chore(deps-dev): bump prettier from 3.9.0 to 3.9.1 - #98
Merged
Conversation
Bumps [prettier](https://github.com/prettier/prettier) from 3.9.0 to 3.9.1. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.0...3.9.1) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Uh oh!
There was an error while loading. Please reload this page.
BigSimmo pushed a commit
that referenced
this pull request
Jul 29, 2026
Both raised at P2 by Codex review on PR #1377 and both verified against the code before acting. 1. The measurement plan still described L1-2's REFUTED contract — "scope must start before the limiter settles". The L1-2 section was corrected when the overlap was removed but this paragraph was missed, so the doc contradicted both the route and tests/answer-route-preamble.test.ts. Anyone generalising the harness under #98 would have enforced the opposite invariant and reintroduced database work for throttled requests. It now states the actual admission-cost contract: scope starts only after admission, and a denial dispatches zero scope queries. 2. The provider-free wall-clock step claimed the typeahead route plus demo mode times "auth + rate-limit + scope + RPC". False on both counts: src/app/api/search/universal/route.ts:137 returns on isDemoMode() || isLocalNoAuthMode() BEFORE createAdminClient (:150), publicAccessContext (:151) and consumeSubjectApiRateLimit (:153), and resolveSearchScope is never called from that route. A demo-mode run would measure local fixture search and appear to clear an L1 finding it never exercised. The step now says to run it non-demo, and to time scope separately via /api/answer. Docs only; no source or test behaviour changes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01361jh3eYVjJCzXWjAhdZiF
BigSimmo added a commit
that referenced
this pull request
Jul 29, 2026
#1376) * perf: cut fixed per-request round trips and add preamble Server-Timing Five latency fixes from the 2026-07-28 audit (docs/audit/latency-audit-2026-07-28.md). Rebased fresh on main; the index migration that sank PR #1312 is split out. RAG impact: no retrieval behaviour change — the only src/lib/rag/** edit defers a process-local cache write off the response path. No scoring, ordering, selection, alias, or citation logic is touched, and the mid-request staleness guard that discards the write when the corpus moves is preserved. - Server-Timing: /api/answer/stream emitted none at all, and stream/route.ts:262 confirms it is the route the UI actually uses. Adds auth/ratelimit there and to /api/search, plus scope on /api/answer. On a streaming route only pre-flush stages can reach a header; routing in-stream stages through the SSE contract would put instrumentation inside a governed clinical payload. - Shared-cache hits no longer await the cache write. setCachedAnswer forces an uncached documents read, so the fastest path in the system paid a round trip before responding. Deferred, not dropped. - /api/answer overlaps scope resolution with the rate-limit RPC and aborts it on deny, so a throttled caller still costs nothing. Threading the signal also fixes scope queries never receiving .abortSignal(). - document_table_facts: three select("*") narrowed to explicit projections, keeping the generated search_tsv and owner_id off the wire. The PATCH response is unchanged — the projection matches the TableFactRow DTO field for field. - 10 of 11 ssr:false dashboard surfaces had no loading fallback and rendered nothing between HTML arrival and chunk execution; all now use the shared LoadingPanel. Adds preconnect/dns-prefetch for the Supabase origin, which AuthProvider contacts on mount with no connection warm-up. Ledger #98-#105 record the 19 findings not addressed here. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: address Codex P1s and restore docs link CI Keep resolveSearchScope behind the answer rate limiter so denied callers cannot enumerate documents/labels, and discard deferred shared-cache promotions that resume after invalidateRagCachesForOwner via an invalidation epoch. Drop the outstanding-issues reference to the unauthored L2-3 migration path that broke docs:check-links. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs(ledger): record pr-1376 CI/bugbot repair review Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs(ledger): supersede pr-1376 repair record at tip HEAD Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * style: prettier-format files that failed format:check Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * fix: harden cache invalidation epochs and close review follow-ups Scope invalidation epochs per owner, await shared-cache promotion with post-write cleanup on raced invalidation, thread the stream abort signal into resolveSearchScope, emit Server-Timing on empty-scope answers, and tighten the rate-limit gating test synchronization. