test: harden phone chrome verification and merge safeguards

.github/workflows/ci.yml

@@ -187,6 +187,9 @@ jobs:
       - name: Runtime alignment
         run: npm run check:runtime
 
+      - name: Installed dependency parity
+        run: npm run check:installed-lock-parity
+
       - name: GitHub Actions pin check
         run: npm run check:github-actions
 

AGENTS.md

@@ -166,7 +166,7 @@ When a branch or PR review completes, append the reviewed branch/ref, HEAD SHA,
 
 - For non-trivial source/config/test changes, prefer `npm run verify:cheap` as the first broad gate and `npm run verify:pr-local` before PR handoff when the change is ready. The PR-local gate runs the full unit suite once, then conditionally adds the production build/client-bundle scan and RAG fixture/manifest validation. Browser, dependency-audit, Docker/Supabase replay, and provider-backed checks remain separate gates. Use `npm run verify:pr-local -- --dry-run --files <comma-separated paths>` to inspect selection without running commands. The broader `--extended` plan is dry-run only unless explicit approval is reflected by `ALLOW_EXTENDED_PR_LOCAL=true`.
 - Let the repository run coordinator control cross-worktree verification. It permits at most two focused Vitest/read-only typecheck leases from different worktrees; full Vitest, coverage, lint, build, Playwright, and live-provider tests remain exclusive. Do not install while a repository test, build, lint, typecheck, or server command is active. Avoid aggressive short-interval polling, and do not repeat an unchanged full gate after it passes.
-- For UI, frontend, browser, routing, styling, reduced-motion, or forced-colors changes, run `npm run ensure` before browser work and use `npm run verify:ui` as the Chromium UI gate.
+- For UI, frontend, browser, routing, styling, reduced-motion, or forced-colors changes, run `npm run ensure` before browser work and use `npm run verify:ui` as the Chromium UI gate. For phone-chrome changes, run `npm run verify:phone-chrome` first: it checks installed-lock parity, selects the affected browser/PWA owners and exact journeys, and adds `verify:ui` last only when shared chrome foundations make the broad gate necessary. Inspect uncertain scope with `-- --dry-run`.
 - For release or handoff confidence, use `npm run verify:release`; this includes the full Playwright project set.
 - For clinical ingestion, answer generation, source governance, privacy, production-readiness, or environment changes, run the smallest relevant domain check plus `npm run check:production-readiness`.
 - For pull requests that touch ingestion, answer generation, search/ranking, source rendering, document access, privacy, production env, or clinical output, complete the clinical governance preflight in `.github/pull_request_template.md`.
@@ -218,7 +218,7 @@ The shared search chrome must adapt by page ownership, not by ad-hoc padding or
 - **Hidden means zero reserve.** When phone search/header/footer chrome scroll-hides, the content-facing reserve is `0rem`; do not restore `0.75rem`, `env(safe-area-inset-bottom)`, or `var(--safe-area-bottom)` as hidden padding. Visible composer chrome may still consume safe-area inset.
 - **Header/footer symmetry.** Top header and bottom composer hide/reveal from the same scroll signal where they share a scroll container. If one is hidden, page content behind that edge must be fully visible rather than covered by an opaque white/surface band.
 - **Page adaptation.** Standalone mode homes keep the composer in-flow in the hero on phones; submitted/search-result views use the compact bottom dock; answer mode may use overlaid glass header behaviour with matching top reserve; document detail/source routes let `DocumentViewer` own its composer.
-- **Guards.** Update the reserve helper, CSS tokens, Playwright phone-scroll coverage, and static contract tests together. Do not silence the existing reserve/overlay tests; add a narrower guard for any new page-specific exception.
+- **Guards.** Update the reserve helper, CSS tokens, Playwright phone-scroll coverage, and static contract tests together. Do not silence the existing reserve/overlay tests; add a narrower guard for any new page-specific exception. Run `npm run verify:phone-chrome`; its smart selector must keep focused owner/journey proof before any recommended full `verify:ui` escalation.
 
