRole("heading", { level: 1, name: "Favourites", exact: true })).toBeVisible();
     await expect(page.getByTestId("favourites-item-workspace")).toHaveCount(0);
 
     await visibleByTestId(page, "favourite-row-lithium-monitoring-guideline").locator("button[aria-pressed]").click();
@@ -3661,6 +3697,31 @@ test.describe("Clinical KB UI smoke coverage", () => {
     await expectSingleMedicationPage(page);
     await expect(page.getByRole("link", { name: "Back to medications" }).filter({ visible: true })).toBeVisible();
 
+    // Desktop polish: the patient control belongs to the title row, with a
+    // deliberate breathing space before the elevated category rail below it.
+    const desktopPatientAction = page.getByTestId("medication-primary-action").filter({ visible: true });
+    const desktopMedicationRail = page.getByTestId("medication-section-rail");
+    const [patientBox, desktopRailBox] = await Promise.all([
+      desktopPatientAction.boundingBox(),
+      desktopMedicationRail.boundingBox(),
+    ]);
+    expect(patientBox).not.toBeNull();
+    expect(desktopRailBox).not.toBeNull();
+    expect(desktopRailBox!.y - (patientBox!.y + patientBox!.height)).toBeGreaterThanOrEqual(6);
+
+    const summaryCategory = desktopMedicationRail.getByRole("button", { name: /^Summary/ });
+    await summaryCategory.focus();
+    await expect(summaryCategory).toBeFocused();
+    await page.emulateMedia({ reducedMotion: "reduce" });
+    await expect
+      .poll(() => summaryCategory.evaluate((button) => Number.parseFloat(getComputedStyle(button).transitionDuration)))
+      .toBeLessThanOrEqual(0.001);
+    await page.emulateMedia({ forcedColors: "active", reducedMotion: "no-preference" });
+    await expect
+      .poll(() => desktopMedicationRail.evaluate((rail) => getComputedStyle(rail).borderTopStyle))
+      .not.toBe("none");
+    await page.emulateMedia({ forcedColors: "none" });
+
     // Regression guard for #1802: medication sections use the same priority
     // menu as the mode home, not the older horizontally scrolling tab strip.
     await page.setViewportSize({ width: 390, height: 844 });
@@ -4258,20 +4319,29 @@ test.describe("Clinical KB UI smoke coverage", () => {
     await expect(navigator.getByTestId("services-shortlist-bar")).toHaveCount(0);
     await expect(navigator.getByTestId("services-comparison")).toHaveCount(0);
 
+    // The compact rail is progressive: it tracks shortlist state rather than
+    // standing there as an always-on four-card walkthrough (ledger #163).
+    const progress = navigator.getByRole("navigation", { name: "Referral progress" });
+    const currentStage = progress.locator('[aria-current="step"]');
+    await expect(currentStage).toHaveText("Search");
+
     const addButtons = navigator.getByRole("button", { name: /Add .* to shortlist/ });
     await addButtons.nth(0).click();
     const shortlist = navigator.getByTestId("services-shortlist-bar");
     await expect(shortlist).toContainText("1 shortlisted");
     await expect(shortlist.getByRole("button", { name: "Compare" })).toBeDisabled();
+    await expect(currentStage).toHaveText("Shortlist");
 
     await addButtons.nth(1).click();
     await expect(shortlist).toContainText("2 shortlisted");
     await shortlist.getByRole("button", { name: "Compare" }).click();
     await expect(navigator.getByTestId("services-comparison")).toBeVisible();
+    await expect(currentStage).toHaveText("Compare");
 
     await shortlist.getByRole("button", { name: "Clear" }).click();
     await expect(navigator.getByTestId("services-shortlist-bar")).toHaveCount(0);
     await expect(navigator.getByTestId("services-comparison")).toHaveCount(0);
+    await expect(currentStage).toHaveText("Search");
   });
 
   test("search regressions avoid fetch errors and open viewer hits @critical", async ({ page }) => {
@@ -5331,6 +5401,29 @@ test.describe("Clinical KB UI smoke coverage", () => {
     await gotoApp(page, "/");
 
     const dialog = await openGuide(page);
+    const guideScrollBody = dialog.locator(".polished-scroll");
+    const mobileFooter = dialog.locator("[data-guide-mobile-footer]");
+    await guideScrollBody.evaluate((element) => {
+      element.scrollTop = 80;
+      element.dispatchEvent(new Event("scroll", { bubbles: true }));
+    });
+    await expect(mobileFooter).toHaveAttribute("aria-hidden", "true");
+    await expect(mobileFooter).toHaveAttribute("inert", "");
+
+    // The hidden mobile footer must not be reachable by keyboard tabbing.
+    await dialog.getByRole("button", { name: "Close guide" }).focus();
+    const tabStopCount = await dialog.locator('button, input, [href], [tabindex]:not([tabindex="-1"])').count();
+    for (let tabIndex = 0; tabIndex <= tabStopCount; tabIndex += 1) {
+      await page.keyboard.press("Tab");
+      await expect.poll(() => mobileFooter.evaluate((element) => element.contains(document.activeElement))).toBe(false);
+    }
+
+    await guideScrollBody.evaluate((element) => {
+      element.scrollTop = 0;
+      element.dispatchEvent(new Event("scroll", { bubbles: true }));
+    });
+    await expect(mobileFooter).toHaveAttribute("aria-hidden", "false");
+    await expect(mobileFooter).not.toHaveAttribute("inert");
     const search = dialog.getByPlaceholder("Search the guide");
     await search.fill("privacy");
     await expect(dialog.getByText(/topics? found for “privacy”\./)).toBeVisible();
diff --git a/tests/ui-stress.spec.ts b/tests/ui-stress.spec.ts
index 50dff4eacb..3326c926d8 100644
--- a/tests/ui-stress.spec.ts
+++ b/tests/ui-stress.spec.ts
@@ -527,6 +527,32 @@ test.describe("Medication responsive stress coverage", () => {
       } else {
         await expect(desktopResult).toBeVisible();
         await expect(phoneResult).toBeHidden();
+
+        const columnMetrics = await page
+          .locator('[data-testid^="medication-result-"][data-testid$="-desktop"]:visible')
+          .evaluateAll((rows) =>
+            rows.map((row) => {
+              const ceiling = row.querySelector<HTMLElement>('[data-medication-cell="ceiling"]');
+              const action = row.querySelector<HTMLElement>('[data-medication-cell="action"]');
+              const table = row.parentElement?.parentElement;
+              if (!ceiling || !action || !table) return null;
+              const ceilingRect = ceiling.getBoundingClientRect();
+              const actionRect = action.getBoundingClientRect();
+              const rowRect = row.getBoundingClientRect();
+              const tableRect = table.getBoundingClientRect();
+              return {
+                columnGap: actionRect.left - ceilingRect.right,
+                ceilingOverflow: ceiling.scrollWidth - ceiling.clientWidth,
+                rightEdgeOverflow: rowRect.right - tableRect.right,
+              };
+            }),
+          );
+        expect(columnMetrics.every(Boolean)).toBe(true);
+        for (const metrics of columnMetrics) {
+          expect(metrics?.columnGap ?? 0).toBeGreaterThanOrEqual(12);
+          expect(metrics?.ceilingOverflow ?? Number.POSITIVE_INFINITY).toBeLessThanOrEqual(1);
+          expect(metrics?.rightEdgeOverflow ?? Number.POSITIVE_INFINITY).toBeLessThanOrEqual(1);
+        }
       }
     }
 
