Fix typography audit issues

docs/branch-review-ledger.md

@@ -1193,6 +1193,7 @@ This file is append-only. Never rewrite or delete an existing review record; app
 | 2026-07-28 | PR #1289 / `codex/rag-reliability-final` | `a1ca6a016490e4d4b564edd3d553d87fed3071df` | Protected-main RAG reliability, clinical-governance and release review | APPROVE. Independent retrieval, governance and fallback reviews found and fixed three merge blockers: global chunk-query alias overreach was narrowed to the measured clozapine blood-count action shape; legacy private source reviews remain on the deployed v1 RPC while unapplied-v2 paths fail explicitly; and source-backed review fallback is now a zero-tolerance blocking metric with reconciled evidence. Final rereviews found no P0-P2. PR #1288 was superseded without force-push after GitGuardian correctly rejected a token-shaped fake fixture; the clean replacement tree is byte-identical to the reviewed tree and both secret scanners pass. The additive BMJ attestation migration remains unapplied and BMJ stays unverified pending qualified human action. | Exact application tree `verify:pr-local` PASS: format, zero-warning lint, typecheck, 403 files and 4,101 tests passed with 2 skipped, production build/client-secret scan, and 36 offline RAG fixtures. Live 36-case canary PASS with document/content recall 1.0, zero failed cases and zero per-case document/content RR regressions; three cache-bypassed affected-path answer probes PASS with zero provider requests and zero generation cost. Earlier coverage PASS: 399 files, 4,062 passed and 2 skipped, RAG 86.83% statements and 90.79% lines. Hosted build, static, unit coverage, migration replay, Supabase Preview, Production UI, policy, Semgrep, Gitleaks and GitGuardian passed on the implementation tree; final evidence-only head requires the normal hosted rerun. |
 | 2026-07-28 | PR #1289 / `codex/rag-reliability-final` | `d49af8acb42ccedbfe6c8b3f03d30769ba906ec7` | Bugbot review (exact head) | APPROVE. No high-confidence P0–P2. Application `src/`/`supabase/`/`tests/`/`scripts/` trees are unchanged vs prior APPROVE tip `a1ca6a01`; tip delta is docs evidence + clean merge from `main`. No unresolved `cursor[bot]` Bugbot threads. Residual risk: unapplied BMJ attestation migration (`#022`) correctly fails closed with `503 source_review_v2_unavailable` until qualified hosted apply. | Focused high-risk Vitest 358 + 1502 passed; merge-tree CLEAN vs `origin/main`; no provider-backed checks; no PR comment mutations. |
 | 2026-07-28 | PR #1289 / `codex/rag-reliability-final` | `ab6ca036937bff1acaefbda8a5581d6d75f489b3` | Final current-main sync review | APPROVE pending fresh exact-head required checks. Merged current `origin/main` without conflict after its already-reviewed document-search and focus-path changes; no protected RAG, evaluation, migration, or RAG fixture surface changed from the live-canary application tree, and no P0-P2 finding remains. | `git merge-tree --write-tree` CLEAN before sync; branch-ledger guard and `git diff --check` PASS; prior exact application-tree `verify:pr-local` and live 36-case canary remain applicable; fresh hosted checks required. |
+| 2026-07-28 | PR #1294 / `execute-typography-fixes-clean-2` | `6a0086732a5cfaaa17977ee0c568d6f326f4c059` | CI babysit + Bugbot | FIXED. Merged origin/main cleanly (behind/mergeable). Production UI failed on strict getByTestId(differential-detail-page) matching live page + hidden Next streaming S: clone; scoped locator to mobile-composer-reserve-pad (same class as presentation/service detail). Prettier-fixed Static PR. Bugbot: 0 unresolved cursor[bot] threads; no P0/P1 on unique diff. | Focused Chromium diagnosis-detail journey PASS 1/1; format:check PASS on touched file; no provider-backed checks. |
