Resolve remaining review defects in alerts, PDF extraction and CI

Closed
BI
25d ago
+3896-1188

Summary

Repair the confirmed merged-PR review defects in durable roster alerts, PDF extraction, queue rollback fencing and catalogue integrity. This consolidated successor includes #3638's fixes; the original PR remains open. Review this PR and do not merge both independently.

  • Queue offer events atomically with open.post; claim them across instances with expiring tokens, drain device pages and acknowledge/retry each device independently. Recheck current eligibility, preferences, quiet nights and subscription ownership before each send. Preserve staff-release controls. Delivery is at least once: a crash after provider acceptance can duplicate that device's alert.
  • Require visible ruled-cell evidence before assigning PDF edge text to clinical table cells. Preserve ambiguous text with geometry/review warnings, complete safety notes and overflowing instructions. Correct later automated changes that removed these protections.
  • Repair queue-enqueue compilation and mutation-identity typings/fixtures. Regenerate the narrowed CET catalogue and lineage fixture; CET remains unverified and excluded, with all 1,081 logical IDs, content hashes, governance and eligibility values preserved.
  • Append only the three specifically approved migration hashes, preserving all 321 existing entries. Commit the genuine pinned-image drift manifest recovered from hosted generation, preserving its exact 857,796 bytes and emitted SHA-256 3555daf05dc0e71d941634714c31d46ce792ffe19243408e3a7ba5db0238a49d. No expected catalogue fields were hand-edited.

Issue-by-issue evidence and approval scope: docs/audit/2026-10-18-remaining-review-closeout.md and the original resolution audit. Immutable independent review records cover source corrections, seals, fail-closed recovery and generated-manifest integrity.

Areas touched: Knowledge and records, Personal practice, Source intake and indexing, Clinical reference content, Answer engine, Data platform and access, Delivery and assurance, App experience, Prototypes

RAG impact: behaviour change — live canary pair not run; requires separate explicit owner approval. PDF extraction rejects uncertain clinical cell associations while preserving source text; inherited cited-source recovery and metadata admission fixes remain. No relevance comparator changes.