 <!-- END:search-chrome-behaviour -->
 

docs/README.md

@@ -64,6 +64,7 @@ npm run docs:check-links
 
 - [process-hardening.md](process-hardening.md) — verification gates, CI expectations, known debts
 - [testing.md](testing.md) — test execution, focused/live commands, Playwright ownership, flake policy
+- [phone-chrome-physical-acceptance.md](phone-chrome-physical-acceptance.md) — labelled Safari and cold-launch PWA acceptance matrix
 - [productivity-workflows.md](productivity-workflows.md) — repo workflow planners (flightplan, triage, rag-lab, …)
 - [codex-review-protocol.md](codex-review-protocol.md) — shared review protocol for all review skills
 - [codex-prompt-playbook.md](codex-prompt-playbook.md) — copy/paste prompts for common repo work

docs/branch-review-ledger.md

@@ -1124,4 +1124,9 @@ This file is append-only. Never rewrite or delete an existing review record; app
 | 2026-07-27 | branch-cleanup exact merged-head batch | `multi-head` | branch-cleanup | REMOVED. Deleted 30 additional clean worktrees and 34 additional local branches whose exact tips matched GitHub merged PR head records. Preserved the newly merged `codex/settings-ux` worktree under a recent-work grace rule, along with all checked-out, dirty, open-PR, closed-unmerged, secret-safeguarded, process-locked, or unmatched refs. | GitHub merged/open PR head inventory; exact OID match immediately before removal; no force worktree removal; no application tests or provider-backed application workflows run. |
 | 2026-07-27 | branch-cleanup aged and closed-ref batch | `multi-head` | branch-cleanup | REMOVED. Deleted 36 clean branch-backed worktrees older than 72 hours while retaining their refs, then deleted 16 old temporary or exact closed-PR local refs and 11 exact closed-PR remote refs after verified recovery bundles. Restored and retained one permission-locked Antigravity worktree; retained all dirty, open-PR, recent, archive/preserve, secret-bearing, high-risk, divergent, detached, or potentially useful UI refs. | Fresh GitHub open/all/closed PR inventories; 72-hour creation/closure cutoff; exact tip checks; four verified incremental bundles for 21 refs in this pass; no force worktree removal, application tests, or provider-backed application workflows run. |
 | 2026-07-27 | `codex/publish-document-nav-20260727` (PR #1278) | `71d442e7921c36fe036128207c9925484a908fd0` | Protected-main review of preserved cleanup records, reusable review prompts, and document navigation mockups | APPROVE pending final exact-head hosted required checks. The unique preserved work was transplanted onto current `origin/main`; stale phone-chrome and unsafe 15-minute lock-expiry patches were excluded. The first hosted static run found arbitrary mockup font sizes, which were replaced with the established named type-scale tokens. Review found no remaining P0-P3 issue and no retrieval, clinical-output, provider, or production-route behavior change. | Flight plan, Prettier, docs index/scripts/links, sitemap, branch-ledger, type-scale, icon-scale, brand, design-system, and `git diff --check` PASS; hosted build, static, unit coverage, advisory mockup UI, safety, policy, Semgrep, and secret checks PASS on reviewed head; Production UI pending at ledger append; local heavy gates deferred behind legitimate shared exclusive owners; no non-GitHub provider-backed checks. |
+| 2026-07-27 | `codex/phone-chrome-testing-infra-20260727` | `f50bb000cd9addf98086cfccc07e25aa327be022` | Protected-main release-readiness review of phone-chrome testing infrastructure | APPROVE pending exact-head hosted required checks. Added installed-lock parity, risk-scoped phone verification, one-owner and atomic geometry helpers, stable chrome diagnostics, physical iPhone acceptance guidance, and a fail-closed final merge audit. The full Chromium run exposed a stale endpoint assertion while chrome changed the document range; the test now re-converges the endpoint without weakening its one-pixel contract. Current `origin/main` merged cleanly; its new Playwright matcher is mockup-only and does not alter the tested production project. No P0-P3 finding remains. Residual acceptance risk is physical Safari and cold-launch PWA paint, which was not available locally. | `verify:phone-chrome` PASS: contracts 91/91, focused phone journeys 12/12, full Chromium 323/323; exact repaired differential journey 1/1; Prettier, ESLint, typecheck, full unit 396 files / 3,554 passed / 2 skipped, production build/client-secret scan, offline RAG fixtures 36 cases, and `git diff --check` PASS; no live provider-backed app checks. |