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs(ledger): record pr-1376 follow-up repair at tip Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs: correct three audit claims and record the token-streaming refutation Corrections found while planning the remaining work — each was verified at the cited line, and each REDUCES the work the audit implied: - L3-3 was wrong twice: the Therapy Compass index and full payloads are mutually exclusive (mode-home first paint is 707 KB, not 3.16 MB), and the index split the finding implied was missing already ships via build-therapies-index.mjs with its own gate. The real residual is only the missing /public Cache-Control and the proxy matcher not excluding .json. - L3-6(b) overstated a 3-hop first-paint waterfall. The 4-way fan-out is gated on drawer visibility, and readLocalProjectIdentity is a guaranteed no-op off localhost. Real production win is ~1 hop. - L3-6(c) proposed batching as new work, but /api/images/signed-urls already exists with zero call sites. Records the hard constraint that signed URLs must never reach SearchResult.images[].signed_url, because rag-cache persists results into a shared cross-owner cache table. - The measurement plan named test-cache-path.mjs as an offline fixture; it is the vitest/tsc cache-directory helper. Names the real offline surface and the vi.doMock seam instead. Also adds Refutation 6 to docs/rag-behaviour/refuted-approaches.md: token streaming as a latency fix. Unlike Refutations 1-5 this was not re-attempted — it is recorded because the defect it would "fix" is real and visible, so the wrong fix is the one a future task reaches for first. answer-stream-contract.ts removed token/revising as a clinical-safety control; raw tokens bypass the numeric-faithfulness gate. Only admissible shape is progressive disclosure of already-verified sections over the existing progress event. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: keep shared-cache promote off the cold-path response Awaiting replaceSharedCacheRow inside setCachedAnswer blocked every generation path on a Sydney DB round trip. Restore fire-and-forget shared promote while keeping owner-scoped epoch cleanup after commit. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
BigSimmo pushed a commit
that referenced
this pull request
Jul 29, 2026
Confirms the squash merge landed by content: the diff between squash commit f4a3f50 and branch tip bebc6c0 is empty, so nothing was orphaned by the auto-merge race despite four concurrent pushes during the merge window. Also records that the coverage follow-ups were renumbered #98/#99 -> #106/#107 (main claimed #98-#105 concurrently) with both rows verified intact, and that the three red `PR required` results were concurrency cancellations rather than defects. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012YRCXgX4AWZ579bKN6sk6b
BigSimmo pushed a commit
that referenced
this pull request
Jul 29, 2026
…iew batch Eight review findings (1 Codex P2, 7 CodeRabbit), each verified against the code before acting. MOST CONSEQUENTIAL — the L2-3 "recall is byte-identical" claim was wrong, and it was load-bearing. fetchDocumentTitleAliasRows (rag-candidate-sources.ts:482) applies .limit(12) with no ORDER BY, so which twelve documents return is plan-dependent; a new index can change the title-alias set feeding candidate assembly. "No query text changes" is true, but recall does not follow from it. That claim was the argument for keeping L2-3 out of canary territory, so the gating is revised: the documents-list and (status,id) uses stay ordering-safe, the RAG-path index is canary-gated unless the unordered .limit(12) is made deterministic first — the cheaper fix, since an unordered LIMIT is latent nondeterminism regardless of this work. Operator SQL alone never reaches staging, DR, or local replay: migrations/ is the source of truth and schema.sql only a mirror, so hand-run statements hit the live database and nothing else, and a required_indexes registration would fail on every replayed environment. Authoring the migration is now a required part of #102, following the 20260717170000 idempotent pattern. This PR still ships no migration (the #1312 objection), but the runbook no longer implies the operator sequence is sufficient. Test guard hardened: the ordering case anchored on a fixed 5 ms sleep, which can expire before the handler reaches the limiter. It now waits for consumeSubjectApiRateLimit to be entered, then asserts scope is untouched — the same guarantee without the timing fragility. Ledger: the 78e2beb record still described the reverted scope-vs-ratelimit overlap. The ledger is append-only, so this appends a superseding record via ledger:append --supersede rather than editing the row, per the contract. Status wording: #102 is "runbook prepared", not done, while the operator steps are pending; #105 separates shipped implementation from pending browser verification; #98/#99/#102/#103/#105 restored to the execution queue with their remaining actions. Fixed the MD038 malformed RAG-impact code span. Verification: verify:cheap exit 0 (427 files, 4386 passed / 4 skipped); check:branch-review-ledger pass (1232 records, no duplicates). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01361jh3eYVjJCzXWjAhdZiF