diff --git a/tests/ui-style-contract.spec.ts b/tests/ui-style-contract.spec.ts
index a09281802e..c1bc0b1f49 100644
--- a/tests/ui-style-contract.spec.ts
+++ b/tests/ui-style-contract.spec.ts
@@ -148,6 +148,159 @@ test.describe("unlayered style rules render their effect", () => {
     expect(audit.inlineCarriers, "tap-sized min-height is inert on inline boxes").toEqual([]);
     expect(audit.undersized, "controls rendered below their declared min-height").toEqual([]);
   });
+
+  /**
+   * Gate 2 / ledger #293 finding 2 — the rendered-interactive enumeration.
+   *
+   * The test above only ever measures elements whose COMPUTED `min-height` is
+   * already at or above the tap floor (`declared < tapFloor - 0.5` is
+   * skipped), so a floor overridden down to 0 is invisible to it by
+   * construction. A broader enumeration was written in session
+   * (2026-08-09) to close that gap, found a genuine defect class in every
+   * run, and was then reverted rather than landed: on
+   * `/services?q=CMHT&run=1` six runs against one production build returned
+   * 6, 5, 4, 3, 3 and 9 distinct sub-floor shapes, largely disjoint —
+   * `waitForLoadState("networkidle")` plus shape deduplication did not
+   * settle it, because that route drives the live search+ranking pipeline
+   * and the audit raced its async render. Since this spec matches
+   * `productionSpecPattern` (`playwright.config.ts`) and ships in the
+   * required Production UI job, an intermittent version would have blocked
+   * every merge in the repo — worse than the gap it closes. A later pass
+   * (2026-08-12) also refuted the finding this gap was chasing on THAT
+   * route: `services-navigator-page.tsx`'s zeroed carriers are an
+   * intentional `sm:min-h-0` desktop release of the phone-only floor, not a
+   * live defect (see the finding-1 correction in
+   * `docs/outstanding-issues.md` #293) — so re-deriving it there would have
+   * reported the wrong thing even if it were deterministic.
+   *
+   * This version closes finding 2 two ways at once, per #293's own revised
+   * "Next": (1) it enumerates on `/forms`'s no-query home, which renders its
+   * cards from a fixed array once its registry *summary* settles rather than
+   * from ranked search results whose shape can legitimately vary run to run
+   * — never re-land this enumeration on a live-search route; and (2) it
+   * polls the enumeration itself until three consecutive reads agree before
+   * trusting it, rather than a fixed wait or `networkidle` (which
+   * `ui-specifiers.spec.ts` already found unusable here: persistent
+   * background fetches keep it open past its timeout on this app's routes).
+   * The explicit `.sort()` below is a second, independent determinism
+   * safeguard: the shape list's order must never depend on `querySelectorAll`
+   * traversal order or `classList` iteration order, only on content.
+   *
+   * It runs at a PHONE viewport deliberately: `min-h-tap`'s `sm:` release is
+   * unreleased below that breakpoint, so a sub-floor carrier there is a
+   * genuine violation rather than the intentional desktop-width finding-1
+   * shape, and `#293`'s own "Next" calls a phone layout "the simpler, more
+   * deterministic surface" for exactly this reason.
+   */
+  test("min-h-tap carriers render at or above the tap floor at a phone viewport (Gate 2, #293 finding 2)", async ({
+    page,
+  }) => {
+    test.setTimeout(60_000);
+    await page.setViewportSize({ width: 390, height: 844 });
+
+    const enumerateTapCarriers = () =>
+      page.evaluate(() => {
+        const describe = (element: Element) => {
+          const rect = element.getBoundingClientRect();
+          // Sorted class list: an unsorted `element.className` string would
+          // make the shape depend on source/compiler class order rather than
+          // on which classes are actually present.
+          const classes = Array.from(element.classList).sort().join(".");
+          return `${element.tagName.toLowerCase()}.${classes}@${Math.round(rect.height)}`;
+        };
+        return Array.from(document.querySelectorAll("*"))
+          .filter((element) => element.classList.contains("min-h-tap"))
+          .filter((element) => {
+            const rect = element.getBoundingClientRect();
+            return rect.width > 0 && rect.height > 0;
+          })
+          .map(describe)
+          .sort(); // Explicit sort: output must never depend on DOM traversal order.
+      });
+
+    /**
+     * Read the enumeration repeatedly until it stops changing. This is the
+     * mechanism that survives whatever async settling remains on the route
+     * (registry summary fetch, hydration, layout effects) instead of
+     * guessing a fixed delay or trusting `networkidle`.
+     */
+    const waitForStableEnumeration = async (): Promise<string[]> => {
+      let previousKey: string | null = null;
+      let stableStreak = 0;
+      let shapes: string[] = [];
+      for (let attempt = 0; attempt < 20; attempt += 1) {
+        shapes = await enumerateTapCarriers();
+        const key = JSON.stringify(shapes);
+        if (key === previousKey) {
+          stableStreak += 1;
+          if (stableStreak >= 3) return shapes;
+        } else {
+          stableStreak = 0;
+        }
+        previousKey = key;
+        await page.waitForTimeout(150);
+      }
+      throw new Error(`tap-carrier enumeration did not stabilise after 20 polls; last read: ${JSON.stringify(shapes)}`);
+    };
+
+    const runAudit = async (): Promise<string[]> => {
+      await page.goto("/forms", { waitUntil: "domcontentloaded" });
+      await page.getByRole("region", { name: "Forms tasks" }).waitFor({ state: "visible", timeout: 20_000 });
+      return waitForStableEnumeration();
+    };
+
+    // Three independent full navigations — the same shape of reproduction as
+    // #293's six-run evidence — must agree exactly. This is the assertion
+    // that would have caught the original nondeterminism: it does not just
+    // check the audit's *content*, it checks that repeating the whole
+    // navigate-and-enumerate cycle is stable.
+    const first = await runAudit();
+    const second = await runAudit();
+    const third = await runAudit();
+
+    expect(second, "repeat navigation produced a different min-h-tap carrier enumeration").toEqual(first);
+    expect(third, "repeat navigation produced a different min-h-tap carrier enumeration").toEqual(first);
+    expect(first.length, "expected at least one rendered min-h-tap carrier on this route").toBeGreaterThan(0);
+
+    const tapFloor = await page.evaluate(() => {
+      const probe = document.createElement("div");
+      // Keep the measurement out of the page's flex/grid flow so it reflects
+      // only the token value, not ambient layout sizing.
+      Object.assign(probe.style, {
+        position: "fixed",
+        left: "-9999px",
+        top: "-9999px",
+        display: "block",
+        boxSizing: "border-box",
+        width: "1px",
+        minHeight: "0",
+        margin: "0",
+        padding: "0",
+        border: "0",
+      });
+      probe.style.height =
+        getComputedStyle(document.documentElement).getPropertyValue("--spacing-tap").trim() || "3rem";
+      document.body.appendChild(probe);
+      try {
+        return probe.getBoundingClientRect().height;
+      } finally {
+        probe.remove();
+      }
+    });
+    expect(tapFloor, "expected --spacing-tap to resolve to the documented 48px phone tap floor").toBeGreaterThanOrEqual(
+      48,
+    );
+
+    const undersized = first.filter((shape) => {
+      const height = Number(shape.slice(shape.lastIndexOf("@") + 1));
+      // An unmeasurable shape is a failure, not a pass.
+      return !Number.isFinite(height) || height < tapFloor - 0.5;
+    });
+
+    // At this viewport `min-h-tap`'s `sm:` release (finding 1) is not in
+    // force, so every carrier is expected to render at or above the floor.
+    expect(undersized, "min-h-tap carriers rendered below the tap floor at phone width").toEqual([]);
+  });
 });
 