Verification

  • Independent PDF, alert/concurrency, catalogue, seal and recovered-manifest reviews; actionable findings corrected and rechecked. Requested reviewer routing is not independently verified execution telemetry.
  • Owning worker/PDF/roster/catalogue and architecture contracts: 1,805 passed, one skipped across 131 files. Later concurrent-change corrections passed 35 focused TypeScript tests and 60 PDF tests, plus fresh full lint/typecheck. The recovered manifest then passed 66 drift/freshness/immutability/parity-contract tests in four files. The later concurrent paging/shutdown fix was preserved through a clean merge and passed 26 tests in two files, full typechecking, scoped lint/format and independent review; generated SQL/manifest bytes remain unchanged. The later real base-branch conflict was limited to two Cloud fixture suites: main's isolation improvements and this branch's regression cases are retained; 171 tests in two files, full typechecking, scoped lint/format passed. This conflict resolution was controller-reviewed; prior independent SQL/artifact reviews apply to unchanged bytes. These scopes overlap; no combined total is implied.
  • Local assessment/Teaching browser proof: 23 passed, unchanged 2px assertion, Chromium 151; responsive/installed-layout, reduced motion, enlarged text, forced colours and keyboard checks. Physical Safari/PWA and assistive-technology acceptance remain separate.
  • Native PostgreSQL disposable transaction/grant and actual two-session claim/lease/expiry tests passed. No live SQL or push-provider calls ran.
  • Append-only migration guard passes all 324 entries, with exactly three owner-approved additions and every prior hash unchanged. Hosted static CI, including lint/typecheck, passed in recovery run 39112988994.
  • 765 CI workflow contract tests in 36 files passed. An actual-shell harness confirms the recovery fallback preserves green fresh checks, red stale checks and exact emitted JSON/checksum. It prints scratch-schema metadata only on freshness failure and still exits nonzero.
  • Recovery CI passed production/browser builds, safety/configuration, SAST, Lighthouse, container build/content/smoke/runtime checks, the critical Chromium lane and all three production Chromium shards. Its only unit failure was the old expected manifest; that file is now replaced. Local full verify:ui was not separately selected. No physical-device or clinical approval is inferred.
  • Corrected generation provenance: run 39115800292, job 117641296328, source f3732205b563cf5f74fd5b5f055fc61deae2c2f2, generated 2026-10-18T09:37:59.569Z. Recovered bytes match the emitted checksum. The only catalogue delta from the first recovered file is removal of the extra helper EXECUTE grant. Schema hash 5118a8dcb45d715d0886d639b13a7f28e316adc0269a4aef77e8e39bbbcac112 matches corrected schema.sql; image remains pinned to Supabase 17.6.1.127@sha256:be60aee15997daca475b710b734bc6bfe52cd544dcd7e9fd2ff58210b6747d83.
  • Hosted freshness passed on ddd54e3db225df1a968ac09d56893df667b1d4a8; strict parity then found one helper EXECUTE mismatch. The migration chain is owner-only; a terminal mirror-only revoke restores that restrictive ACL without changing sealed SQL. A disposable actual-migration SQL proof confirms service-role updates still fire the mutation trigger. Independent review found no actionable issue in the correction.
  • Corrected-mirror final hosted freshness and strict parity: run39117853586/job117647286333 on e305f9e7dfecb8a1661d1b6f5e61597de526b95d passed replay, database behaviour, genuine pinned regeneration and strict comparison. Logs: “matches a fresh regeneration” and “No divergence between the migration chain and supabase/schema.sql.” Existing pg_net emulator exception remains unchanged.
  • Final required CI aggregate: success on exact head e305f9e7dfecb8a1661d1b6f5e61597de526b95d, run39117853586/job117650620082. Full CI run success: unit coverage/partitions, static checks, builds, migration replay/behaviour/freshness/parity, all production Chromium lanes, Lighthouse, container checks, safety and ingestion SAST passed. Separate PR policy migration-order failure below remains open; this is not an all-checks/merge-ready claim.
  • Separate PR policy blocker: the unmerged 20261018055300_atomic_training_milestone_mirror.sql predates main's newest 20261018062736 migration. Proposed CLI-generated rename to 20261018101142_atomic_training_milestone_mirror.sql preserves identical SQL/hash and all321historical seals. The unchanged policy validator confirms the proposed rename fixes the violation. Moving its approved draft hash key requires specific owner approval; proposal is prepared but not applied. No production merge or live SQL approval is implied.

Intermediate blocked-proposal pushes used the documented SKIP_DRIFT_GUARD=1 override while the genuine generated file was unavailable. The first manifest push passed the normal guard without overrides. The subsequent mirror ACL correction used the same documented stale-manifest override; the corrected-manifest push also passed the normal guard without overrides. Network policy, historical hashes, drift exceptions and required gates remain unchanged.

Risk and rollout

  • Risk: clinical-source association, roster privacy/delivery and database concurrency. This PR is not merge-ready: applicable human/device acceptance, live RAG canaries and accountable classification/sign-off remain open. Merge only after specific production database-change approval in an approved window. Merging applies the migrations to the live clinical database automatically. Approval to append the three hashes does not authorize that merge.
  • Rollback: revert application/extractor changes before release; a database rollback requires a separately approved forward migration. Preserve applied history. Unruled edge content can lose structured row assignment while retaining source text/geometry for review.
  • Provider or production effects: GitHub branch/PR publication and configured offline CI only. No merge, auto-merge, live SQL, production deployment, provider push, clinical signature or live RAG evaluation was performed. Worker release/credential bindings remain operator-controlled.

