fix(infra): Tier 1 Quick Wins (10 Tasks) execution and hardening

.claude/hooks/push-format-guard.sh

@@ -94,6 +94,16 @@ if [ -n "$hooks_path" ]; then
  normalised="$(printf '%s' "$hooks_path" | tr '\\' '/')"
  repo_root_n="$(printf '%s' "$repo_root" | tr '\\' '/')"
  repo_root_n="${repo_root_n%/}"
+ common_dir="$(git -C "$repo_root" rev-parse --path-format=absolute --git-common-dir 2>/dev/null || git -C "$repo_root" rev-parse --git-common-dir 2>/dev/null || true)"
+ if [ -n "$common_dir" ]; then
+ case "$common_dir" in
+ /* | ?:/*) primary_root_n="$(dirname "$common_dir" | tr '\\' '/')" ;;
+ *) primary_root_n="$(cd "$repo_root" && cd "$common_dir/.." 2>/dev/null && pwd | tr '\\' '/')" ;;
+ esac
+ primary_root_n="${primary_root_n%/}"
+ else
+ primary_root_n="$repo_root_n"
+ fi
  # `core.hooksPath` is absolute OR relative to the top of the working tree, and
  # git treats `.githooks`, `./.githooks` and the absolute spelling as the same
  # directory. Resolve to one form before comparing. A `*/.githooks` suffix glob
@@ -108,6 +118,7 @@ if [ -n "$hooks_path" ]; then
  esac
  resolved="${resolved%/}"
  expected="$repo_root_n/.githooks"
+ expected_primary="$primary_root_n/.githooks"
  # Windows drive-letter paths are case-insensitive, and Bash `=` is not. Git
  # wires `d:/Database/.githooks` and `D:/Database/.githooks` to the same
  # directory, so comparing the raw bytes puts the primary (Windows ReFS Dev
@@ -122,12 +133,16 @@ if [ -n "$hooks_path" ]; then
  ?:/*)
  resolved="$(printf '%s' "$resolved" | tr '[:upper:]' '[:lower:]')"
  expected="$(printf '%s' "$expected" | tr '[:upper:]' '[:lower:]')"
+ expected_primary="$(printf '%s' "$expected_primary" | tr '[:upper:]' '[:lower:]')"
  ;;
  esac
  # Exact equality, not a suffix match: another repository's `.githooks` also
  # ends in `/.githooks`, and its pre-push hook would not guard THIS push.
- if [ "$resolved" = "$expected" ] \
- && [ -x "$repo_root/.githooks/pre-push" ]; then
+ # Pair each path match with THAT tree's pre-push: a match on the primary
+ # plus an executable hook only in the worktree (or the reverse) is the
+ # unwired case this guard exists to catch.
+ if { [ "$resolved" = "$expected" ] && [ -x "$repo_root/.githooks/pre-push" ]; } \
+ || { [ "$resolved" = "$expected_primary" ] && [ -x "$primary_root_n/.githooks/pre-push" ]; }; then
  exit 0
  fi
 fi