 | 2026-07-28 | PR #1292 / `codex/chat-clinical-grounding-cap-bbc4` | c665fce7b84d9ecda3e92b1db7bfc3c1877d0222 | Main conflict resolve + Bugbot | Real merge conflicts in `answer-verification.ts` / `rag-claim-support.ts` after #1289/#1286 landed. Resolved by retaining main band-conflict + sectionIndex claim assessment and re-applying unassessed numeric fail-closed. Bugbot: 0 reviewThreads. No comments to resolve. | Local: vitest claim-support+answer-verification 223/223; merge-tree clean post-resolve. |
 | 2026-07-28 | PR #1273 / `codex/create-mobile-navigation-mockups` | `af9a957b` | Babysit recheck | Hosted CI green on prior tip; GitHub DIRTY was staleness (merge-tree CLEAN). Merged origin/main cleanly. Unresolved threads 0. Bugbot: no cursor[bot] findings. | merge origin/main; check:type-scale --strict PASS; no provider checks. |
 | 2026-07-27 | PR #1275 / `codex/identify-and-fix-performance-issues-during-mode-switch` | `82c17f76` | Mode-switch prefetch review + merge restore | Prefetch mode homes on menu open; later reconciled with main per-option prefetch. Ledger restored append-only from main after mojibake rewrite. | Focused nav tests; check:branch-review-ledger; no provider checks. |
@@ -1201,6 +1202,7 @@ This file is append-only. Never rewrite or delete an existing review record; app
 | 2026-07-27 | PR #1275 / `codex/identify-and-fix-performance-issues-during-mode-switch` | `f4b55751` | CodeRabbit behavioral prefetch-test disposition | RESOLVED. Behavioral DOM coverage for menu-open prefetch paths (later adapted to per-option model). | focused vitest PASS; no provider checks. |
 | 2026-07-27 | PR #1275 / `codex/identify-and-fix-performance-issues-during-mode-switch` | `81005d18` | Codex mojibake-ledger disposition | RESOLVED. Historical rows restored byte-for-byte from origin/main; append-only thereafter. | exact prefix check; check:branch-review-ledger PASS; no provider checks. |
 | 2026-07-28 | PR #1275 / `codex/identify-and-fix-performance-issues-during-mode-switch` | `01469840` | CI/merge conflict closeout + Bugbot triage | RESOLVED merge conflict with origin/main (7ae4eb49 per-option prefetchModeHome). Dropped superseded bulk prefetchModeHomes; menu-open warms only highlighted option; focus/pointer scanning retained. CodeRabbit duplicate/malformed ledger threads dispositioned (main-owned). No open cursor[bot] Bugbot product defects. | merge-tree clean; focused vitest 12/12; ledger restored from main + appends; no provider checks. |
+| 2026-07-28 | PR #1294 / `execute-typography-fixes-clean-2` | `41da30ed82eb1cb6685883b6afbaa1e3198ee37d` | CI green closeout | APPROVE. Hosted required aggregate green after diagnosis-detail S: clone locator scope + Prettier + main sync (#1275). Bugbot: 0 unresolved cursor[bot] threads; no P0/P1 on unique product delta (mockup h3→h2 + test locator). Mergeable; 0 behind main. | Hosted Static PR / Unit / Build / Safety / Advisory UI / Production UI / PR required PASS; focused Chromium diagnosis-detail PASS 1/1 earlier; no provider-backed checks. |
 | 2026-07-28 | PR #1285 / `cursor/pdf-extractor-sigkill-137-0687` | `f1e422e8ee64f7e161e78d9a56707a1a83cc3374` | CI babysit: PR policy + main sync | Before: PR marked ready → PR policy FAIL (missing Clinical Governance Preflight); GitHub CONFLICTING/DIRTY but merge-tree clean (17 behind). 0 unresolved review threads; Bugbot no P0/P1. After: merged origin/main; PR body updated with complete Clinical Governance Preflight (7/7 checked). | Local pr-policy evaluate ok; Vitest process-failure 2/2; no provider checks. |
 | 2026-07-28 | PR #1285 / `cursor/pdf-extractor-sigkill-137-0687` | `734931960175afa12359e84c030290396c381bb5` | CI babysit closeout | Final tip after main sync + Clinical Governance Preflight body fix for ready PR. | Awaiting exact-head PR policy/required CI. |
 | 2026-07-28 | PR #1292 / `codex/chat-clinical-grounding-cap-bbc4` | ff40a2b945caf657b45cec0d662317057c63abe3 | CI babysit + main sync + Bugbot | GitHub DIRTY/CONFLICTING with clean `merge-tree` (2 behind main). Merged `origin/main` with no content conflicts. CI already green on prior tip; no product test failures. Bugbot: reviewThreads=0; product fail-closed scan clean. No comments to resolve. | Local overflow Vitest 1/1; ledger guard pass; awaiting exact-head hosted CI. No providers. |