BigSimmo pushed a commit
that referenced
this pull request
Jul 29, 2026
Following up my own reply on the offline-harness thread: restoring the script names was only half the fix. #1376 had added real implementation guidance to measurement-plan item 2 on main, and re-landing this audit overwrote it. That detail is what makes #98 buildable rather than merely described. Restored, with every reference verified rather than copied: - scripts/fixtures/rag-offline-contract-tests.json — exists. - The seam: vi.doMock("@/lib/supabase/admin", ...) before importing rag.ts. main cited tests/rag-offline-answer.test.ts:79-108; the admin doMock is actually at :102 (a second doMock at :108), so this cites :102. - Why it is the only zero-production-edit seam: rag.ts and rag-cache.ts construct their client inline per phase rather than accepting an injected one — verified, 4 and 8 createAdminClient() call sites respectively. - Ship as a vitest suite, not an npm script, so it rides npm run test instead of forcing a ci.yml edit via check-gate-manifest.mjs. Kept from this branch: the admission-cost direction guard, which main's copy lacks — any generalisation must assert scope starts only after the limiter admits and a denial dispatches zero scope queries, never the reverse. Also records why test-cache-path.mjs / check-rag-fixtures.mjs were the wrong reference, so the substitution is not repeated. Verification: verify:cheap exit 0 (427 files, 4386 passed / 4 skipped). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01361jh3eYVjJCzXWjAhdZiF
BigSimmo pushed a commit
that referenced
this pull request
Jul 29, 2026
Resolved docs/outstanding-issues.md by keeping this branch's updated #98, #102, #104 and #105 entries (the ones this PR rewrites) and adding main's new #108 and #109 rows; the rest of the conflict was prettier re-padding column widths after a summary-cell length change. next-id stays at 110. Removed four exact-duplicate branch-review-ledger rows produced by the union merge driver keeping both copies of rows present on this branch and on main - the duplication risk tracked as #88.
BigSimmo pushed a commit
that referenced
this pull request
Jul 29, 2026
The #98 row still named test-cache-path.mjs and check-rag-fixtures.mjs as the fixtures to build the round-trip counting harness over. Neither can count a RAG request: the first computes Vitest/TypeScript cache paths, the second only validates fixture manifests. A harness wired to them would have pinned nothing. The audit document already carried this retraction (:358); this row did not, so the stale references survived in the one place an implementer would actually read them. Now names scripts/eval-rag-offline.mjs, scripts/test-rag-offline.mjs, scripts/rag-offline-contract.mjs and scripts/fixtures/rag-offline-contract-tests.json, all four verified present, and records the correction inline so it is not reintroduced a third time. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01361jh3eYVjJCzXWjAhdZiF
BigSimmo pushed a commit
that referenced
this pull request
Jul 29, 2026
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01361jh3eYVjJCzXWjAhdZiF
BigSimmo pushed a commit
that referenced
this pull request
Jul 29, 2026
Resolves the `docs/outstanding-issues.md` conflict. Two independent causes: 1. Rows #98–#105 diverged. `main` carries the newer text (PR #1377 landed "Done 2026-07-29" outcomes and rewrote several summaries); this branch carried the pre-#1377 wording. Took `main`'s rows wholesale — the branch made no edits to that range, it simply forked before them. 2. `#108`/`#109` were allocated twice. `main` used them for the verified-landed branch deletions and the shallow-clone finding; this branch had used the same two ids for the design-system token manifest and the `ui-overlap` flake. The `issues:next-id` marker has no concurrency protection, which is exactly the failure the branch's own PR notes predicted. Renumbered this branch's two rows to #110/#111 and bumped the marker to 112. No content was dropped from either side; all 111 rows are unique. Also records #111 as done, since this branch is what fixes it: the ui-overlap inset measurement now retries inside `toPass` with the 2px symmetry tolerance and the assertions unchanged. Leaving it open with a "Next: apply the retry shape" action would have re-queued work this PR already did.