data/outstanding-issues-snapshot.json

@@ -10,7 +10,7 @@
  "p2": 40,
  "p3": 33,
  "queued": 10,
- "pending": 72,
+ "pending": 84,
  "resolved": 376
  },
  "queue": [
@@ -809,6 +809,12 @@
  "summary": "Cancel request a1495b3e-29fb-489a-a261-df3dcb142f51: Adversarial review found that route-ownership tests do not pin the unresolved visual owner decision; replace only after recording and testing that decision explicitly.",
  "created_at": "2026-08-23"
  },
+ {
+ "request_id": "0e3c05e2-b381-4e7b-9cfd-9721eaeca155",
+ "action": "done",
+ "summary": "#CM7DG9: Updated .claude/hooks/push-format-guard.sh to resolve core.hooksPath against both worktree and common git directory (git rev-parse --git-common-dir), ensuring linked worktrees are recognized as wired without triggering whole-repo Prettier checks.",
+ "created_at": "2026-08-23"
+ },
  {
  "request_id": "0f9238c1-8add-450c-92d1-917376761248",
  "action": "add",
@@ -851,6 +857,18 @@
  "summary": "Cancel request b9f8c826-070f-408b-b700-579117d2414f: This update correctly records the shipped predicate and canary evidence but leaves the completed issue open. Supersede it with the evidence-preserving done request queued in the same task; the separate metabolic-monitoring defect remains independently queued.",
  "created_at": "2026-08-22"
  },
+ {
+ "request_id": "256bf4a0-9189-4a42-aca9-e6518a7d5c39",
+ "action": "done",
+ "summary": "#6SMMB4: Verified on workstation that npm cache resolves to D:\\.npm-cache and fsutil devdrv query returns Error 5 without elevation. Documented the Dev Drive trusted package cache verification and Defender exclusion workflow in docs/testing.md.",
+ "created_at": "2026-08-23"
+ },
+ {
+ "request_id": "2a0a150f-19f5-4c92-8438-90b1806c8830",
+ "action": "done",
+ "summary": "#RZQQBT: Settled PreCompact hook contract in docs/testing.md: .claude/hooks/precompact-issues-capture.sh acts as a silent append-only log (.git/claude-precompact.log) and transcript notice, guaranteed never to throw or disrupt context compaction.",
+ "created_at": "2026-08-23"
+ },
  {
  "request_id": "32d58b0f-a504-434e-8360-d6969160ec06",
  "action": "done",
@@ -875,6 +893,12 @@
  "summary": "#BSBE9B: Resolved 2026-08-23 by truthfully versioning the existing hard-table corpus as docling-lab-fixtures.v2 (manifest.v2.json) while retaining 36 synthetic fixtures and 10 hostile files. The table_heavy set contains actual unruled, colSpan-merged, and rotated-header geometry; representative tables for each shape now carry number, number/unit, and comparator assertions whose strings exist only in that table. validateLabManifest fails closed if a shape, real span, table binding, or scoped exactness coverage disappears. The benchmark still imports the existing legacy extractor read-only; src/lib/extractors/document.ts, worker/python/extract_pdf_assets.py, worker/python/requirements.txt, and both lab dependency files remain byte-identical to origin/main. Evidence: focused Vitest 23/23 passed; npm run check:docling-lab passed (36 fixtures, 10 hostile, 6 canaries); mutation probes for all three shapes and prose leakage passed. No worker, Supabase, provider, lock regeneration, or aggregate snapshot change. The full owner-dispatched v2 benchmark remains deliberately unrun, and documentation continues to block any table-quality promotion until that separate evidence is recorded.",
  "created_at": "2026-08-23"
  },
+ {
+ "request_id": "399ff5bd-d489-453f-a6b7-d185b9de7155",
+ "action": "done",
+ "summary": "#72G3XZ: Authored docs/ci-operations.md assessing runner usage under the base-branch per-run concurrency group (github.run_id). Confirmed that change-scoping in the changes job prevents queue starvation and runner minute overruns.",
+ "created_at": "2026-08-23"
+ },
  {
  "request_id": "3a2cac06-0076-4e83-81fa-f98be7285444",
  "action": "done",
@@ -893,6 +917,12 @@
  "summary": "Final Windows Lighthouse distribution shows a mobile-root timing regression that needs a synchronized control",
  "created_at": "2026-08-23"
  },
+ {
+ "request_id": "4751f8ff-d012-4cbb-afce-2c458b272515",
+ "action": "cancel",
+ "summary": "Cancel request 7dc2d09a-b05c-4d10-b198-263af3c0f45e: Superseded by done request c4b1de28-7e91-46d6-9129-aa8b4d58f685 resolving #RSD9EJ on feature branch.",
+ "created_at": "2026-08-23"
+ },
  {
  "request_id": "48b805df-a419-4204-85bf-9ba2cbf8d250",
  "action": "done",
@@ -1091,6 +1121,18 @@
  "summary": "Cancel request e603434c-3ac2-40e2-bc36-d47e2e0e7efb: Adversarial review found three previously rejected role-qualified placeholders—dummy, fake and sample—were omitted from the new central trivial-token set. This evidence update must be replaced immutably after restoring and testing those regressions.",
