Fix confirmed merged-PR review findings and stage atomic milestone repair (rebuild of #3638)

Merged
BI
25d ago
+3900-1195

Requested by Josh · project thread

Clean rebuild of #3638. This PR carries the identical final code of #3638 at 013a81de8, merged with current main, as one commit. #3638 could not pass PR policy: qodo-code-review[bot] commits in its history touch Supabase or clinical paths, and history rewrites are banned. The owner chose a rebuild (thread decision, 18 Oct 2026). The bot's changes are included only as they stood at 013a81de8, so review them here. Earlier review discussion stays on #3638. Draft until the owner has reviewed it.

This PR now also carries all of #3641's work (rebuilt as #3654, closed as superseded), at the owner's request on 18 Oct 2026: the durable roster offer device outbox (migration 20261018073435, sealed with the owner's named approval), PDF edge-text ruled-cell evidence, exact 100,000-row metadata paging and the CI drift-manifest recovery output. Deliberately not carried: #3641's duplicate milestone migration 20261018062800 (carried here as 20261018075500), the queue-rollback mutation_id migration the owner dropped, and the narrowed CET attribution the owner reverted. Merge this before the rebuilt #3640 (#3653), because its migrations are dated earlier.

The drift manifest is this PR's generated manifest plus the roster entries from #3654's CI-generated manifest, with schema_sha256 matching schema.sql. Migration replay will confirm it when the PR leaves draft. Local evidence for the fold: 13 focused files / 129 tests, 33 migration, drift and site-content files / 543 tests, full typecheck, scoped lint and format, and the migration-role guard all passed. The Python PDF extractor tests were not rerun locally.

Summary

Investigate the 30 open findings in the supplied merged-PR review and repair confirmed local mechanisms. The issue-by-issue evidence and remaining limitations are in docs/audit/2026-10-18-merged-pr-resolution.md; #3641's are in docs/audit/2026-10-18-remaining-review-closeout.md.

Fix cited-source recovery authority, generation-safe metadata and summary reads, upload replay cleanup, queue rollback fences, batched dashboard actions, worker timeouts, Teaching request sharing and post-write freshness, booking withdrawal races, EPA rotation dates, source provenance, shell/Git isolation, and ledger identity/correction handling. Withdraw unverifiable CET claims and the stale lithium attestation without granting clinical approval. From #3641: queue offer alerts atomically with open.post, claim them across instances with expiring tokens and acknowledge each device independently (delivery is at least once), and require visible ruled-cell evidence before assigning PDF edge text to clinical table cells.

An atomic CME/registrar milestone RPC and the roster outbox are included as draft database proposals. This PR is not merge-ready. Merge only after explicit owner approval for these specific database changes and an approved window, pinned schema replay/drift regeneration, and the applicable acceptance evidence. Merging the migrations to main automatically applies them to the live clinical database.

Areas touched: Knowledge and records, Personal practice, Source intake and indexing, Clinical reference content, Answer engine, Delivery and assurance, App experience, Data platform and access, Prototypes

RAG impact: behaviour change — canary pair not run; live before/after provider evaluation requires separate explicit owner authorization. Recovery now requires evidence from exact cited chunks/documents and preserves low confidence; metadata admission is stricter; PDF extraction rejects uncertain clinical cell associations while preserving source text. No relevance comparator changes.

Verification

  • Independent source review and bounded correction review completed on #3638 and #3641; confirmed findings corrected.
  • Historical local and hosted evidence for each source PR is recorded on #3638, #3641 and in the two audit documents. It is not repeated here and is not hosted proof for this combined head.
  • Fold of #3641 into this PR: focused, migration/drift/site-content, typecheck, lint, format and migration-role checks passed locally (counts above).
  • Hosted CI on this combined head: draft-scope checks only until the PR leaves draft. Migration replay, unit coverage and browser lanes are pending, and skipped checks are not passes.

Verification not run: live provider canary pair, hosted database queries/mutations, physical-device acceptance and clinical/legal/cultural sign-off.

Risk and rollout

  • Risk: cross-subsystem clinical-source, owner-access, ingestion, roster privacy/delivery and transaction changes. All source-review holds remain.
  • Rollback: revert the application changes before release; any database rollback is a separately approved forward migration, never an edit to applied migration history.
  • Provider or production effects: branch publication and configured GitHub automation only. No merge, auto-merge, production deployment, live database mutation, provider evaluation or provider configuration change is authorized or performed by this work.

Clinical Governance Preflight

  • Source-backed claims still require linked source verification before clinical use
  • No patient-identifiable document workflow was introduced or expanded without explicit governance approval
  • Supabase target remains PsychSift Production (sjrfecxgysukkwxsowpy)
  • Service-role keys and private document access remain server-only
  • Demo/synthetic content remains clearly separated from real clinical sources
  • Source metadata, review status, and outdated/unknown-source behavior remain conservative
  • Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Deployment classification/TGA SaMD assessment and clinical activation approval remain outstanding. No regulatory or clinical acceptance is inferred from synthetic tests or source review.

🤖 Generated with Claude Code

https://claude.ai/code/session_018UBtJDgQZJ3eBsxLWte9r4

Summary by CodeRabbit

  • New Features
    • Open-shift offers can be delivered through a durable alert process, with per-device delivery tracking and retries.
  • Improvements
    • Bulk document reindexing now processes selections in batches and can retry rate-limited requests.
    • Teaching controls remain keyboard-accessible when unavailable, and successful updates refresh displayed information.
    • PDF extraction now flags ambiguous edge text for review rather than assigning it to table cells.
  • Bug Fixes
    • Duplicate upload replays clean up superseded files.
    • Training milestone changes are synchronized with registrar records.
    • Therapy evidence descriptions and source-review statuses have been corrected.