This was referenced Jul 30, 2026
BigSimmo pushed a commit
that referenced
this pull request
Jul 30, 2026
Sync main, then update two rows against evidence rather than adding new ones. #98: PR #1450 landed the counting proxy and answer-path budgets while this branch was open. Verified rather than assumed — the helper counts on execution not construction, tests/rag-round-trip-budget.test.ts pins two answer-path scenarios plus three counter self-tests, and it is registered in the offline contract fixture so it runs there. Ran it: Test Files 1 passed (1), Tests 5 passed (5). The row stays open with its Next narrowed to the two real gaps: /api/search has no budget, and eval-rag-offline/test-rag-offline were not wired. Also records the helper's own blind spot — it sees only traffic through the wrapped client. #130: already owns the unfiled pre-paint/cold-load guard, so its design goes there instead of a new row. Records what the guard must test (the pre-paint reserve seed, sampled before and after hydration rather than once after), why a zero-inset profile is required for it to be able to fail at all, and that it must be proven against the broken shape first. Also records the environment blocker: browser gates cannot launch here per #121, and the symlink bridge writes under /opt, which the sandbox refuses. No new ids allocated; both are updates to rows that already own the work. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018K7sEKH35KZkWxvCnQcNN2
BigSimmo added a commit
that referenced
this pull request
Jul 30, 2026
…gn (#1455) * issues: close#122, capture the container Playwright pin mismatch Three related ledger items, each independently revertible. Close#122 (`ci/circleci: verify` fails on every branch). Its outcome allowed either "trustworthy signal again, or it stops reporting"; the second happened. `.circleci/config.yml` was deleted by 9779828 (PR #1412), and PR #1452's head reported 21 check runs with none named `ci/circleci: verify`, so the status no longer reports on new PRs. No operator log read is needed and the quota hypothesis is retired unproven. Capture #145: the remote container ships Chromium 1194 while the repo's Playwright pin wants 1234, so every browser test dies at launch and zero assertions run while the output reads like product breakage. This has cost time twice — the 2026-07-30 handoff records 13 launch failures read as a code defect, and #120 was filed on a gate reading taken under the same condition. The row gives the start-of-session check and keeps the existing "never run npx playwright install" stop rule. Fix a stale rule found while verifying #122: AGENTS.md cited `ci/circleci: verify` as a check that fails on unformatted files. It cannot report again, so the rule now names `Static PR checks` and records the CircleCI failures as history. The outstanding-issues diff is 4 insertions / 3 deletions ignoring whitespace; the rest is Prettier re-padding the archive table, because #122's original summary is wider than that column and was kept verbatim. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018K7sEKH35KZkWxvCnQcNN2 * issues: fold the Playwright pin evidence into #121, drop duplicate #145 Codex review was right: #121 ("Container Playwright browser build lags the pinned client") already tracks this exact condition — client 1234 versus container 1194, every browser test failing at launch — so #145 created a second canonical action for one problem. The row was allocated without first searching the open table, which is the dedupe step the issues skill requires. #145 is removed and its distinct content folded into #121: the reproduction on main at c5c1a86, the fact that the condition has now been misread twice (the handoff's 13 launch failures, and #120 filed as a gate defect under it), the detection command to run before trusting a browser gate, and the stop rule against filing a gate defect from a run whose tests never launched. #121's own workaround, PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD note and open Next decision are unchanged. The id marker rolls back 146 -> 145 because #145 was never used by a live row. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018K7sEKH35KZkWxvCnQcNN2 * issues: record #98 delivery and #130 pre-paint guard design Sync main, then update two rows against evidence rather than adding new ones. #98: PR #1450 landed the counting proxy and answer-path budgets while this branch was open. Verified rather than assumed — the helper counts on execution not construction, tests/rag-round-trip-budget.test.ts pins two answer-path scenarios plus three counter self-tests, and it is registered in the offline contract fixture so it runs there. Ran it: Test Files 1 passed (1), Tests 5 passed (5). The row stays open with its Next narrowed to the two real gaps: /api/search has no budget, and eval-rag-offline/test-rag-offline were not wired. Also records the helper's own blind spot — it sees only traffic through the wrapped client. #130: already owns the unfiled pre-paint/cold-load guard, so its design goes there instead of a new row. Records what the guard must test (the pre-paint reserve seed, sampled before and after hydration rather than once after), why a zero-inset profile is required for it to be able to fail at all, and that it must be proven against the broken shape first. Also records the environment blocker: browser gates cannot launch here per #121, and the symlink bridge writes under /opt, which the sandbox refuses. No new ids allocated; both are updates to rows that already own the work. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018K7sEKH35KZkWxvCnQcNN2 --------- Co-authored-by: Claude <noreply@anthropic.com>
14 tasks
BigSimmo pushed a commit
that referenced
this pull request
Jul 30, 2026