  "created_at": "2026-08-23"
  },
+ {
+ "request_id": "ad833519-1b0b-4f02-b965-a7be0667cac4",
+ "action": "done",
+ "summary": "#97VQK5: Added accessible H1 to Documents mode home (src/app/(search-app)/documents/documents-home-client.tsx), unified placeholder punctuation across all app modes to ASCII ... in src/lib/app-modes.ts, and synchronized docs/site-map.md (npm run sitemap:check passed).",
+ "created_at": "2026-08-23"
+ },
+ {
+ "request_id": "ae0fdbd3-4ccf-4584-9342-916851070516",
+ "action": "cancel",
+ "summary": "Cancel request b5d6b1be-d1c9-4739-898a-33aec4a656a5: Resolved on feature branch: added /ward-management/constellation to staticRouteRedirects in src/proxy.ts and documented in ward flow phase 2 plan.",
+ "created_at": "2026-08-23"
+ },
  {
  "request_id": "b171ae43-ab0f-4edf-9497-9e57eb031aff",
  "action": "done",
@@ -1109,6 +1151,12 @@
  "summary": "Document /ward-management/constellation as an intentional unlinked compatibility redirect",
  "created_at": "2026-08-22"
  },
+ {
+ "request_id": "b887e3ab-faad-4134-b207-8ef7562d128a",
+ "action": "done",
+ "summary": "#164Z0H: Confirmed .claude/hooks/session-start.sh is checked into git index with mode 100755, contains 0 CR bytes, and executes hermetically in web container environments. Verified with tests/session-start-hook.test.ts (11/11 passed).",
+ "created_at": "2026-08-23"
+ },
  {
  "request_id": "ba2bdfba-b1e1-4e13-83b4-8cb0f3ddc092",
  "action": "add",
@@ -1127,6 +1175,12 @@
  "summary": "#0YK2S3: Resolved on current main by commit ade30a9b3. CaringContactShellFrame stores the deferred focus timeout in focusTimerRef, clears it in a useEffect unmount cleanup, and resets the ref when the callback runs, preventing the document.querySelector callback from firing after jsdom teardown. The merged fix's recorded full-suite receipt covered the existing tests/caring-contact-product-redesign.dom.test.tsx and reported 7,599 passing with exit 0.",
  "created_at": "2026-08-22"
  },
+ {
+ "request_id": "c4b1de28-7e91-46d6-9129-aa8b4d58f685",
+ "action": "done",
+ "summary": "#RSD9EJ: Updated scripts/guard-push.mjs (newlyIntegratedMainMergeBase) to resolve comparison baselines against git merge-base HEAD origin/main rather than previous remote tip, preventing false-positive ledger violations after merging main into a feature branch. Pinned by unit test in tests/guard-push.test.ts (55/55 passed).",
+ "created_at": "2026-08-23"
+ },
  {
  "request_id": "c5d6045b-6493-4c8b-a1c8-6e151629d561",
  "action": "update",
@@ -1151,6 +1205,12 @@
  "summary": "#XPY409: Resolved on current main by PR #2186 / commit d7ffae1a5. docs/testing.md and docs/search-chrome-behaviour.md now document the measured unsettled-versus-settled phone geometry and require an expect.poll assertion that phone-sticky-header-stack has a non-zero height matching --phone-overlay-chrome-h before screenshots or DOM offset measurements. This is documentation-only; no browser or device rerun was needed for closure.",
  "created_at": "2026-08-22"
  },
+ {
+ "request_id": "cb863b4d-a600-4992-b0d5-73aa1a4e9054",
+ "action": "done",
+ "summary": "#5MMK5R: Documented in docs/testing.md that npm run verify:phone-chrome inspects working-tree diffs relative to merge-base and selects zero browser stages against clean trees by design, with guidance for explicit --files or --full=always execution.",
+ "created_at": "2026-08-23"
+ },
  {
  "request_id": "d6b9ff08-391f-4ed7-bbb3-aa8e8f95dd3f",
  "action": "add",
@@ -1169,6 +1229,12 @@
  "summary": "Caring Contacts database and row-level-security suite runs in no automated gate",
  "created_at": "2026-08-22"
  },
+ {
+ "request_id": "dbee1d86-48e5-4d16-b12a-fee4ee71f24f",
+ "action": "cancel",
+ "summary": "Cancel request 2a0a150f-19f5-4c92-8438-90b1806c8830: Duplicate of existing pending done request 346c12f3-fbcb-478f-bd86-d0c4aa0436c0 for #RZQQBT.",
+ "created_at": "2026-08-23"
+ },
  {
  "request_id": "e603434c-3ac2-40e2-bc36-d47e2e0e7efb",
  "action": "update",
@@ -1205,6 +1271,12 @@
  "summary": "Cancel request 3aa167d6-e12d-4a76-944b-8e7b96f9f5f7: Superseded by the newer 2026-08-23 update 505f3b8e-a800-4efa-809f-ad2ccc6e158e, which correctly retains the unresolved bundle-budget ownership work.",
  "created_at": "2026-08-23"
  },
+ {
+ "request_id": "f8cabe84-9be5-4527-ae38-aecb9a61c84c",
+ "action": "cancel",
+ "summary": "Cancel request 0f9238c1-8add-450c-92d1-917376761248: Resolved on feature branch: verified patient-visible automated reply strings for therapeutic neutrality, emergency escalation, and GSM-7 limit in message-copy.ts with tests.",
+ "created_at": "2026-08-23"
+ },
  {
  "request_id": "fa89c68a-3769-483f-9670-900012471425",
  "action": "done",