Clinical Governance Preflight

  • Source-backed claims still require linked source verification before clinical use
  • No patient-identifiable document workflow was introduced or expanded without explicit governance approval
  • Supabase target remains PsychSift Production (sjrfecxgysukkwxsowpy)
  • Service-role keys and private document access remain server-only
  • Demo/synthetic content remains clearly separated from real clinical sources
  • Source metadata, review status, and outdated/unknown-source behavior remain conservative
  • Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Clinical/legal/cultural approval remains with accountable humans under docs/clinical-sign-off-how-to.md. The canonical correction requests must land before their separate serialized reconciliation; this PR does not directly edit the canonical issue ledger.

Summary by cubic

Resolves the remaining confirmed review defects across roster alerts, PDF extraction, queue rollback fencing, RAG citation recovery, the therapy catalogue, teaching milestones, and CI reliability.

  • Roster offer alerts drain through a database outbox with expiring leases and per-device receipts; delivery is at least once, and per-device eligibility is rechecked on each batch. Keyless open posts now get a one-use server post key so the outbox trigger records them, and worker shutdown waits at most 15s for an in-flight batch before lease expiry retries it.
  • PDF edge-row recovery requires visible ruled-cell evidence; ambiguous text is kept with geometry and a review warning, and text crossing table boundaries is no longer lost or duplicated.
  • Document queue rollbacks use database-generated mutation_id values so stale rollbacks cannot overlap newer requests; upload replay proves the winning admission is durable before superseded objects are released.
  • RAG source-backed recovery credits only signals from exact cited chunks; the unverified CET claim is removed from the therapy catalogue, and cited-document summary reads now include generation-null rows. The owner reset the DID possession-form sign-off, leaving 515 of 585 DSM-5-TR specifier items awaiting clinician review.
  • Training milestone writes use an atomic RPC mirroring registrar rows in the same transaction; teaching action buttons stay keyboard-activatable via aria-disabled.
  • CI reliability: isolated Git configuration for smoke fixtures, required GNU timeout for version probes, coalesced shared GETs for teaching reads, and metadata paging admits exactly 100,000 rows before failing closed. Bulk document reindexing runs in batches of 10 with per-batch progress reportingchers, waits out one rate-limit window instead of failing at batch three, and keeps succeeded/failed totals when a later batch fails.

Merge blockers

  • The three database migrations (durable offer outbox, atomic training milestone RPC, queue rollback fence) are approved and sealed; the atomic milestone mirror is renamed to sort after main's newest migration, and merging applies them to the live clinical database automatically.
  • The generated drift manifest is committed and independently verified, but hosted parity with the live database and full hosted CI remain pending; no complete green run is claimed for the latest fixture corrections.

Summary by CodeRabbit

  • New Features

    • Roster offers can be delivered through a persistent, retryable alert process, improving delivery reliability when notifications are temporarily unavailable.
    • Bulk document reindexing now processes large selections in batches and reports progress as work completes.

  • Bug Fixes

    • Teaching pages refresh data after successful updates, and assessment records now reflect the active rotation and correct local dates.
    • Search-related document details are limited to accessible, indexed content.
    • PDF extraction handles ambiguous table-edge text more cautiously, reducing the chance of assigning it to the wrong clinical field.
    • Upload replays and overlapping booking updates better preserve committed or newer data.

  • Accessibility

    • Incomplete assessment controls remain keyboard-focusable and provide accessible explanations without allowing invalid submissions.

Summary by Gitar

  • Worker timeouts:
    • Split control-plane and data-plane abort signals so data-plane RPCs use the longer timeout
  • Codex cloud setup:
    • Required GNU timeout for version probes and scrubbed provider secrets from the agent shell profile
  • Sign-off gating:
    • Today-rule sign-offs now derive enablement from the live rule sets and MHA timer gate
  • Supervisor bookings:
    • Preserved concurrent bookings when withdrawing unchanged availability rows
  • Metadata reads:
    • Paged related-document metadata reads up to 100,000 rows, failing closed beyond the cap
  • Bulk reindexing:
    • Splits large document selections into batches of 10 and reports progress as each batch completes

This will update automatically on new commits.