+| 2026-07-27 | PR #1279 / `codex/phone-chrome-testing-infra-20260727` | `9aa0416313addaa9fc3a850c699b0e51f3a14c6c` | Hosted Production UI split-owner and hydration follow-up | APPROVE pending fresh exact-head hosted checks. The retained CI traces proved the calculator footer and frame header could independently accept or reject the same scroll event under slower RAF scheduling. Page-owned calculator chrome now consumes the frame's authoritative hide decision, with local reporters only as a shell-less fallback. A separate desktop smoke timeout filled a controlled input before React attached `onChange`; the shared fill helper now establishes that handler boundary before all 16 answer journeys. No assertions were relaxed and no P0-P3 finding remains. Residual acceptance risk remains physical Safari and cold-launch PWA paint, which was not available locally. | Final `verify:phone-chrome` PASS: installed/lock parity, runtime, contracts 92/92, focused phone journeys 12/12, full Chromium 323/323; exact two calculator regressions plus desktop hydration journey PASS 3/3; Prettier, typecheck, production builds, and `git diff --check` PASS; no non-GitHub provider-backed checks. |
+| 2026-07-27 | PR #1279 / `codex/phone-chrome-testing-infra-20260727` | `d6d76f9b61479997f747ddd45767d81b851e207c` | Exact-main sync review after hydrated-interaction test hardening | APPROVE pending fresh exact-head hosted checks. Current `origin/main` merged with one test-only overlap in the differential compare endpoint journey. The resolution preserves main's handler-readiness guard and 15-second live-endpoint convergence while keeping the feature branch's atomic document-owner assertion. Main's remaining hydrated-interaction changes merged automatically; no production component, phone geometry, or retrieval behavior conflicted. No P0-P3 finding remains. | Pre-sync `verify:phone-chrome` PASS: 92/92 contracts, 12/12 focused phone journeys, 323/323 full Chromium; post-sync exact resolved production differential journey PASS 1/1; production build/TypeScript and `git diff --check` PASS; hosted required checks pending. |
 | 2026-07-27 | `codex/settings-followup` | `806fcc4c3167d9e2f9fbd832c39e53d3491f270a` | Protected-main release-readiness review of settings follow-up browser reliability | APPROVE. The test-only diff waits for one settled React owner before strict answer/search interactions, makes universal-search mocks echo the requested query, and retries scroll-to-live-endpoint geometry after late dock layout. Review found no P0-P3 issue and no product, retrieval, ranking, clinical-output, or provider behavior change. Highest residual risk is physical iOS/WebKit behavior outside local Chromium coverage. | Focused integrated production Chromium PASS (5/5); exact integrated-head `verify:pr-local` PASS (runtime, formatting, lint, typecheck, 393 files, 3,538 passed / 2 skipped, 36 offline RAG fixtures); `verify:ui` PASS (323/323); `git diff --check` PASS; no non-GitHub provider-backed checks. |
+| 2026-07-27 | PR #1279 / `codex/phone-chrome-testing-infra-20260727` | `e1add338ae6b138ded13c44f5cc8f7eef5302669` | Automated-review follow-up for required-check selection in the final merge audit | APPROVE pending fresh exact-head hosted checks. The P1 was valid: the audit selected the required aggregate but incorrectly treated every advisory status as merge-blocking. Unsettled-state validation now applies only to the required aggregate, while missing or unsuccessful `pr-required` still fails closed. A regression snapshot proves a failed Advisory UI job cannot block a successful required aggregate. No other P0-P3 finding remains. | Focused `tests/final-merge-audit.test.ts` PASS (7/7); Prettier and `git diff --check` PASS; earlier exact-tree `verify:phone-chrome` remains the browser baseline because this follow-up changes only the audit validator and its unit test; hosted required checks must rerun on this head. |
+| 2026-07-27 | PR #1279 / `codex/phone-chrome-testing-infra-20260727` | `a2331fc8d1883d687d0bbb6e1b023503ab5deb1d` | Automated-review follow-up for changed Playwright journey selection | APPROVE pending fresh exact-head hosted checks. The P2 was valid: fixed title filters could omit a modified journey while the planner still reported focused coverage. Changed phone-chrome Playwright specs now run completely without `--grep`; the title-filtered matrix remains only for relevant unchanged specs, preserving focused-first feedback without hiding edited tests. Regression cases cover both `ui-phone-scroll` and `ui-tools`. No other P0-P3 finding remains. | Focused `tests/verify-phone-chrome.test.ts` PASS (7/7); smart-plan dry run selects complete changed specs before the risk-selected full UI suite; Prettier and `git diff --check` PASS; fresh hosted required checks must rerun on this head. |

docs/codebase-index.md

@@ -316,20 +316,21 @@ One shared composer (`master-search-header.tsx`) serves every mode. Placement:
 