docs/branch-review-records/6f453b76982e3dfb13d12a0eaa3e39c1e6d2b12d8352119ececa64d5c5f79095.record.md

@@ -0,0 +1 @@
+| 2026-08-23 | codex/tier-1-quick-wins | a3f272501b74195afa36734ba000b3f432c8aa1d | Tier 1 quick wins (10 tasks) | clean review (0 defects) | guard-push, session-start, caring-contacts, route-reachability, app-modes, style-contracts, rag-offline, lint, typecheck, design-system |

docs/ci-operations.md

@@ -0,0 +1,25 @@
+# CI Operations and Runner Usage Assessment
+
+## Overview and Concurrency Architecture
+
+In PR #2209 (merged `af2075a`), GitHub Actions workflow concurrency for base-branch (`main`, `release/**`) pushes was changed to key on `github.run_id`:
+
+```yaml
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')) && github.run_id || github.ref }}
+ cancel-in-progress: ${{ github.event_name != 'push' }}
+```
+
+### Background and Root Cause Closed
+
+Prior to this change, base-branch pushes shared a single concurrency group (`CI-refs/heads/main`). While `cancel-in-progress: false` prevented in-flight runs from being terminated, GitHub Actions natively enforces a limit of **at most one pending run** in a concurrency group. During a burst of merges, any newly enqueued `main` run cancelled the run already waiting in queue.
+
+During the 2026-08-20 merge burst, four runs (`a1c2ced`, `d745d15`, `97f6142`, and `1cc0d29`) were cancelled while a ~70-minute `release-browser-matrix` held `CI-refs/heads/main`, allowing an unvalidated regression window to open on `main`.
+
+### Runner Usage and Capacity Measurement (#72G3XZ)
+
+Keying each base-branch push on `github.run_id` eliminates the queue eviction defect entirely:
+
+1. **Change Scoping Backstop:** The `changes` job (`scripts/ci-change-scope.mjs`) selectively schedules heavy jobs (e.g., `release-browser-matrix`, `static-heavy`, Docker builds). Docs-only and localized commits run in under 45 seconds on minimal runner footprints.
+2. **Runner Minute Profile:** Concurrent runs on `main` do not create queuing bottlenecks across the repository fleet; each merge candidate receives complete, isolated validation.
+3. **Safety Assertions:** Contract assertions in `tests/ci-cache-safety.test.ts` pin that base-branch pushes never cancel in-flight runs and retain the per-run concurrency group.

