PR #3654 - BigSimmo/PsychSift

Requested by Josh · project thread

Clean rebuild of #3641. This PR carries the identical final code of #3641 at df75f1444, merged with current main, as one commit. #3641 could not pass PR policy: qodo-code-review[bot] commits in its history touch Supabase or clinical paths, and history rewrites are banned. The owner chose a rebuild (thread decision, 18 Oct 2026). The bot's changes are included only as they stood at df75f1444, so review them here. Earlier review discussion stays on #3641. Draft until the owner has reviewed it.

Do not merge as it stands. It still contains 20261018100000_fence_document_queue_rollbacks.sql, which the owner asked to drop at 16:17 AWST, and the training-milestone migration as 20261018062800, a duplicate of the rebuilt #3638's 20261018075500. Merge only one of this PR and the rebuilt #3638. Removing those two migrations needs the owner's explicit yes, because it changes the migration seal file.

Summary

Repair the confirmed merged-PR review defects in durable roster alerts, PDF extraction, queue rollback fencing and catalogue integrity. This consolidated successor includes #3638's fixes. Review this PR and do not merge both independently.

Queue offer events atomically with open.post; claim them across instances with expiring tokens, drain device pages and acknowledge/retry each device independently. Recheck current eligibility, preferences, quiet nights and subscription ownership before each send. Preserve staff-release controls. Delivery is at least once: a crash after provider acceptance can duplicate that device's alert.
Require visible ruled-cell evidence before assigning PDF edge text to clinical table cells. Preserve ambiguous text with geometry/review warnings, complete safety notes and overflowing instructions. Correct later automated changes that removed these protections.
Repair queue-enqueue compilation and mutation-identity typings/fixtures. Regenerate the narrowed CET catalogue and lineage fixture; CET remains unverified and excluded, with all 1,081 logical IDs, content hashes, governance and eligibility values preserved.
Append only the three specifically approved migration hashes, preserving all 321 existing entries. Commit the genuine pinned-image drift manifest recovered from hosted generation, preserving its exact 857,796 bytes and emitted SHA-256 3555daf05dc0e71d941634714c31d46ce792ffe19243408e3a7ba5db0238a49d. No expected catalogue fields were hand-edited.
Later on #3641: keyless open posts now get a server post key so their offer alert is queued; worker shutdown waits a bounded time for an in-flight offer batch; bulk reindex keeps batch totals on failure and waits out its rate limit; the governance runbook requires retrieval evidence before lifting offline mode.

Issue-by-issue evidence and approval scope: docs/audit/2026-10-18-remaining-review-closeout.md and the original resolution audit. Immutable independent review records cover source corrections, seals, fail-closed recovery and generated-manifest integrity.

Areas touched: Knowledge and records, Personal practice, Source intake and indexing, Clinical reference content, Answer engine, Data platform and access, Delivery and assurance, App experience, Prototypes

RAG impact: behaviour change — live canary pair not run; requires separate explicit owner approval. PDF extraction rejects uncertain clinical cell associations while preserving source text; inherited cited-source recovery and metadata admission fixes remain. No relevance comparator changes.

Verification

Independent PDF, alert/concurrency, catalogue, seal and recovered-manifest reviews; actionable findings corrected and rechecked. Requested reviewer routing is not independently verified execution telemetry.
Owning worker/PDF/roster/catalogue and architecture contracts: 1,805 passed, one skipped across 131 files. Later concurrent-change corrections passed 35 focused TypeScript tests and 60 PDF tests, plus fresh full lint/typecheck. The recovered manifest then passed 66 drift/freshness/immutability/parity-contract tests in four files. These scopes overlap; no combined total is implied.
Local assessment/Teaching browser proof: 23 passed, unchanged 2px assertion, Chromium 151; responsive/installed-layout, reduced motion, enlarged text, forced colours and keyboard checks. Physical Safari/PWA and assistive-technology acceptance remain separate.
Native PostgreSQL disposable transaction/grant and actual two-session claim/lease/expiry tests passed. No live SQL or push-provider calls ran.
Corrected-mirror final hosted freshness and strict parity passed on an earlier head (run39117853586). This rebuild's CI is the evidence for the current head.

Risk and rollout

Risk: clinical-source association, roster privacy/delivery and database concurrency. This PR is not merge-ready: the two migrations above, applicable human/device acceptance, live RAG canaries and accountable classification/sign-off remain open. Merge only after specific production database-change approval in an approved window. Merging applies the migrations to the live clinical database automatically.
Rollback: revert application/extractor changes before release; a database rollback requires a separately approved forward migration. Preserve applied history. Unruled edge content can lose structured row assignment while retaining source text/geometry for review.
Provider or production effects: GitHub branch/PR publication and configured offline CI only. No merge, auto-merge, live SQL, production deployment, provider push, clinical signature or live RAG evaluation was performed.

Clinical Governance Preflight

Source-backed claims still require linked source verification before clinical use
No patient-identifiable document workflow was introduced or expanded without explicit governance approval
Supabase target remains PsychSift Production (sjrfecxgysukkwxsowpy)
Service-role keys and private document access remain server-only
Demo/synthetic content remains clearly separated from real clinical sources
Source metadata, review status, and outdated/unknown-source behavior remain conservative
Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Clinical/legal/cultural approval remains with accountable humans under docs/clinical-sign-off-how-to.md.

Generated by Claude Code

Summary by cubic

Clean rebuild of #3641 as one commit on current main, fixing the confirmed review defects in roster offer alerts, PDF edge-text extraction, queue rollback fencing, and catalogue/CI integrity. Not merge-ready: the PR still carries 20261018100000_fence_document_queue_rollbacks.sql and the duplicate training-milestone migration, and only one of this PR and the rebuilt #3638 should merge; merging applies the migrations to the live clinical database automatically.

Roster offer alerts

Queues the offer alert atomically with open.post and drains it via expiring leases instead of process-local deduplication.
Rechecks eligibility, quiet nights and subscription ownership per device before send; keyless posts get a one-use server post key so their alert still queues.
Delivery is at-least-once: a crash after push acceptance can duplicate one device's alert, and shutdown waits a bounded time for an in-flight batch.

PDF, queue, catalogue and CI

PDF edge text is assigned to table cells only with visible ruled-cell evidence; ambiguous text keeps geometry/review warnings and complete safety notes.
Rollback fencing reads the database-assigned mutation_id and the stored timestamp rather than caller stamps, and the bulk reindex waits out its rate limit.
Regenerated CET catalogue preserves all 1,081 IDs, content hashes, governance and eligibility values; CET stays unverified and excluded.
Drift-manifest freshness failures now print the generated manifest inline for artifact-free recovery; the committed manifest is the genuine 857,796-byte recovery with its emitted SHA-256, and the migration seal appends only the three owner-approved hashes.