@@ -1213,7 +1215,14 @@ This file is append-only. Never rewrite or delete an existing review record; app
 | 2026-07-28 | PR #1291 / `claude/issues-upload-limit-sync-123366` | `1607558188283d3497683f1067835d96f1031d3c` | CI babysit + merge conflict + Bugbot | FIXED. GitHub CONFLICTING/DIRTY was a real content conflict in `docs/outstanding-issues.md`: main had claimed `#084` for completed per-result grading evidence, colliding with this PR's upload-limit capture. Resolved by keeping main's ledger, renumbering the upload-limit recommendation to `#085`, and bumping `issues:next-id` to `086`. Synced again when main advanced with #1300. CodeRabbit date thread already resolved. Bugbot: zero `cursor[bot]` findings. Required CI green (PR required SUCCESS). | merge-tree CLEAN; prettier + docs:check-links PASS; hosted Change scope/Static/PR required SUCCESS; no provider-backed checks. |
 | 2026-07-28 | PR #1291 / `claude/issues-upload-limit-sync-123366` | `af140d11d5ca23dee0d8705d9933db967fc8c404` | Babysit closeout tip | Supersedes prior #1291 row at `16075581` after appending the conflict/Bugbot ledger record. Product delta vs main unchanged: `#085` upload-limit capture only. merge-tree CLEAN; awaiting exact-head required checks. | ledger append + check:branch-review-ledger PASS; prior tip hosted PR required SUCCESS. |
 | 2026-07-28 | PR #1302 / `claude/maturity-ledger-entry` | `64da2c1b34ae101590b8676af12ec6b49c14f0ad` | CI/conflict babysit + Codex threads + Bugbot | FIXED. Real content conflict with main: `#085` already claimed by upload-limit rec (#1291). Merged origin/main; renumbered maturity backlog to `#086`, bumped `issues:next-id` to `087`, added recommended-queue order 29 with go-ahead/RAG/provider stop rules. X7/M1 work orders arrived via main #1299. Codex P2 threads replied + resolved. Bugbot: zero cursor[bot] findings. CircleCI stub from main clears prior "no configuration" status error. | merge-tree CLEAN; prettier + docs:check-links + docs:check-scripts PASS; awaiting exact-head hosted CI; no provider-backed checks. |
-| 2026-07-28 | PR #1306 / `claude/frontend-checklist-skills-ece5e6` | `3e6584413f15cdc2c201b8ab123191b38f5d8042` | External skill precedence + evidence rules; CodeRabbit closeout | MERGED (squash); remote branch auto-deleted. Added `External skill precedence` and `Evidence and calibration are never compressed` to AGENTS.md after installing 390 user-global Front-End Checklist skills plus the caveman output-style plugin. CodeRabbit raised 3 findings; its autofix landed 2 pre-merge (WCAG target-size citation corrected to 2.5.5 AAA 44x44 vs 2.5.8 AA 24x24; third-party ref verification deferred to the provider boundary). The summary-level precedence-scoping nitpick had no inline thread, was skipped by autofix, and landed separately in PR #1308. | prettier PASS; docs:check-links 1274 refs PASS; docs:check-index PASS; verify:cheap BLOCKED at check:installed-lock-parity (worktree next 16.2.10 vs locked 16.2.11) so lint/typecheck/test never ran; no provider-backed checks. |
+| 2026-07-28 | PR #1294 / `execute-typography-fixes-clean-2` | `9ac401fd3f9997c1a18c83dc2e5190ff02fcad63` | CI babysit re-request | FIXED drift. Hosted required checks already green on prior tip `10157dec`; GitHub DIRTY was staleness (merge-tree CLEAN, 31 behind). Merged origin/main cleanly; unique delta unchanged (mockup h3→h2 + diagnosis-detail S: clone locator). Bugbot: 0 unresolved cursor[bot] threads; no P0/P1. | Prior hosted Production UI/PR required PASS on `10157dec`; merge-tree CLEAN; prettier check PASS; no provider-backed checks. |