 /**
diff --git a/tests/ui-tools-search-mode-mockup.spec.ts b/tests/ui-tools-search-mode-mockup.spec.ts
index f1870b2a93..3e92a59a0a 100644
--- a/tests/ui-tools-search-mode-mockup.spec.ts
+++ b/tests/ui-tools-search-mode-mockup.spec.ts
@@ -124,8 +124,8 @@ test.describe("Perfected Tools results mode mockup @mockup", () => {
     const mockup = await gotoMockup(page, 1440);
     await page.locator('[data-testid="global-search-input"]:visible').fill("");
 
-    await expect(mockup.getByText("12 tools", { exact: true })).toBeVisible();
-    await expect(mockup.locator('section[aria-label="Tool results"] article')).toHaveCount(12);
+    await expect(mockup.getByText("13 tools", { exact: true })).toBeVisible();
+    await expect(mockup.locator('section[aria-label="Tool results"] article')).toHaveCount(13);
   });
 
   test("phone keeps results visible until Details opens the preferred bottom sheet", async ({ page }) => {
diff --git a/tests/ui-tools-show-all.spec.ts b/tests/ui-tools-show-all.spec.ts
new file mode 100644
index 0000000000..8b479455c7
--- /dev/null
+++ b/tests/ui-tools-show-all.spec.ts
@@ -0,0 +1,39 @@
+import { expect, test, type Page } from "playwright/test";
+
+async function gotoLauncher(page: Page, path = "/tools") {
+  await page.goto(path, { waitUntil: "domcontentloaded" });
+  await expect(page.locator("#main-content").first()).toBeVisible({ timeout: 15_000 });
+}
+
+async function expectNoPageHorizontalOverflow(page: Page) {
+  const overflow = await page.evaluate(() => {
+    const documentWidth = Math.max(document.documentElement.scrollWidth, document.body?.scrollWidth ?? 0);
+    return documentWidth - document.documentElement.clientWidth;
+  });
+
+  expect(overflow).toBeLessThanOrEqual(2);
+}
+
+test("Show all opens the unfiltered tools search mode", async ({ page }) => {
+  await page.setViewportSize({ width: 390, height: 844 });
+  await gotoLauncher(page, "/?mode=tools");
+
+  const showAll = page.getByRole("link", { name: "Show all tools" });
+  await expect(showAll).toBeVisible();
+  await expect(showAll).toHaveText("Show all");
+  await expect(showAll).toHaveAttribute("href", "/tools");
+
+  const showAllBox = await showAll.boundingBox();
+  expect(showAllBox?.height).toBeGreaterThanOrEqual(48);
+
+  await showAll.focus();
+  await expect(showAll).toBeFocused();
+
+  await Promise.all([page.waitForURL(/\/tools$/), page.keyboard.press("Enter")]);
+
+  const results = page.getByTestId("tools-search-results-page");
+  await expect(results).toBeVisible();
+  await expect(results.getByRole("heading", { level: 1, name: "All tools" })).toBeVisible();
+  await expect(results.getByTestId("tools-results-home-composer").getByTestId("global-search-input")).toBeVisible();
+  await expectNoPageHorizontalOverflow(page);
+});
diff --git a/tests/ui-tools.spec.ts b/tests/ui-tools.spec.ts
index 8e1cbf323e..1259874506 100644
--- a/tests/ui-tools.spec.ts
+++ b/tests/ui-tools.spec.ts
@@ -425,16 +425,43 @@ async function expectVerticalSeparation(page: Page, upperSelector: string, lower
 
 test.beforeEach(stubZeroTouchPoints);
 
-test.describe("Clinical KB tools launcher", () => {
+test.describe("Clinical KB tools directory and legacy launcher", () => {
   test.describe.configure({ timeout: 60_000 });
 
+  for (const viewport of [
+    { name: "phone", width: 390, height: 844 },
+    { name: "desktop", width: 1280, height: 900 },
+  ] as const) {
+    test(`universal mode picker opens the all tools directory at ${viewport.name} width`, async ({ page }) => {
+      await mockAnswerDashboardApi(page);
+      await page.setViewportSize({ width: viewport.width, height: viewport.height });
+      await gotoLauncher(page, "/?mode=answer");
+
+      const menu = await openAppModeMenu(page, "Answer");
+      const toolsOption = menu.getByRole("menuitemradio", { name: /^Tools\b/ });
+      await toolsOption.scrollIntoViewIfNeeded();
+      await Promise.all([page.waitForURL(/\/tools$/), toolsOption.click()]);
+
+      await expect(page.getByTestId("tools-search-results-page")).toBeVisible();
+      await expect(page.getByRole("heading", { level: 1, name: "All tools" })).toBeVisible();
+      if (viewport.name === "phone") {
+        await expect(page.getByTestId("tools-results-home-composer").getByTestId("global-search-input")).toHaveCount(0);
+        await expect(page.locator("form.answer-footer-search-dock")).toBeVisible();
+      } else {
+        await expect(page.getByTestId("tools-results-home-composer").getByTestId("global-search-input")).toBeVisible();
+        await expect(page.locator("form.answer-footer-search-dock")).toHaveCount(0);
+      }
+      await expectNoPageHorizontalOverflow(page);
+    });
+  }
+
   for (const viewport of [
     { name: "mobile", width: 390, height: 820 },
     { name: "desktop", width: 1280, height: 900 },
   ] as const) {
     test(`tools launcher is usable at ${viewport.name}`, async ({ page }) => {
       await page.setViewportSize({ width: viewport.width, height: viewport.height });
-      await gotoLauncher(page);
+      await gotoLauncher(page, "/?mode=tools");
 
