#3522 Fix confirmed documentation drift from the audit review, reset First Nations letter on region change, queue ledger requests

User description

Summary

Fixes the simple, confirmed items from the review of 16 audit reports. Every claim was re-checked against main (4382217) before editing; the audits themselves were partly wrong, so nothing was applied from their suggested text without re-deriving it.

• Operator runbooks.
  • The DR runbook and db-maintenance.md named a database setting that does not exist (app.indexing_agent_url). The real one is app.indexing_v3_agent_base_url, which falls back to the production host when unset.
  • The DR checklist told the operator to re-create the ingestion cron job that 20260926041000 retired.
  • The DR runbook's undated 102-migration count is now a dated measurement.
  • launch-operator-runbook.md says "at least" instead of "exactly" for the retention jobs.
  • observability-slos.md calls the ops digest daily, with a note that the scheduled run cannot meet the three-contiguous-hour page rule.
  • deployment-architecture.md names dockerfilePath in railway.worker.json instead of a non-existent RAILWAY_DOCKERFILE_PATH.
  • reindex-runbook.md gains the active_agent_enrichment bullet.
  • operations-runbook.md points at the real query locations and page size (1000).
• Gate claims. branch-review-ledger.md and branch-review-archival-policy.md said their check runs in verify:cheap; it is a verify:full step. docs/testing.md explains the old 70-minute timeout as historical (matrix legs are now capped at 45). README.md states the real scope of release-browser-matrix and that it is not part of pr-required, and the test:focused example now uses <paths>.
• Design-system and governance prose. ADOPTION.md counts, GATES.md tap-floor ratchet, SPEC.md "planned" checks that ship, .design-sync/conventions.md tap size / radius map / --command colour, and the Supabase label in clinical-governance.md (:67 only; the dated 2026-06-28 section is left alone).
• Agent instructions. The design-review agent and audit skill now use ledger:lookup / ledger:append instead of hand-editing the ledger.
• Code (one line). src/components/first-nations/where-is-home.tsx clears the letter when the region changes, so Copy cannot paste region A's service numbers while region B is shown.
• Ledger. 13 immutable add requests under docs/outstanding-issues-inbox/ for the confirmed issues not fixed here. They are not reconciled, as the /issues skill requires.

Areas touched: Knowledge and records, Data platform and access, Design system, Delivery and assurance, App experience, Clinical reference content, Source intake and indexing

RAG impact: none. No ranking-protected file is touched and no retrieval behaviour changes.

Verification

• Checks run:
  • prettier --check on all 19 changed files: "All matched files use Prettier code style!" (3.9.9, same result as before the edits).
  • node scripts/check-docs-links.mjs: "docs link check passed: 5764 repo path references resolve."
  • node scripts/check-docs-script-refs.mjs: "docs script-ref check passed: 851 npm-run reference(s) resolve to real scripts."
  • check-instructions.mjs: "retired-rules: pass"; instruction-budget: pass (AGENTS.md 23,977 of 24,000 bytes, unchanged by this PR).
  • check-codebase-index-coverage.mjs: "coverage OK"; update-docs-inventory.mjs --check: within tolerance.
  • check-outstanding-issues.mjs: "passed: 858 rows (141 open, 717 archived)"; check-ledger-write-discipline.mjs: "passed for 4382217c3c61..HEAD".
• Not run: typecheck, unit tests, verify:cheap, verify:full, any browser test. Dependencies are not installed in the environment this was prepared in, so the where-is-home.tsx change is unverified beyond reading it. CI is the first real run of it. No DOM test was added for it.
• scripts/organisation/decisions.mjs reports one warning about docs/decisions/2026-08-22-automated-review-coverage.md; it is present on main without this change.

Risk and rollout

• Risk: low. All changes are documentation except the one-line state reset. The doc edits that touch operator instructions (DR runbook, db-maintenance.md) narrow or correct existing steps and add no new action.
• Rollback: revert the commit.
• Provider or production effects: None. No migration, no workflow, no deployment, no provider call.

Notes

• Deliberately not changed: docs/outstanding-issues.md (canonical ledger; its corrupted arrow on line 15 is recorded in a ledger request instead), the privacy-document encoding repair, script header comments under scripts/**, and anything needing a migration (e.g. the display.revoke NULL guard) or an owner decision.
• Findings this PR does not address are queued as ledger requests: PDF extractor prose-into-table-row, display.revoke guard, listOwnerTeams N+1, InboxRecord cast, the "Top match" test and its duplicate render, test-deletion guard blind spots, On Call identifier-guard coverage, Roster overlap check, week-strip / all-day / holiday gaps, sast.yml and eslint-rules, safety-document line anchors, script-header claims, and remaining doc drift.

🤖 Generated with Claude Code

https://claude.ai/code/session_013fpAhwc33X7YgFkDu3pa18

Generated by Claude Code

Summary by cubic

Fixes confirmed documentation drift from the audit review, resets the First Nations contact letter when the home region changes, and queues the remaining confirmed issues in the ledger.

Operator runbooks and gates

• Runbooks now name the real settings and steps, including the retired ingestion cron job and invoke_indexing_v3_agent; restore steps run ALTER DATABASE ... SET as postgres and verify via pg_db_role_setting or a new connection.
• Both restore docs redeploy every function in supabase/config.toml, verify OPENAI_API_KEY by name, and warn that a POST to site-content-sync claims queued outbox events rather than serving as a health probe; a new test asserts each one has a deploy command.
• Gate claims are corrected: ledger checks run in verify:full, the 70-minute timeout is documented as historical, release-browser-matrix is not part of pr-required, and the daily ops digest cannot meet the three-contiguous-hour RPC page condition on its own.
• Design-system, governance, and agent prose corrected, and the design-review agent and audit skill now use ledger:lookup / ledger:append.

Code and ledger

• where-is-home.tsx clears the letter on a region switch but keeps it on same-region reselect, covered by a new DOM test.
• 13 immutable ledger add requests queue the confirmed issues not fixed here, including the migration-gated display.revoke guard and owner-decision items.

CodeAnt-AI Description

Clear regional letters on region changes and correct recovery guidance

What Changed

• Switching home regions clears the contact letter so copied service numbers cannot come from the previously selected region; reselecting the same region keeps the letter.
• Database recovery instructions now identify the current schedules and edge functions, explain how to verify the endpoint before enabling the indexing schedule, and warn against probing a function that processes queued events.
• Corrected guidance on CI checks, design-system requirements, operational queries, and current project configuration.
• Recorded confirmed audit findings that still need follow-up.

Impact

✅ Prevents copying contact numbers for the wrong region
✅ Reduces risk of misdirected indexing requests after a restore
✅ Clarifies which checks block a merge

@codeant-ai ask: Your question here

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

@codeant-ai: Your feedback here

@codeant-ai: Do not flag unused imports.

@codeant-ai: review