 ## Key config files
 
-| File                                | Role                                                  |
-| ----------------------------------- | ----------------------------------------------------- |
-| `package.json`                      | Scripts, deps, Node 24 / npm 11                       |
-| `.env.example`                      | Full env template                                     |
-| `next.config.ts`                    | CSP, security headers, build config                   |
-| `tsconfig.json`                     | Strict TS; excludes `supabase/functions/**`           |
-| `eslint.config.mjs`                 | Lint scope                                            |
-| `AGENTS.md`                         | Agent rules, verification gates, shortcuts            |
-| `.github/workflows/ci.yml`          | CI pipeline                                           |
-| `scripts/sync-open-pr-branches.mjs` | Operator-only dry-run/apply helper for PR branch sync |
-| `docs/process-hardening.md`         | Verification pyramid                                  |
-| `docs/clinical-governance.md`       | Clinical safety governance                            |
-| `docs/reindex-runbook.md`           | Reindex operations                                    |
-| `docs/retrieval-quality-runbook.md` | Retrieval tuning                                      |
+| File                                       | Role                                                      |
+| ------------------------------------------ | --------------------------------------------------------- |
+| `package.json`                             | Scripts, deps, Node 24 / npm 11                           |
+| `.env.example`                             | Full env template                                         |
+| `next.config.ts`                           | CSP, security headers, build config                       |
+| `tsconfig.json`                            | Strict TS; excludes `supabase/functions/**`               |
+| `eslint.config.mjs`                        | Lint scope                                                |
+| `AGENTS.md`                                | Agent rules, verification gates, shortcuts                |
+| `.github/workflows/ci.yml`                 | CI pipeline                                               |
+| `scripts/sync-open-pr-branches.mjs`        | Operator-only dry-run/apply helper for PR branch sync     |
+| `docs/process-hardening.md`                | Verification pyramid                                      |
+| `docs/phone-chrome-physical-acceptance.md` | Physical Safari / cold-launch PWA phone-chrome acceptance |
+| `docs/clinical-governance.md`              | Clinical safety governance                                |
+| `docs/reindex-runbook.md`                  | Reindex operations                                        |
+| `docs/retrieval-quality-runbook.md`        | Retrieval tuning                                          |
 
 ---
 

docs/codex-review-protocol.md

@@ -38,3 +38,13 @@ Use this protocol for every Codex review, audit, bug hunt, PR review, release-re
 - P1: Broken core workflow, unsafe automation, privacy/auth failure, or repeatable defect that blocks merge/handoff.
 - P2: Real defect, missing guardrail, fragile process, or test gap that should be fixed before relying on the work.
 - P3: Low-risk cleanup, clarity, documentation, or future-proofing issue.
+
+## Final merge audit
+
+Before a protected-main merge, run the local audit from a clean PR checkout and pin the reviewed head:
+
+```powershell
+npm run audit:final-merge -- --dry-run --base-ref origin/main --head-ref HEAD --expected-head <head-sha>
+```
+
+The output records the local base/head and expected merge-tree. GitHub checks, labels, review threads, fresh remote refs, and deployment health are provider reads and require explicit authorization. Once authorized, add `--providers --pr <number> --repo BigSimmo/Database` and set `ALLOW_PROVIDER_READS=true`; the audit fails closed unless the repository's `pr-required` aggregate is present and settled successfully. After the squash merge, rerun with `--post-merge --expected-tree <pre-merge-tree> --health-url <production-origin>/api/health`; the audit compares the remote main tree and requires an HTTP success with JSON `status: "ok"`. The script is read-only: it never merges, pushes, reruns CI, resolves threads, or deploys.