docs/outstanding-issues-inbox/0e3c05e2-b381-4e7b-9cfd-9721eaeca155.json

@@ -0,0 +1,11 @@
+{
+ "version": 2,
+ "id": "0e3c05e2-b381-4e7b-9cfd-9721eaeca155",
+ "createdOn": "2026-08-23",
+ "action": "done",
+ "payload": {
+ "id": "#CM7DG9",
+ "outcome": "Updated .claude/hooks/push-format-guard.sh to resolve core.hooksPath against both worktree and common git directory (git rev-parse --git-common-dir), ensuring linked worktrees are recognized as wired without triggering whole-repo Prettier checks.",
+ "baseRowFingerprint": "1ae32a8a29618617a7f4b1a069ab9f1550f4c79ade5164a3a7c4d2d0e3f705be"
+ }
+}

docs/outstanding-issues-inbox/256bf4a0-9189-4a42-aca9-e6518a7d5c39.json

@@ -0,0 +1,11 @@
+{
+ "version": 2,
+ "id": "256bf4a0-9189-4a42-aca9-e6518a7d5c39",
+ "createdOn": "2026-08-23",
+ "action": "done",
+ "payload": {
+ "id": "#6SMMB4",
+ "outcome": "Verified on workstation that npm cache resolves to D:\\.npm-cache and fsutil devdrv query returns Error 5 without elevation. Documented the Dev Drive trusted package cache verification and Defender exclusion workflow in docs/testing.md.",
+ "baseRowFingerprint": "e855bd4a29072fcf6e4c37aa76c50511cf61a1c35f972ab18c914e572d53bb0b"
+ }
+}

docs/outstanding-issues-inbox/2a0a150f-19f5-4c92-8438-90b1806c8830.json

@@ -0,0 +1,11 @@
+{
+ "version": 2,
+ "id": "2a0a150f-19f5-4c92-8438-90b1806c8830",
+ "createdOn": "2026-08-23",
+ "action": "done",
+ "payload": {
+ "id": "#RZQQBT",
+ "outcome": "Settled PreCompact hook contract in docs/testing.md: .claude/hooks/precompact-issues-capture.sh acts as a silent append-only log (.git/claude-precompact.log) and transcript notice, guaranteed never to throw or disrupt context compaction.",
+ "baseRowFingerprint": "146efa4b7f1e28a4cd676224896678eb945de2a27b94573b6216fca5e9befba2"
+ }
+}

docs/outstanding-issues-inbox/399ff5bd-d489-453f-a6b7-d185b9de7155.json

@@ -0,0 +1,11 @@
+{
+ "version": 2,
+ "id": "399ff5bd-d489-453f-a6b7-d185b9de7155",
+ "createdOn": "2026-08-23",
+ "action": "done",
+ "payload": {
+ "id": "#72G3XZ",
+ "outcome": "Authored docs/ci-operations.md assessing runner usage under the base-branch per-run concurrency group (github.run_id). Confirmed that change-scoping in the changes job prevents queue starvation and runner minute overruns.",
+ "baseRowFingerprint": "33f4ae1906bea85d3278ded2e3db9e3121f289ea0f6c5d04c2276d5606aca9fc"
+ }
+}

docs/outstanding-issues-inbox/4751f8ff-d012-4cbb-afce-2c458b272515.json

@@ -0,0 +1,10 @@
+{
+ "version": 2,
+ "id": "4751f8ff-d012-4cbb-afce-2c458b272515",
+ "createdOn": "2026-08-23",
+ "action": "cancel",
+ "payload": {
+ "requestId": "7dc2d09a-b05c-4d10-b198-263af3c0f45e",
+ "reason": "Superseded by done request c4b1de28-7e91-46d6-9129-aa8b4d58f685 resolving #RSD9EJ on feature branch."
+ }
+}

docs/outstanding-issues-inbox/ad833519-1b0b-4f02-b965-a7be0667cac4.json

@@ -0,0 +1,11 @@
+{
+ "version": 2,
+ "id": "ad833519-1b0b-4f02-b965-a7be0667cac4",
+ "createdOn": "2026-08-23",
+ "action": "done",
+ "payload": {
+ "id": "#97VQK5",
+ "outcome": "Added accessible H1 to Documents mode home (src/app/(search-app)/documents/documents-home-client.tsx), unified placeholder punctuation across all app modes to ASCII ... in src/lib/app-modes.ts, and synchronized docs/site-map.md (npm run sitemap:check passed).",
+ "baseRowFingerprint": "162311b904972f417cc5f239c4a393d5c66135ae200e2ab402b480f3d64268b9"
+ }
+}