…and #146 Conflict was docs/outstanding-issues.md only. Took main's copy wholesale (it carries #122's closure and the #98/#130 records from #1455) and re-applied the two one-line relocation notes, rather than hand-editing the conflict region. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JHLPEV4o1rzipPDqshCSHY
BigSimmo pushed a commit
that referenced
this pull request
Jul 30, 2026
Closes the half of #98 that PR #1450 left open: /api/search had no budget, so an added round trip there was still an inference rather than a red gate. tests/search-round-trip-budget.test.ts pins searchChunksWithTelemetry — the function src/app/api/search/route.ts actually calls — using the existing counting proxy, and is registered in both the offline contract fixture and rag-offline-contract.mjs so it runs in the contract rather than on demand. Two scenarios. A lexical clinical search currently costs 11 round trips: rag_aliases 1, match_document_chunks_text_v2 3, match_document_table_facts_text_v2 3, get_related_document_metadata_v2 1, document_index_quality 1, document_images 2. Both the total and the breakdown are pinned, because a refactor swapping one probe for an unrelated query would hold the total while changing the traffic. Whether 3+3 text RPCs per search is intended is not settled here — the budget makes it visible and #98 now carries it as an open retrieval decision. The second scenario pins zero Supabase traffic for a query refused as adversarial, matching rag.ts's claim that prompt-injection intent is refused before any query issues. Both guards were proven against the broken shape rather than assumed: - The first control spent 0 trips because the module registry was cached between runs, so it would have passed while proving nothing. Fixed with vi.resetModules() inside the harness. - The refusal check initially failed on the results assertion rather than the round-trip one, demonstrating only that the test catches the regression, not that the budget can fail. The counter assertion is now ordered first; with a non-refused query it fails as "expected 11 to be +0". Counts are deterministic across three consecutive runs. No src/lib/rag file is edited; this observes the path, it does not change retrieval behaviour. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018K7sEKH35KZkWxvCnQcNN2
BigSimmo pushed a commit
that referenced
this pull request
Jul 30, 2026
…point Codex review was right. The suite invokes searchChunksWithTelemetry directly, so it is a budget for the search retrieval core, not for /api/search. Everything the route does around retrieval — auth, rate limiting, scope resolution, related-document enrichment, the telemetry write — is invisible to it, and a round trip added to any of those leaves the suite green. The refusal budget is likewise about retrieval: an adversarial HTTP request still pays the route's preamble before retrieval is reached, so "zero round trips" was true of the function and false of the endpoint. Nothing about the measurements changes; the claims around them do. The file header, describe block, both test names and the refusal assertion now say retrieval core, and the header states what is NOT covered so the suite cannot be cited as endpoint coverage. #98 carries the same correction rather than leaving the overstated version in the ledger. The stronger remedy Codex offered — drive POST with counted clients — is filed as #98's next step with the tests/answer-route-preamble.test.ts pattern named, rather than half-built here. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018K7sEKH35KZkWxvCnQcNN2
BigSimmo pushed a commit
that referenced
this pull request
Jul 30, 2026
Both findings verified against the code before accepting, and both were right. 1. scripts/rag-offline-contract.mjs still described the suite as "the same guard for /api/search". That is the same overstatement Codex caught in the test and the ledger, and I had missed this third copy of it. The comment now says retrieval core and names what the suite does not observe: the route's auth, rate limiting, scope resolution, enrichment and telemetry write. 2. vi.doMock registrations survive vi.restoreAllMocks (which targets spies) and vi.resetModules (which clears the module cache, not the mock registry), so the Supabase/OpenAI fakes could outlive this file if isolation were relaxed. afterEach now calls vi.doUnmock for both. This is the established pattern here rather than a generic suggestion: five sibling suites already do it, and the comment cites tests/rag-variant-early-exit.test.ts:110. Also resolves the fourth docs/outstanding-issues.md conflict from main advancing, by rebuilding the #98/#121/#130 edits on main's table and diffing row-id sets against main to prove nothing was lost. Focused suites after the change, including the neighbouring mock-sensitive ones: Test Files 3 passed (3), Tests 9 passed (9). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018K7sEKH35KZkWxvCnQcNN2
BigSimmo added a commit
that referenced
this pull request
Jul 30, 2026
… retract a wrong #121 claim (#1464) Budget the search retrieval core: tests/search-round-trip-budget.test.ts pins Supabase round-trip counts for searchChunksWithTelemetry, registered in the offline contract. Scoped explicitly as retrieval-core, not an /api/search endpoint budget — the route's auth, rate limiting, scope resolution, enrichment and telemetry write are outside what it observes. One retrieval measures 11 round trips, with match_document_chunks_text_v2 and match_document_table_facts_text_v2 each firing three times; whether that is intended is left open on #98 rather than guessed at. Retract a wrong claim on #121: a sandboxed remote session can produce browser evidence via PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH, verified by launching. The earlier "only two options" sentence is kept with the retraction beside it. #130's blocker is marked LIFTED as a result, so the pre-paint guard is buildable.