       await expect(page.getByRole("heading", { level: 1, name: "Tools" })).toBeVisible();
       await expect(page.getByRole("region", { name: "Quick tool shortcuts" })).toBeVisible();
@@ -467,9 +494,10 @@ test.describe("Clinical KB tools launcher", () => {
       await expect(page.getByLabel("Mode Tools")).toBeVisible();
       await expect(visibleGlobalSearchInput(page)).toHaveCount(1);
       if (viewport.name === "mobile") {
-        // Phones keep the compact shared search in the tools-home hero slot.
-        await expect(page.getByTestId("tools-home").getByTestId("global-search-input")).toBeVisible();
-        await expect(page.locator("form.answer-footer-search-dock")).toHaveCount(0);
+        // Tools delegates its phone composer to the same shared global footer
+        // used by submitted views; tablet and desktop retain the hero slot.
+        await expect(page.getByTestId("tools-home").getByTestId("global-search-input")).toHaveCount(0);
+        await expect(page.locator("form.answer-footer-search-dock")).toBeVisible();
       } else {
         await expect(page.getByTestId("tools-home").getByTestId("global-search-input")).toBeVisible();
       }
@@ -478,19 +506,42 @@ test.describe("Clinical KB tools launcher", () => {
     });
   }
 
-  test("standalone tools route uses the shared global search", async ({ page }) => {
+  test("all tools are visible immediately with optional shared search", async ({ page }) => {
     await page.setViewportSize({ width: 1280, height: 900 });
     await gotoLauncher(page, "/tools");
 
-    await expect(page.getByRole("heading", { level: 1, name: "Tools" })).toBeVisible();
+    const results = page.getByTestId("tools-search-results-page");
+    await expect(results).toBeVisible();
+    await expect(results.getByRole("heading", { level: 1, name: "All tools" })).toBeVisible();
+    await expect(results.getByRole("heading", { level: 2, name: "Clinical KB Search" }).first()).toBeVisible();
+    await expect(results.getByRole("heading", { level: 2, name: "Medication Prescribing" }).first()).toBeVisible();
     await expect(visibleGlobalSearchInput(page)).toHaveCount(1);
-    await expect(page.getByTestId("tools-home").getByTestId("global-search-input")).toBeVisible();
+    await expect(results.getByTestId("tools-results-home-composer").getByTestId("global-search-input")).toBeVisible();
+    await expect(page.locator("form.answer-footer-search-dock")).toHaveCount(0);
     await expect(page.getByTestId("tools-local-search-input")).toHaveCount(0);
 
-    // Typing in the shared composer live-filters the tools grid, matching /?mode=tools.
+    // Browsing needs no query; typing simply narrows the already-visible directory.
     await fillHydratedGlobalSearch(page, "medication");
-    await expect(page.getByTestId("application-card-medication-prescribing")).toBeVisible();
-    await expect(page.getByTestId("application-card-documents")).toBeHidden();
+    await expect(results.getByRole("heading", { level: 1, name: "medication" })).toBeVisible();
+    await expect(results.getByRole("heading", { level: 2, name: "Medication Prescribing" }).first()).toBeVisible();
+    await expect(results.getByRole("heading", { level: 2, name: "Documents" })).toHaveCount(0);
+
+    await visibleGlobalSearchInput(page).fill("");
+    await expect(results.getByRole("heading", { level: 1, name: "All tools" })).toBeVisible();
+    await expect(results.getByRole("heading", { level: 2, name: "Documents" })).toBeVisible();
+
+    const categories = results.getByRole("radiogroup", { name: "Tool category" });
+    await categories.getByRole("radio", { name: /Treat/ }).click();
+    await expect(results.getByRole("heading", { level: 2, name: "Clinical KB Search" })).toHaveCount(0);
+    await categories.getByRole("radio", { name: /All tools/ }).click();
+
+    await results.getByRole("button", { name: "View details for Medication Prescribing" }).click();
+    await expect(results.getByRole("complementary", { name: "Medication Prescribing" })).toBeVisible();
+    await expect(
+      results.getByRole("complementary", { name: "Medication Prescribing" }).getByRole("link", {
+        name: "Prescribe Medication Prescribing",
+      }),
+    ).toHaveAttribute("href", "/medications");
     await expectNoPageHorizontalOverflow(page);
   });
 
@@ -549,39 +600,33 @@ test.describe("Clinical KB tools launcher", () => {
     await expectNoPageHorizontalOverflow(page);
   });
 
-  test("tool descriptions remain complete across supported breakpoints", async ({ page }) => {
+  test("all tools stay visible across supported breakpoints and media preferences", async ({ page }) => {
     await gotoLauncher(page, "/tools");
 
     for (const width of [320, 390, 639, 768, 1440, 1920]) {
       await page.setViewportSize({ width, height: 900 });
-      const tool =
-        width < 1024
-          ? page.getByTestId("application-row-clinical-kb-search")
-          : page.getByTestId("application-card-clinical-kb-search");
-      const description = tool
-        .getByText("Ask source-backed clinical questions and move straight to evidence.", {
-          exact: true,
-        })
-        .first();
-      await expect(description).toBeVisible();
-      const clipping = await description.evaluate((element) => {
-        const style = getComputedStyle(element);
-        return {
-          horizontal: element.scrollWidth > element.clientWidth + 1,
-          vertical: element.scrollHeight > element.clientHeight + 1,
-          lineClamp: style.webkitLineClamp,
-        };
-      });
-      expect(clipping.horizontal).toBe(false);
-      expect(clipping.vertical).toBe(false);
-      expect(clipping.lineClamp).not.toBe("2");
+      await expect(page.getByRole("heading", { level: 1, name: "All tools" })).toBeVisible();
+      await expect(page.getByRole("region", { name: "Tool results" })).toBeVisible();
+      await expect(page.getByRole("heading", { level: 2, name: "Clinical KB Search" }).first()).toBeVisible();
+      if (width < 640) {
+        await expect(page.getByTestId("tools-results-home-composer").getByTestId("global-search-input")).toHaveCount(0);
+        await expect(page.locator("form.answer-footer-search-dock")).toBeVisible();
+      } else {
+        await expect(page.getByTestId("tools-results-home-composer").getByTestId("global-search-input")).toBeVisible();
+        await expect(page.locator("form.answer-footer-search-dock")).toHaveCount(0);
+      }
       await expectNoPageHorizontalOverflow(page);
     }
+
+    await page.emulateMedia({ reducedMotion: "reduce", forcedColors: "active" });
+    await expect(page.getByRole("heading", { level: 1, name: "All tools" })).toBeVisible();
+    await expect(page.getByTestId("tools-results-home-composer").getByTestId("global-search-input")).toBeVisible();
+    await expectNoPageHorizontalOverflow(page);
   });
 
