#3653 fix: remediate full-deep audit findings and retain release holds (rebuild of #3640)

Requested by Josh · project thread

Clean rebuild of #3640. This PR carries the identical final code of #3640 at 83a49c5fa, merged with current main, as one commit. #3640 could not pass PR policy: qodo-code-review[bot] commits in its history touch Supabase or clinical paths, and history rewrites are banned. The owner chose a rebuild (thread decision, 18 Oct 2026). The bot's changes are included only as they stood at 83a49c5fa, so review them here. Earlier review discussion stays on #3640. Draft until the owner has reviewed it.

#3650 (RAG cache evidence revision) was merged into the old #3640 branch by the owner after this rebuild was cut. Its changes, including migration 20261018095804 and its seal entry (approved by the owner by name), are now carried here too, so this tree equals the old branch merged with main. Merge this after #3652, because #3652's migrations are dated earlier. Its own description and evidence are on #3650.

Summary

• Prevent stale account requests and rollback from updating a different user's favourites, roster, sharing and calendar state; correct pay-history loading and selected-timezone conversions.
• Make CME cleanup and ingestion recovery durable and transactional; minimize upload/worker diagnostics, harden RAG cache revocation/freshness and request coalescing, and preserve calculator/staff release holds.
• Invalidate the RAG cache scope revision when table facts or images change (#3650).
• Add an explicit isolated rootless catalog replay backend while retaining Docker as the default, preserve all existing migration seals, and document the audit findings, implementation and outstanding acceptance conditions.

Areas touched: App experience; Personal practice; Data platform and access; Answer engine; Source intake and indexing; Delivery and assurance; Knowledge and records.

RAG impact: behaviour change — cache governance/freshness, revocation, fallback, request coalescing and evidence-revision invalidation. Provider-backed before/after canary evidence is not available; it remains an owner-authorized acceptance condition.

Verification

• Historical local and hosted evidence for the source PRs is recorded on #3640, #3650 and in docs/audit/2026-10-17-full-deep-remediation-results.md. It is not hosted proof for this combined head.
• Carrying #3650 across: the resulting tree was checked to equal the old branch merged with main, and the cache-revocation, migration-immutability and drift-detection tests passed locally (3 files, 51 tests).
• Hosted CI on this head: draft-scope checks only until the PR leaves draft. Migration replay, unit coverage and browser lanes are pending, and skipped checks are not passes.
• Supabase Preview is not verified. The Dependabot high alerts (#24, #27, NLTK) and the dev-only braces advisory have no fixed upstream release and remain open.

Risk and rollout

• Risk: High. This crosses account isolation, recovery state, private-document cleanup, clinical holds and RAG cache boundaries. Qualified clinical/privacy/provider approvals and candidate-matched hosted verification remain unmet. Deploying #3650's change invalidates every cached answer and search once.
• Rollback: Revert application changes in a reviewed commit while retaining clinical/privacy holds. SQL and durable queue/state changes need a separately reviewed compatibility and data-recovery plan; reverting TypeScript alone does not undo database effects.
• Provider or production effects: Creating/updating this PR may trigger configured GitHub CI and the existing Supabase preview-branch integration. No paid RAG evaluation, Railway deployment, production SQL application or merge is authorized by this publication.

Merge only inside the owner's specifically approved production database window. This PR contains supabase/migrations/20261018082910_audit_durable_recovery_pairing_and_cache_fences.sql and supabase/migrations/20261018095804_rag_cache_scope_evidence_revision.sql; merging to main automatically applies migrations to the live clinical database within seconds. This work did not alter owner-controlled auto-merge state.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains PsychSift Production (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Physiological calculators and staff activation remain held. No qualified clinical, legal, privacy or provider sign-off was fabricated. The cache revision is now a clinical-evidence hazard control that the owner should review; no hazard control is sealed here.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_018UBtJDgQZJ3eBsxLWte9r4

---

Summary by Gitar

• Roster alerts:
  • Added a durable offer alert outbox with per-device receipts and at-least-once push delivery in roster_offer_alert_outbox
  • Keyless open-shift posts now get a server-generated post key so their offer alerts enqueue
• PDF extraction:
  • Table edge recovery now requires ruled cell boundaries, retaining ambiguous edge text for review via edge_recovery_needs_review
• Release holds:
  • Sick-call projection now shares the real-staff release hold, and bedside calculator outputs stay held pending clinical review
• Work role access:
  • Moving a hospital team revokes its whole-team supervisor grants in the same transaction via work_revoke_supervisors_on_team_move

_{This will update automatically on new commits.}

Summary by CodeRabbit

• Bug Fixes

  • Prevented account-specific data and pending actions from carrying over when switching accounts.
  • Improved roster warnings and retries when calendar sources fail, corrected pay-period history coverage, and improved work-time handling across time zones.
  • Updated retrieval-cache freshness checks so governance and evidence changes are reflected; improved recovery handling for queued documents.
  • Added a release hold for clinical calculators pending review and gated hospital sick-call access behind a release setting.

• Documentation

  • Expanded operational guidance, audit findings, remediation plans, and release-readiness records. Local acceptance and release readiness remain blocked by outstanding approvals and verification.