BigSimmo pushed a commit
that referenced
this pull request
Jul 30, 2026
BigSimmo added a commit
that referenced
this pull request
Jul 30, 2026
BigSimmo added a commit
that referenced
this pull request
Jul 31, 2026
* issues: capture the unreadable-CI token, at-risk worktree work, and the unpushed hook fix Three findings from the 2026-07-30 organisation session that were recorded nowhere durable: - #149 the session GitHub PAT lacks Checks: Read, so no agent can confirm a PR is green. The endpoint that does work returns an empty result rather than an error, so it reads like an absence of checks rather than an absence of permission. - #150 four worktrees on already-merged branches hold uncommitted work that exists in no branch and no PR, the largest being +395/-200 across 19 files including CI config. - #151 the pre-commit fail-open for #143 lives only on a never-pushed local branch, which is also 17 behind main and conflicts on the file whose count sentence main's new docs:update generator now owns. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(ledger): record the session-followup capture review for PR #1490 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(ledger): record #143/#151/#149 reconciliation for PR #1490 Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs(ledger): supersede PR #1490 reconciliation after remote sync Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * issues: record the worktree snapshots and redirect #151 to PR #1494#150 — the four at-risk worktrees were snapshotted onto their own already-merged branches (748ef018f, 5dbd9f965, b7eae51a4, d949859c3), so the work survives a worktree reclaim. All four are clean now. None is pushed or reviewed; the next action is per-snapshot promote-or-reset. #151 — the never-pushed branch is superseded rather than salvageable: its script and hook reached main by other routes, so the fail-open guard was applied to main's committed hook in PR #1494 instead. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs: remove credential metadata and correct audit dates * docs: consolidate session follow-up findings * docs: record consolidated follow-up review * issues: record that #101 hydration shipped PR #1463 merged as dba7356, so #86's "Next X3 unit — rag-hydration.ts" is now stale. The row records the extraction as shipped and keeps the corrected boundary: hydration re-homed only two of prepareCoverageGateResults's five rag.ts-only dependencies, so it did not unblock that function — exactly as the Codex review on PR #1461 predicted. This row was deliberately dropped from #1463 itself (commit 6290d02) after docs/outstanding-issues.md conflicted on five consecutive main syncs. Recording it separately here is the same pattern used for #1454 via #1461. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GGEBHp4Seoh1jK1vGTNtYS * docs(ledger): record the landed X3 hydration review Appended with npm run ledger:append (never hand-written), keyed to the squash commit dba7356 so ledger:lookup can resolve it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GGEBHp4Seoh1jK1vGTNtYS * docs: fix the #101 mislabel and key the ledger row to a resolvable ref Both defects were raised by Codex on PR #1495 and both are real; verified against the files before accepting. 1. #101 is NOT this extraction. docs/outstanding-issues.md:138 shows #101 is "Canary-gated retrieval parallelisation candidates" (P3, rec) — a separate, still-open recommendation gated on a live canary pair. Calling the hydration extraction "#101" marked that unrelated work as shipped and could have caused the live-evaluation work to be skipped. The label came from the original task brief and was propagated without checking it against the ledger. Both the #86 row and the X3 work-order entry now identify the change as the X3 hydration unit (PR #1463) instead. #101's own row is untouched and still open. 2. The ledger row did not resolve. `npm run ledger:lookup -- dba7356` returned NOT REVIEWED, because the ref cell held only the slash-form branch token and that branch no longer resolves locally, so the throttling record could not prevent a repeat review. Appended a superseding record keyed to the landed SHA; the same lookup now returns ALREADY REVIEWED. The original row is retained, per the ledger's append-only rule. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GGEBHp4Seoh1jK1vGTNtYS * docs: record consolidated PR reviews * docs: record ingestion recovery review * docs(visual): document the platform-scoped baseline layout and how to seed it `playwright.visual.config.ts` records snapshots under `__screenshots__/{platform}/`, so a baseline taken on Windows lands in `win32/` and is never consulted by the `ubuntu-24.04` CI job, which reads `linux/`. Nothing said so, and committing `win32/` images looks like protection while providing none. Records the constraint, names the CI artifact as the supported recorder for `linux/` baselines, and notes that comparison stays advisory until the jobs come off `continue-on-error`. Also creates the tracked directory `.gitignore` already claims exists, which sets `ui_changed=true` (`scripts/ci-change-scope.mjs`) so the visual job can run and produce that first artifact. No baselines are added here — they cannot be produced on this platform. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs: correct visual baseline adoption steps * docs: record visual baseline guidance review * fix(ui): repair mockup accent token references * docs: record token-reference repair review * docs: archive advisory UI scoping task * docs: record advisory UI closure review * issues: archive #151 after #1494 and mark #143 fully resolved PR #1494 landed the fail-open guard on main, so close the open salvage row and update the #143 archive from PARTIAL to resolved across #1442 and #1494. Also carries the merge of origin/main that cleared the GitHub DIRTY mergeability state. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs(ledger): record PR #1490 main-sync and #151 closeout Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs(ledger): record #1496 id-collision renumber for PR #1490 Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * issues: record the withdrawn live-region finding as #151 so it is not re-filed Archive-only row. There is no defect and no work to do — the row exists purely as a guard rail against repeating a misreading that already happened once. search-results-header-band.tsx sets aria-live={faulted ? "off" : "polite"} on its count/status span, which reads like a silenced failure announcement. It is not: the band mounts a separate fault panel with role="alert" carrying the failure title, body and Retry, and the mute is deliberate so the two do not both speak. The reasoning is in a comment directly above the attribute, and tests/search-results-header-band.dom.test.tsx pins it with singular role queries that throw on duplicates. During session 2026-07-30 (PR #1481) this was filed as a real P2 defect on the strength of the attribute alone, and the proposed fix — escalating the count span to role="alert"/aria-live="assertive" — would have produced a duplicate announcement and a red test, making it worse than no change. Codex caught it. An earlier withdrawal row was then lost to the squash that merged #1481, which is the row-deletion shape #148 now guards against. Also records that the mockup's escalation is correct in the mockup and must not be ported: search-refine-adaptive-mockups.tsx has no fault panel, so there the count span is the only announcement channel. #148 needed no work — the merge-base deletion check landed on main independently, and its output now reports the base it compared against. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JdPa3mHCX5ZQZZvU5GHU3r * docs(rag): record refuted lexical probe collapse (#98) * issues: capture the residual id-allocation hazard as #151#133 is resolved: #1444 removed merge=union and #1479 excluded the ledger from Prettier, which together fixed conflict frequency. Neither changes id allocation, which is still read-modify-write against the next-id marker, so concurrent branches still claim the same number. Measured on PR #1451: one row was renumbered #135 -> #141 -> #145 -> #147 -> #149 across four sync cycles. The sharper finding is that GitHub's Update-branch button resolved one such collision into duplicate #141 rows with the marker left below main's highest id — git reported success and only check:outstanding-issues caught it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(issues): attribute the mobile CLS breach — a 128px reserve round trip #147 asked which elements shift. Driving Chromium against the same offline production build with a PerformanceObserver on layout-shift (Lighthouse mobile emulation, reading entry.sources[].node) gives one dominant cause on all four breaching routes: the entire main content region moves down 128px and straight back up 128px within 15-60ms. Both moves score, so it is pure cost with zero net movement — 100% of /documents/search's 0.220 and about 75% of /dsm's. The shifting element is the max-sm:pt-[var(--phone-overlay-chrome-h)] wrapper around <main>. A MutationObserver timeline on the root style attribute pins the mechanism rather than inferring it: the property goes CSS seed -> 200px -> 72px, and the 200px is written when the header stack ALREADY measures 72px (t=1552ms reserve=200px stack=72, corrected at t=1612ms). usePhoneOverlayChromeReserve reads stack.offsetHeight while the stack is transiently tall, publishes a value that is stale by the time it lands, and its ResizeObserver then corrects it. The CSS seed at globals.css:375 is correct for the settled stack, which corrects the mechanism recorded on the now-archived #130 — that framed the defect as the seed under-reserving by 0-8px. Measured, the driver is a 128px transient over-reserve written by the hook, not the seed. / is the control: it never writes the property and is the one clean route. Variance is stated rather than smoothed: /dsm measured 0.363 and 0.219 across two runs, and this harness has no network throttling so /forms and /therapy-compass run high locally. Only /dsm, /documents/search and / reproduced the live dispatch exactly. Also recorded: attaching a MutationObserver to document.documentElement inside a Playwright addInitScript throws before the document element exists, silently killing the CLS observer and reporting a uniform CLS=0.000 — a false clean bill that voided one run of this harness. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01361jh3eYVjJCzXWjAhdZiF * docs(ledger): record the #151 capture review for PR #1506 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(review): clarify snapshot branch state * docs(ledger): record PR #1490 main sync after snapshot wording Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs: archive rendered style contract task * docs: record style contract closure review * docs: record synced style contract review * docs: record post-121 style closure review * docs: normalize style review ledger after sync * docs: record post-1490 style closure review * docs: record consolidated PR 1490 review * docs: record replacement consolidation review * docs: record reconciled consolidation review * docs: record post-1511 consolidation review * docs: normalize PR 1510 ledger after main sync * docs: record PR 1510 post-sync review * docs: correct false #98 canary evidence and NOTES triage Remove the incorrect probe-collapse canary attribution from #98 and point the unread --med-accent-soft note at #157 without breaking the seven-token TOKENS_MISSING accounting. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs(ledger): record PR #1510 evidence-correction review Supersede the prior approve-with-no-findings row after correcting the false #98 canary attribution and NOTES triage drift. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs: keep concurrency note inside issue table * docs: record post-1513 consolidation review * docs: address CodeRabbit notes on PR #1510 Fix the computed-value-time wording in design-sync notes, give #33 a unique recommended-queue order, and drop the duplicated #98 Done block. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs(ledger): record PR #1510 CodeRabbit fix review Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
BigSimmo added a commit
that referenced
this pull request
Jul 31, 2026
BigSimmo pushed a commit
that referenced
this pull request
Aug 12, 2026
…re-scope the wave plan Archived with source evidence: - #166 the verify-before-use caveat ships (verification-notice.tsx:52, rendered unconditionally by AnswerCard at answer-card.tsx:108). I reported this row as open twice before reading the code; the archive says so. - #208 buildAnswerClipboardText composes renderCopyText rather than replacing formatAnswerRenderCopyText (answer-copy-payload.ts:121-138). - #216 AnswerCard is adopted on the answer surface and the manifest agrees. Re-scoped #250: its wave plan names A1 rows that are now closed and hygiene rows that are in flight, so as written it misdirects. Recorded what actually remains (#147, #117, #118, #98, #189). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017paT42ZVMf8jaLtkjFxdy5
7 tasks
BigSimmo pushed a commit
that referenced
this pull request
Aug 14, 2026
…merged #215, #210, and #293 were queued as `done` in this same PR, each citing a PR (#1949, #1953, #1962) that turned out still to be open, not merged — verified by checking whether each PR's actual file change is present on origin/main (none are). Reconciling the original `done` requests would have closed these rows while their fixes exist only on unmerged branches, one of which (#1949) currently has failing required CI. Converts all three to `update` requests documenting the correction and the real current state, so reconciling this PR now cannot close a row before its fix has actually landed. Leaves #98, #189, and #194 as `done` unchanged — those cite PR #1950 and PR #1947, both confirmed merged into main.
BigSimmo added a commit
that referenced
this pull request
Aug 14, 2026
Retain #98's unresolved offline-runner action
BigSimmo added a commit
that referenced
this pull request
Aug 16, 2026
8 tasks
BigSimmo added a commit
that referenced
this pull request
Aug 17, 2026
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps prettier from 3.9.0 to 3.9.1.
Release notes
Sourced from prettier's releases.
Changelog
Sourced from prettier's changelog.
Commits
c47654cRelease 3.9.106159aaFix bug in release script4bc5ab4Update file-entry-cache to 11.1.5 (#19483)b7fd58bRelease@prettier/plugin-oxc@0.2.0and@prettier/plugin-hermes@0.2.03006400Revert changes in release script7bef7dbGit blame ignore 3.9.0bb817b1Bump Prettier dependency to 3.9.005cf896Clean changelog_unreleased79f6cdfDisable finished steps3613b1eAdd blog post for v3.9 (#19414)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)