   test("launcher links point to the expected in-app modes", async ({ page }) => {
     await page.setViewportSize({ width: 1280, height: 900 });
-    await gotoLauncher(page);
+    await gotoLauncher(page, "/?mode=tools");
 
     for (const [title, href] of [
       ["Medication Prescribing", "/medications"],
@@ -604,7 +649,7 @@ test.describe("Clinical KB tools launcher", () => {
 
   test("search and filters reduce visible application rows without overflow", async ({ page }) => {
     await page.setViewportSize({ width: 1280, height: 900 });
-    await gotoLauncher(page);
+    await gotoLauncher(page, "/?mode=tools");
 
     await fillHydratedGlobalSearch(page, "medication");
 
@@ -613,34 +658,29 @@ test.describe("Clinical KB tools launcher", () => {
     await expectNoPageHorizontalOverflow(page);
   });
 
-  test("tools mode embeds the launcher content inside the dashboard", async ({ page }) => {
+  test("non-submitted tools query keeps the all-results page and home composer", async ({ page }) => {
     await page.setViewportSize({ width: 1280, height: 900 });
-    // `/?mode=tools&q=…` (no run=1) now prefills the shared home's composer
-    // rather than rendering Tools content there. /tools is the canonical surface.
     await gotoLauncher(page, "/tools?q=medication&focus=1");
 
     await expect(page.getByRole("button", { name: "Mode Tools" })).toBeVisible();
     await expect(page.locator('input[placeholder="Search tools..."]:visible').first()).toHaveValue("medication");
 
-    const toolsHub = page.getByTestId("tools-hub");
-    await expect(toolsHub).toBeVisible();
-    await expect(toolsHub.getByTestId("tools-home")).toBeVisible();
-    await expect(toolsHub.getByRole("heading", { level: 1, name: "Tools" })).toBeVisible();
-    await expect(toolsHub.getByTestId("global-search-input")).toBeVisible();
-    const queryRibbon = toolsHub.getByTestId("search-query-ribbon");
-    await expect(queryRibbon.getByRole("heading", { name: "medication" })).toBeVisible();
-    await expect(queryRibbon.getByRole("group", { name: "Filter tools by category" })).toBeVisible();
-    const medicationDetails = toolsHub.getByRole("button", { name: "View details for Medication Prescribing" });
-    await expect(medicationDetails).toHaveAttribute("aria-haspopup", "dialog");
-    await expect(toolsHub.getByTestId("application-card-documents")).toBeHidden();
-    await expect(toolsHub.getByTestId("tool-mode-result-medications")).toHaveCount(0);
+    const results = page.getByTestId("tools-search-results-page");
+    await expect(results).toBeVisible();
+    await expect(results.getByTestId("tools-results-home-composer").getByTestId("global-search-input")).toBeVisible();
+    await expect(results.getByRole("heading", { level: 1, name: "medication" })).toBeVisible();
+    await expect(results.getByRole("group", { name: "Filter tools by category" })).toBeVisible();
+    const medicationDetails = results.getByRole("button", { name: "View details for Medication Prescribing" });
+    await expect(results.getByRole("heading", { level: 2, name: "Documents" })).toHaveCount(0);
+    await expect(page.locator("form.answer-footer-search-dock")).toHaveCount(0);
 
     await medicationDetails.click();
-    const medicationDialog = page.getByRole("dialog", { name: "Medication Prescribing" });
-    await expect(medicationDialog).toBeVisible();
-    const medicationLaunch = medicationDialog.locator('a[href="/medications"]').first();
-    await expect(medicationLaunch).toBeVisible();
-    await expect(medicationLaunch).toHaveAttribute("href", "/medications");
+    const medicationPanel = results.getByRole("complementary", { name: "Medication Prescribing" });
+    await expect(medicationPanel).toBeVisible();
+    await expect(medicationPanel.getByRole("link", { name: "Prescribe Medication Prescribing" })).toHaveAttribute(
+      "href",
+      "/medications",
+    );
     await expectNoPageHorizontalOverflow(page);
   });
 
@@ -958,7 +998,6 @@ test.describe("Clinical KB tools launcher", () => {
       { path: "/differentials", testId: "differentials-home" },
       { path: "/factsheets", testId: "factsheets-home-main" },
       { path: "/favourites", testId: "favourites-hub" },
-      { path: "/tools", testId: "tools-home" },
     ] as const) {
       await gotoLauncher(page, home.path);
       const homeSurface = page.getByTestId(home.testId);
@@ -1059,7 +1098,6 @@ test.describe("Clinical KB tools launcher", () => {
     { path: "/?mode=answer", testId: "shared-home-empty-state", heroTestId: "shared-home-empty-state" },
     { path: "/documents", testId: "document-search-empty-state", heroTestId: "document-search-empty-state" },
     { path: "/medications", testId: "medication-home", heroTestId: "medication-home" },
-    { path: "/tools", testId: "tools-home", heroTestId: "tools-home" },
     { path: "/services", testId: "services-home", heroTestId: "services-home-template" },
     { path: "/forms", testId: "forms-home", heroTestId: "forms-home-template" },
     { path: "/differentials", testId: "differentials-home", heroTestId: "differentials-home-template" },
@@ -1127,12 +1165,18 @@ test.describe("Clinical KB tools launcher", () => {
     await page.setViewportSize({ width: 390, height: 820 });
     await gotoLauncher(page, "/services?q=13YARN&focus=1&run=1");
     await expect(page.getByRole("button", { name: "Mode Services" })).toBeVisible();
+    await expect(page.getByTestId("service-quick-search-suggestions")).toHaveCount(0);
     const input = visibleGlobalSearchInput(page).first();
     await expect(input).toBeVisible();
     const quickFilter = page.getByTestId("service-filter-trigger-phone");
     await expect(quickFilter).toBeVisible();
     await expect(quickFilter).toHaveAccessibleName(/No filters active/);
-    await expect(page.getByText("Try a focused search", { exact: true })).toHaveCount(0);
+    await expect(page.getByRole("navigation", { name: "Service groups" })).toHaveCount(0);
+    await quickFilter.click();
+    const phoneFilterPanel = page.getByTestId("service-filter-panel");
+    await phoneFilterPanel.getByRole("button", { name: "Service category" }).click();
+    await expect(phoneFilterPanel.getByRole("button", { name: /^Crisis & urgent/ })).toBeVisible();
+    await phoneFilterPanel.getByRole("button", { name: "Close", exact: true }).click();
 
