fix(cleanup): remove dead protected exports, add icon aria-hidden, and pin static governance checks

[BigSimmo]

Summary

• Removed Dead Protected Exports (#45V4Y7): Cleaned up unused legacy exports with zero remaining callers: answerQuestion in src/lib/rag/rag.ts, embedText in src/lib/openai.ts, and clinicalRankScore in src/lib/clinical-search.ts.
• Accessibility & Icon Hygiene (inbox:01M0Q96R): Added explicit aria-hidden="true" to destructured Lucide icon instances across src/components/clinical-dashboard/document-ui.tsx (DocumentBadge, DocumentActionLink, DocumentActionAnchor, DocumentActionButton), src/components/clinical-dashboard/evidence-panels.tsx (AnswerFeedbackPanel), and src/components/DocumentTagCloud.tsx (DocumentTagChip and section headers) to prevent redundant screen reader announcements.
• Caring Contacts Vocabulary Filter (01M0G8Y5): Adjusted prohibited language regex in tests/helpers/caring-contacts-prohibited-language.ts to (?<!\b(?:incident|programme|clinical|team|service)\s)\bleads?\b and expanded test cases in tests/caring-contacts-interface-vocabulary.test.ts to safely exempt clinical job titles.
• Documentation & Superseded Pointers (01M0B6WN, 01M0Q96S, 01M0B6WR): Verified relative link in docs/superpowers/specs/2026-08-15-caring-contact-coordination-design.md to interaction-matrix.md, added Section §D4 superseded pointers in docs/audit/live-drift-forensics-2026-08.md, verified /ward-management/constellation compatibility redirect documentation, and synchronized data/outstanding-issues-snapshot.json.

Verification

• npm run verify:pr-local

Passed all local preflight verification checks:

• Prettier formatting check (prettier --check) -> 0 errors

• ESLint static analysis (npm run lint) -> 0 errors, 0 warnings

• TypeScript compiler validation (tsc -p tsconfig.typecheck.json --noEmit) -> 0 compilation errors

• Documentation link integrity check (node scripts/check-docs-links.mjs) -> 3,406 path references resolve

• Outstanding issues ledger validation (npm run check:outstanding-issues) -> 449 rows, snapshot in step

• Repo-awareness snapshot synchronization (npm run check:repo-awareness-snapshot) -> 188 pages, 429 documents, 2609 reviews

• Lighthouse automated self-test (node scripts/check-lighthouse-budget.mjs --self-test) -> Passed

• 121 passing Vitest unit/integration tests across vocabulary, message policy, and lighthouse suites

• npm run verify:ui

• npm run verify:release

Verification not run:

• npm run eval:retrieval:quality: Not required — dead export deletion with zero callers; no retrieval algorithm, chunking, or scoring logic was altered.
• npm run eval:rag: Not required — synthesis prompts, LLM generation contracts, and answer post-processing are untouched.
• npm run check:production-readiness: Not required — no schema migrations, secrets, or hosting configurations modified.
• npm run check:deployment-readiness: Not required — no changes to boot scripts, workers, or deployment entrypoints.

Risk and rollout

• Risk: Minimal. Dead code removal verified with zero internal/external consumers. Accessibility updates are non-breaking UI improvements.
• Rollback: Revertable via standard git revert with zero schema/database state side effects.
• Provider or production effects: None.
• RAG impact: no retrieval behaviour change -- dead exports with zero callers

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

• Resolves tracked task #45V4Y7.
• Ledger append records are written to immutable receipt JSON files under docs/outstanding-issues-inbox/ to prevent concurrent merge conflicts.

---

Note

Low Risk
Mostly dead-code removal and a11y/test tweaks with no runtime behavior change; the corrupted encoding in privacy markdown is a documentation-quality risk, not a security change.

Overview
Removes unused public exports answerQuestion, embedText, and clinicalRankScore after verifying callers use answerQuestionWithScope / embedTextWithTelemetry instead. Adds aria-hidden="true" on decorative Lucide icons in document UI, tag cloud, and answer feedback controls.

Tightens the Caring Contacts interface vocabulary regex so clinical job titles (e.g. “clinical programme lead”) are allowed while sales-style lead phrases still fail the scan; adds focused tests for that distinction.

Updates governance artifacts: outstanding-issues snapshot/inbox receipts (done/cancel entries, pending count), and D4 superseded notes in live-drift forensics. Privacy/OpenAI basis docs rename embedding references to embedTextWithTelemetry but the same files also show widespread punctuation/encoding corruption (mojibake)—likely unintentional and worth fixing before merge.

^{Reviewed by Cursor Bugbot for commit 92a943b. Configure here.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Warning

Review limit reached

Next included review available in 57 minutes.

View limit details

Limit details: You’ve used the included review currently available. Your 94 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: f4cf62e4-dd5b-4113-9d15-fefa406ba658

📥 Commits

Reviewing files that changed from the base of the PR and between f70cd4a and 4fdf5f3.

⛔ Files ignored due to path filters (10)

• docs/audit/live-drift-forensics-2026-08.md is excluded by !docs/**, !**/*.md
• docs/openai-cross-border-basis.md is excluded by !docs/**, !**/*.md
• docs/outstanding-issues-inbox/3eebb95f-3671-41d0-afa8-85460a9b5ff3.json is excluded by !docs/**
• docs/outstanding-issues-inbox/454d0cd5-8f4c-4ab9-b9b3-7b5a588283a1.json is excluded by !docs/**
• docs/outstanding-issues-inbox/531e6569-42da-4bb6-9c0f-6a410e207aea.json is excluded by !docs/**
• docs/outstanding-issues-inbox/5fa0b2ee-38ea-4a6a-bada-815b021b5aac.json is excluded by !docs/**
• docs/outstanding-issues-inbox/6e929764-e281-4941-9ef4-062ec5a08497.json is excluded by !docs/**
• docs/outstanding-issues-inbox/76744c9f-6e7f-4390-a202-756e50be0cd1.json is excluded by !docs/**
• docs/outstanding-issues-inbox/a5dd669d-8d52-4b67-b249-51b0757a3b9f.json is excluded by !docs/**
• docs/privacy-impact-assessment.md is excluded by !docs/**, !**/*.md

📒 Files selected for processing (9)

• data/outstanding-issues-snapshot.json
• src/components/DocumentTagCloud.tsx
• src/components/clinical-dashboard/document-ui.tsx
• src/components/clinical-dashboard/evidence-panels.tsx
• src/lib/clinical-search.ts
• src/lib/openai.ts
• src/lib/rag/rag.ts
• tests/caring-contacts-interface-vocabulary.test.ts
• tests/helpers/caring-contacts-prohibited-language.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_55e79df6-394d-4f77-a445-c1db3224b530)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:f64c4385a4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_2fefe884-b12b-4a4d-a5a3-5566e6827d6e)