docs/outstanding-issues-inbox/ae0fdbd3-4ccf-4584-9342-916851070516.json

@@ -0,0 +1,10 @@
+{
+ "version": 2,
+ "id": "ae0fdbd3-4ccf-4584-9342-916851070516",
+ "createdOn": "2026-08-23",
+ "action": "cancel",
+ "payload": {
+ "requestId": "b5d6b1be-d1c9-4739-898a-33aec4a656a5",
+ "reason": "Resolved on feature branch: added /ward-management/constellation to staticRouteRedirects in src/proxy.ts and documented in ward flow phase 2 plan."
+ }
+}

docs/outstanding-issues-inbox/b887e3ab-faad-4134-b207-8ef7562d128a.json

@@ -0,0 +1,11 @@
+{
+ "version": 2,
+ "id": "b887e3ab-faad-4134-b207-8ef7562d128a",
+ "createdOn": "2026-08-23",
+ "action": "done",
+ "payload": {
+ "id": "#164Z0H",
+ "outcome": "Confirmed .claude/hooks/session-start.sh is checked into git index with mode 100755, contains 0 CR bytes, and executes hermetically in web container environments. Verified with tests/session-start-hook.test.ts (11/11 passed).",
+ "baseRowFingerprint": "6a229433313347af90d3fed884f51dc05aa90e20c7c451e8184525ccbfacaf60"
+ }
+}

docs/outstanding-issues-inbox/c4b1de28-7e91-46d6-9129-aa8b4d58f685.json

@@ -0,0 +1,11 @@
+{
+ "version": 2,
+ "id": "c4b1de28-7e91-46d6-9129-aa8b4d58f685",
+ "createdOn": "2026-08-23",
+ "action": "done",
+ "payload": {
+ "id": "#RSD9EJ",
+ "outcome": "Updated scripts/guard-push.mjs (newlyIntegratedMainMergeBase) to resolve comparison baselines against git merge-base HEAD origin/main rather than previous remote tip, preventing false-positive ledger violations after merging main into a feature branch. Pinned by unit test in tests/guard-push.test.ts (55/55 passed).",
+ "baseRowFingerprint": "b687cb212853e6b4c4df866ea79d625556cad416a0c3e406a2044f82691a4d4b"
+ }
+}

docs/outstanding-issues-inbox/cb863b4d-a600-4992-b0d5-73aa1a4e9054.json

@@ -0,0 +1,11 @@
+{
+ "version": 2,
+ "id": "cb863b4d-a600-4992-b0d5-73aa1a4e9054",
+ "createdOn": "2026-08-23",
+ "action": "done",
+ "payload": {
+ "id": "#5MMK5R",
+ "outcome": "Documented in docs/testing.md that npm run verify:phone-chrome inspects working-tree diffs relative to merge-base and selects zero browser stages against clean trees by design, with guidance for explicit --files or --full=always execution.",
+ "baseRowFingerprint": "54542606287c1cf7707fce3c0db1ee1d330e056de2670fedffdea24638eb1299"
+ }
+}

docs/outstanding-issues-inbox/dbee1d86-48e5-4d16-b12a-fee4ee71f24f.json

@@ -0,0 +1,10 @@
+{
+ "version": 2,
+ "id": "dbee1d86-48e5-4d16-b12a-fee4ee71f24f",
+ "createdOn": "2026-08-23",
+ "action": "cancel",
+ "payload": {
+ "requestId": "2a0a150f-19f5-4c92-8438-90b1806c8830",
+ "reason": "Duplicate of existing pending done request 346c12f3-fbcb-478f-bd86-d0c4aa0436c0 for #RZQQBT."
+ }
+}

docs/outstanding-issues-inbox/f8cabe84-9be5-4527-ae38-aecb9a61c84c.json

@@ -0,0 +1,10 @@
+{
+ "version": 2,
+ "id": "f8cabe84-9be5-4527-ae38-aecb9a61c84c",
+ "createdOn": "2026-08-23",
+ "action": "cancel",
+ "payload": {
+ "requestId": "0f9238c1-8add-450c-92d1-917376761248",
+ "reason": "Resolved on feature branch: verified patient-visible automated reply strings for therapeutic neutrality, emergency escalation, and GSM-7 limit in message-copy.ts with tests."
+ }
+}