     // Phones keep the full search results in the page instead of opening a
     // command sheet over the small viewport.
@@ -1196,7 +1240,6 @@ test.describe("Clinical KB tools launcher", () => {
       { path: "/services", testId: "services-home", heading: "Services", headingLevel: 1 },
       { path: "/forms", testId: "forms-home", heading: "Forms", headingLevel: 1 },
       { path: "/differentials", testId: "differentials-home", heading: "Differentials", headingLevel: 1 },
-      { path: "/tools", testId: "tools-home", heading: "Tools", headingLevel: 1 },
     ] as const) {
       test(`mode home search is centered at ${viewport.name} width on ${home.path}`, async ({ page }) => {
         await mockAnswerDashboardApi(page);
@@ -1329,7 +1372,7 @@ test.describe("Clinical KB tools launcher", () => {
     await gotoLauncher(page, "/services?focus=1");
     await expect(page.getByTestId("services-home").getByTestId("global-search-input")).toBeVisible();
     await expect(page.getByTestId("services-home").getByTestId("global-search-input")).toBeFocused();
-    await expect(page.getByText("Try a focused search", { exact: true })).toHaveCount(0);
+    await expect(page.getByTestId("service-quick-search-suggestions")).toHaveCount(0);
 
     await gotoLauncher(page, "/forms?focus=1");
     await expect(visibleByTestId(page, "forms-home").getByTestId("global-search-input")).toBeVisible();
@@ -1344,6 +1387,7 @@ test.describe("Clinical KB tools launcher", () => {
     await expect(page.locator('input[placeholder="Search services..."]:visible').first()).toHaveValue("13YARN");
     await expect(page.getByTestId("service-search-results")).toBeVisible();
     await expect(page.getByTestId("service-search-result-13yarn")).toContainText("13YARN");
+    await expect(page.getByTestId("service-quick-search-suggestions")).toHaveCount(0);
     await expect(
       page.getByTestId("service-search-result-13yarn").getByLabel("Review referral for 13YARN"),
     ).toHaveAttribute("href", "/services/13yarn");
@@ -1361,28 +1405,57 @@ test.describe("Clinical KB tools launcher", () => {
     await expectNoPageHorizontalOverflow(page);
   });
 
-  test("services results keep browse navigation without a walkthrough", async ({ page }) => {
+  test("services results keep category filtering and compact referral progress without suggestion rows", async ({
+    page,
+  }) => {
     await page.setViewportSize({ width: 1280, height: 900 });
     await gotoLauncher(page, "/services?q=13YARN&focus=1&run=1");
 
     await expect(page.getByRole("heading", { level: 1, name: "13YARN" })).toBeVisible();
     await expect(page.getByLabel("Referral workflow")).toHaveCount(0);
-    await expect(page.getByRole("navigation", { name: "Service groups" })).toBeVisible();
+    // The four-card numbered walkthrough stays gone (assertion above). A
+    // compact progress rail sits between the results heading and the list,
+    // under a different accessible name (ledger #163).
+    const referralProgress = page.getByRole("navigation", { name: "Referral progress" });
+    await expect(referralProgress).toBeVisible();
+    await expect(referralProgress.locator('[aria-current="step"]')).toHaveText("Search");
+    await expect(referralProgress).toContainText("Step 1 of 4");
+    await expect(page.getByRole("navigation", { name: "Service groups" })).toHaveCount(0);
     await expect(page.getByTestId("services-shortlist-bar")).toHaveCount(0);
 
-    await expect(page.getByText("Try a focused search", { exact: true })).toHaveCount(0);
-    await expect(page.getByTestId("service-search-result-13yarn")).toBeVisible();
+    // The row is compact by contract: the Catchment/Eligibility/Cost strip
+    // moved to the record, and the bookmark is a persisted favourite that is
+    // deliberately distinct from the in-page shortlist.
+    const firstResult = page.getByTestId("service-search-result-13yarn");
+    await expect(firstResult.getByText("Catchment", { exact: true })).toHaveCount(0);
+    await expect(firstResult.getByRole("button", { name: "Save 13YARN to favourites" })).toBeVisible();
+    const headingBox = await page.getByRole("heading", { level: 1, name: "13YARN" }).boundingBox();
+    const progressBox = await referralProgress.boundingBox();
+    const resultBox = await firstResult.boundingBox();
+    expect(headingBox).not.toBeNull();
+    expect(progressBox).not.toBeNull();
+    expect(resultBox).not.toBeNull();
+    expect(progressBox!.y).toBeGreaterThan(headingBox!.y);
+    expect(progressBox!.y).toBeLessThan(resultBox!.y);
 
-    // Exercise a real facet, then clear only that facet while preserving q.
+    await expect(page.getByTestId("service-quick-search-suggestions")).toHaveCount(0);
+
+    // The former service-group strip is now an honest, overlapping facet in
+    // the shared filter sheet. Clearing it preserves the active query.
     await page.getByTestId("service-filter-trigger-desktop").click();
     const filterPanel = page.getByTestId("service-filter-panel");
-    await filterPanel.getByRole("button", { name: /^Acuity/ }).click();
-    const crisisFacet = filterPanel.getByRole("button", { name: /^Crisis \/ urgent/ });
-    await expect(crisisFacet).toBeVisible();
-    await crisisFacet.click();
-    await expect(page).toHaveURL(/acuity_flags=crisis_high/);
+    await filterPanel.getByRole("button", { name: "Service category" }).click();
+    await expect(filterPanel.getByRole("button", { name: /^Public mental health/ })).toBeVisible();
+    await expect(filterPanel.getByRole("button", { name: /^Alcohol & other drugs/ })).toBeVisible();
+    await expect(filterPanel.getByRole("button", { name: /^Community & specialist support/ })).toBeVisible();
+    const crisisCategory = filterPanel.getByRole("button", { name: /^Crisis & urgent/ });
+    await expect(crisisCategory).toBeVisible();
+    await crisisCategory.click();
+    await expect(page).toHaveURL(/group=urgent/);
+    await expect(page.getByRole("button", { name: "Remove Crisis & urgent filter" })).toBeVisible();
     await filterPanel.getByTestId("service-filter-panel-clear").click();
-    await expect(page).toHaveURL(/q=13YARN/);
+    await expect(page).toHaveURL(/[?&]q=13YARN(?:&|#|$)/);
+    await expect(page).not.toHaveURL(/group=/);
     await expect(page.getByTestId("service-search-result-13yarn")).toBeVisible();
     await filterPanel.getByRole("button", { name: "Close", exact: true }).click();
 
@@ -1889,6 +1962,14 @@ test.describe("Clinical KB tools launcher", () => {
     await expect(visibleByTestId(page, "differentials-search-results")).toBeVisible();
     await expect(page.getByRole("heading", { name: "Differential matches" })).toBeVisible();
     await expect(page.getByRole("link", { name: "Delirium / Acute Confusion / Encephalopathy" }).first()).toBeVisible();
+    const desktopBestMatch = page.getByTestId("differential-best-match-card");
+    await expect(desktopBestMatch).toBeVisible();
+    await expect(desktopBestMatch.getByText("Best match", { exact: true })).toBeVisible();
+    await expect(desktopBestMatch.getByTestId("differential-best-match-panel")).toContainText(
+      /Why considered.*Look for.*Check next/s,
+    );
+    await expect(page.getByTestId("differential-compact-result").first()).toContainText("Clinical cues");
+    await expect(visibleByTestId(page, "differentials-search-results")).not.toContainText("Decision support");
   });
 
   test("differentials evidence-backed search badges stay single-line on narrow viewport", async ({ page }) => {
@@ -2113,6 +2194,11 @@ test.describe("Clinical KB tools launcher", () => {
     await expect.poll(async () => (await readPrimaryScrollGeometry(page)).scrollTop).toBe(0);
     const bestAnswer = page.getByTestId("differential-best-answer");
     await expect(bestAnswer).toBeVisible();
+    await expect(bestAnswer.getByText("Best match", { exact: true })).toBeVisible();
+    await expect(bestAnswer.getByTestId("differential-best-match-panel")).toContainText(
+      /Why considered.*Look for.*Check next/s,
+    );
+    await expect(bestAnswer).not.toContainText("Decision support");
     const foldLayout = await bestAnswer.evaluate((best) => {
       const main = document.querySelector("#main-content");
       const header = document.querySelector("header.universal-header");
@@ -2132,12 +2218,12 @@ test.describe("Clinical KB tools launcher", () => {
     expect(foldLayout!.bestTop).toBeGreaterThanOrEqual(foldLayout!.headerBottom - 2);
     expect(foldLayout!.bestTop).toBeLessThan(foldLayout!.viewportHeight * 0.5);
 
-    // Phone list hides the featured best answer, so ranks must start at 1.
+    // The featured best match owns rank 1; compact results continue at 2.
     const mobileCards = page.getByTestId("differential-mobile-result-card");
     await expect(mobileCards.first()).toBeVisible();
-    await expect(mobileCards.first().getByTestId("differential-mobile-result-rank")).toHaveText("1");
+    await expect(mobileCards.first().getByTestId("differential-mobile-result-rank")).toHaveText("2");
     const ranks = await mobileCards.getByTestId("differential-mobile-result-rank").allTextContents();
-    expect(ranks).toEqual(ranks.map((_, index) => String(index + 1)));
+    expect(ranks).toEqual(ranks.map((_, index) => String(index + 2)));
 
     // Selection reads as a checkbox, but only the visible box is compact. Its
     // surrounding label retains the repository's 48px phone target contract.
@@ -2641,12 +2727,12 @@ test.describe("Clinical KB tools launcher", () => {
     await page.setViewportSize({ width: 390, height: 820 });
     await gotoLauncher(page, "/tools");
 
-    const toolsHub = page.getByTestId("tools-hub");
-    await expect(toolsHub.getByText("Selected tool")).toHaveCount(0);
-    const detailsButton = toolsHub.getByRole("button", { name: "View details for Medication Prescribing" });
-    await expect(detailsButton).toHaveAttribute("aria-haspopup", "dialog");
+    const results = page.getByTestId("tools-search-results-page");
+    const detailsButton = results.getByRole("button", { name: "View details for Medication Prescribing" });
     await detailsButton.click();
-    await expect(page.getByRole("dialog", { name: "Medication Prescribing" })).toBeVisible();
+    const detailSheet = page.getByTestId("tools-search-detail-sheet");
+    await expect(detailSheet).toBeVisible();
+    await expect(detailSheet.getByRole("heading", { name: "Medication Prescribing" })).toBeVisible();
     await expectNoPageHorizontalOverflow(page);
   });
 });
@@ -3060,3 +3146,55 @@ test.describe("Responsive layout guards", () => {
     await expectNoPageHorizontalOverflow(page);
   });
 });
+
+test("low-confidence AccessibleTable keeps its full missing-value phrase readable at 320px @mockup", async ({
+  page,
+}, testInfo) => {
+  await page.setViewportSize({ width: 320, height: 700 });
+  await page.goto("/mockups/accessible-table-browser-fixture", { waitUntil: "domcontentloaded" });
+
+  const fixture = visibleByTestId(page, "accessible-table-browser-fixture");
+  await expect(fixture).toBeVisible({ timeout: 15_000 });
+  await expect(fixture.getByTestId("table-low-confidence-note")).toContainText(
+    "verify values against the source document",
+  );
+
+  const table = fixture.getByRole("table", { name: "Clozapine ANC response" });
+  await expect(table).toBeVisible();
+  const missingValues = table.getByTestId("missing-value");
+  await expect(missingValues).toHaveCount(2);
+  await expect(missingValues.first()).toHaveText("Not recorded");
+
+  const layout = await missingValues.first().evaluate((value) => {
+    const wrapper = value.parentElement;
+    if (!wrapper) throw new Error("Missing-value wrapper was not rendered");
+    const valueRect = value.getBoundingClientRect();
+    const wrapperRect = wrapper.getBoundingClientRect();
+    const style = getComputedStyle(wrapper);
+    return {
+      valueLeft: valueRect.left,
+      valueRight: valueRect.right,
+      wrapperLeft: wrapperRect.left,
+      wrapperRight: wrapperRect.right,
+      wrapperClientWidth: wrapper.clientWidth,
+      wrapperScrollWidth: wrapper.scrollWidth,
+      whiteSpace: style.whiteSpace,
+      overflow: style.overflow,
+      textOverflow: style.textOverflow,
+    };
+  });
+
+  expect(layout.whiteSpace).toBe("normal");
+  expect(layout.textOverflow).not.toBe("ellipsis");
+  expect(layout.wrapperScrollWidth - layout.wrapperClientWidth).toBeLessThanOrEqual(1);
+  expect(layout.valueLeft).toBeGreaterThanOrEqual(layout.wrapperLeft - 1);
+  expect(layout.valueRight).toBeLessThanOrEqual(layout.wrapperRight + 1);
+  await expectNoPageHorizontalOverflow(page);
+
+  const screenshotPath = testInfo.outputPath("low-confidence-accessible-table-320px.png");
+  await fixture.screenshot({ path: screenshotPath });
+  await testInfo.attach("low-confidence-accessible-table-320px", {
+    path: screenshotPath,
+    contentType: "image/png",
+  });
+});
diff --git a/tests/ui-universal-search.spec.ts b/tests/ui-universal-search.spec.ts
index 2d40d23799..6ee42b12ba 100644
--- a/tests/ui-universal-search.spec.ts
+++ b/tests/ui-universal-search.spec.ts
@@ -146,6 +146,21 @@ async function openComposer(page: Page, href = "/?mode=documents&focus=1") {
 test.beforeEach(stubZeroTouchPoints);
 
 test.describe("universal search typeahead", () => {
+  test("keeps calculator command suggestions local", async ({ page }) => {
+    let universalRequestCount = 0;
+    await page.route(/\/api\/search\/universal(?:\?.*)?$/, async (route) => {
+      universalRequestCount += 1;
+      await route.fulfill({ status: 204 });
+    });
+
+    const input = await openComposer(page, "/calculators?focus=1");
+    await input.fill("depression");
+    await expect(page.getByRole("option", { name: /depression severity.*PHQ-9/i })).toBeVisible();
+    await page.waitForTimeout(500);
+
+    expect(universalRequestCount).toBe(0);
+  });
+
   test("shows grouped cross-entity results while typing", async ({ page }) => {
     await mockUniversalSearch(page);
     const input = await openComposer(page);
diff --git a/tests/universal-search-stream.test.ts b/tests/universal-search-stream.test.ts
index 338be2f889..f4777f19ba 100644
--- a/tests/universal-search-stream.test.ts
+++ b/tests/universal-search-stream.test.ts
@@ -100,4 +100,24 @@ describe("consumeUniversalSearchNdjson", () => {
 
     await expect(consumeUniversalSearchNdjson(response)).rejects.toThrow("complete event");
   });
+
+  it("rejects a redacted server error and cancels the open response body", async () => {
+    const { consumeUniversalSearchNdjson } = await import("../src/lib/universal-search-stream");
+    const cancelled = vi.fn();
+    const response = new Response(
+      new ReadableStream<Uint8Array>({
+        start(controller) {
+          controller.enqueue(encoder.encode(`${JSON.stringify({ type: "error", code: "universal_search_failed" })}\n`));
+        },
+        cancel(reason) {
+          cancelled(reason);
+        },
+      }),
+      { headers: { "Content-Type": "application/x-ndjson; charset=utf-8" } },
+    );
+
+    await expect(consumeUniversalSearchNdjson(response)).rejects.toThrow("Universal search failed.");
+    expect(cancelled).toHaveBeenCalledOnce();
+    expect(cancelled).toHaveBeenCalledWith(expect.objectContaining({ message: "Universal search failed." }));
+  });
 });
diff --git a/tests/universal-search.test.ts b/tests/universal-search.test.ts
index e2f1a79ab5..6d96e0c5a3 100644
--- a/tests/universal-search.test.ts
+++ b/tests/universal-search.test.ts
@@ -789,4 +789,22 @@ describe("GET /api/search/universal (live public/owner path)", () => {
     expect(args.demo).toBe(false);
     expect(args.ownerId).toBe(userId);
   });
+
+  it("ends a rejected NDJSON search with a redacted error event", async () => {
+    const client = createSupabaseMock();
+    const runUniversalSearch = createRunMock();
+    runUniversalSearch.mockRejectedValue(new Error("private dependency failure"));
+    mockRuntime(client, runUniversalSearch);
+    const { GET } = await import("../src/app/api/search/universal/route");
+
+    const response = await GET(new Request("http://localhost/api/search/universal?q=clozapine&stream=ndjson"));
+    const events = (await response.text())
+      .trim()
+      .split("\n")
+      .map((line) => JSON.parse(line) as Record<string, unknown>);
+
+    expect(response.status).toBe(200);
+    expect(events).toEqual([{ type: "error", code: "universal_search_failed" }]);
+    expect(JSON.stringify(events)).not.toContain("private dependency failure");
+  });
 });
diff --git a/vitest.config.mts b/vitest.config.mts
index 1eae3841de..774e77bfcd 100644
--- a/vitest.config.mts
+++ b/vitest.config.mts
@@ -50,8 +50,18 @@ const config = {
         // Aggregate behavioral floors ratchet the full post-fixture group rather
         // than making individual large RAG modules brittle. Each value is the
         // greater of the measured whole-group floor or the broad floor + 5pp.
+        // Ledger #192 (maturity X6, 2026-08-14): re-measured against
+        // `npm run test:coverage` on this exact file set. Group B branches (81)
+        // and Group C branches (72) had drifted >5pp below measured — the same
+        // re-ratchet trigger documented above for the whole-repo floor — so
+        // those two values were raised to sit ~2pp under the fresh measurement.
+        // Every other value here already sat within that 5pp band and is
+        // unchanged: raising a floor that already tracks its baseline closely
+        // would risk a false failure from ordinary day-to-day branch-count
+        // variance, not close a real gap.
         "src/lib/{clinical-search,retrieval-selection,answer-ranking,clinical-value-binding,medication-entities,rag/rag-candidate-sources,rag/rag-context-selection,rag/rag-retrieval-variants,rag/rag-routing}.ts":
           {
+            // Measured 2026-08-14: 90.32/81.02/92.86/93.88 (stmt/branch/func/line).
             statements: 86,
             branches: 78,
             functions: 88,
@@ -59,18 +69,23 @@ const config = {
           },
         "src/lib/{answer-verification,evidence,evidence-relevance,rag/rag-claim-support,rag/rag-evidence-gates,rag/rag-quote-verification,rag/rag-source-segmentation}.ts":
           {
+            // Measured 2026-08-14: 93.89/86.04/95.24/96.44. Branches raised
+            // 81 -> 84 (gap was 5.04pp, just past the 5pp trigger).
             statements: 92,
-            branches: 81,
+            branches: 84,
             functions: 94,
             lines: 94,
           },
         "src/lib/rag/{rag,rag-extractive-answer,rag-comparison,rag-answer-support}.ts": {
+          // Measured 2026-08-14: 87.55/78.22/92.57/91.84. Branches raised
+          // 72 -> 76 (gap was 6.22pp, the largest in this file).
           statements: 83,
-          branches: 72,
+          branches: 76,
           functions: 90,
           lines: 88,
         },
         "src/lib/{clinical-safety,source-governance,source-review,clinical-review-queue,answer-response}.ts": {
+          // Measured 2026-08-14: 96.72/85.11/98.73/98.95.
           statements: 94,
           branches: 83,
           functions: 96,