+| 2026-07-28 | PR #1294 / `execute-typography-fixes-clean-2` | `567d7b74c49a9a1f4f4d195bb5538813f63e8b2e` | Build CI RAM-guard fix | FIXED. After main sync, Build failed because guard-next-build exit(1) on private GHA ~7.8 GiB hosts; guard is a local/Docker rail. CI/GITHUB_ACTIONS now warn-and-continue; local still fail-closed. Unique product delta unchanged. Bugbot: 0 threads. | Focused vitest guard-next-build-contract 2/2; prior Production UI green on `10157dec`; no provider-backed checks. |
+| 2026-07-28 | PR #1294 / `execute-typography-fixes-clean-2` | `da6cc04bc3a3823db4d2f14581ceec15f7757b80` | Codex P2 heading hierarchy | FIXED. Reverted mockup popup/sheet titles h2→h3 under Section h2 (hierarchy regression; same finding as PR #1200). Added answer-evidence-popups-heading-contract. Retained CI fixes: diagnosis-detail S: locator + Build RAM-guard CI warn. | Vitest heading+guard contracts 3/3; no provider-backed checks. |
+| 2026-07-28 | PR #1294 / `execute-typography-fixes-clean-2` | `908181ea98390ba18ece86c2057fb1f1ef5c1706` | Container app-image RAM-guard | FIXED. Buildx image build hit same <10 GiB guard (no CI env inside RUN). Extended warn path to DOCKER_BUILD=1 + /.dockerenv; Dockerfile sets DOCKER_BUILD=1. Local still fail-closed. | Focused vitest guard contract 2/2; hosted Build already PASS after prior CI bypass; no provider-backed checks. |
 | 2026-07-28 | PR #1307 / `claude/rag-019-fallback-guard` | `0827d65d12f5c25faffdf4ebca036f00fc2512cd` | CI babysit + Bugbot | FIXED. Build failed because `guard-next-build.mjs` hard-failed when GitHub runners reported 7.8 GiB RAM (<10 GiB); prior tip Build succeeded on a larger runner (flake). Softened to warn-and-continue under CI/GITHUB_ACTIONS; local/Docker still hard-fail. PR policy FAIL: missing `## Clinical Governance Preflight` — body updated. Bugbot: zero cursor[bot] findings; reviewThreads=0 (nothing to resolve). merge-tree clean vs origin/main. | Unit: guard-next-build + #019 fallback + extractive-answer-formatting 137/137; prettier/eslint clean on touched files; pr-policy evaluate ok; no provider checks. |
 | 2026-07-28 | PR #1307 / `claude/rag-019-fallback-guard` | `2e5edfc6c9fcc0bb75674b179607888bbf872b91` | PR policy body synced + template removed | Sync PR policy body SUCCESS applied Clinical Governance Preflight (7/7). Deleted temporary `PR_POLICY_BODY.md`. Awaiting Build/PR policy/PR required on this tip. | Hosted Sync SUCCESS; no provider checks. |
+| 2026-07-28 | PR #1294 / `execute-typography-fixes-clean-2` | `a0df13f45cffb769b852e55bc44b6891b7fd80e7` | Main conflict resolve + CodeRabbit | FIXED. Merged #1307; took main ALLOW_LOW_RAM_BUILD RAM-guard (dropped DOCKER_BUILD approach). Tightened answer-evidence heading contract to component-scoped bodies (rejects sibling h2). Codex P2 already resolved. | Vitest heading+guard 4/4; merge-tree CLEAN; no provider-backed checks. |
+| 2026-07-28 | PR #1306 / `claude/frontend-checklist-skills-ece5e6` | `3e6584413f15cdc2c201b8ab123191b38f5d8042` | External skill precedence + evidence rules; CodeRabbit closeout | MERGED (squash); remote branch auto-deleted. Added `External skill precedence` and `Evidence and calibration are never compressed` to AGENTS.md after installing 390 user-global Front-End Checklist skills plus the caveman output-style plugin. CodeRabbit raised 3 findings; its autofix landed 2 pre-merge (WCAG target-size citation corrected to 2.5.5 AAA 44x44 vs 2.5.8 AA 24x24; third-party ref verification deferred to the provider boundary). The summary-level precedence-scoping nitpick had no inline thread, was skipped by autofix, and landed separately in PR #1308. | prettier PASS; docs:check-links 1274 refs PASS; docs:check-index PASS; verify:cheap BLOCKED at check:installed-lock-parity (worktree next 16.2.10 vs locked 16.2.11) so lint/typecheck/test never ran; no provider-backed checks. |
 | 2026-07-28 | PR #1309 / `claude/gates-skill` | `7dfe103bfa408052c9e899211b8373c7ccb708d3` | Conflict sync + Codex/CodeRabbit + Bugbot | FIXED. GitHub CONFLICTING/DIRTY was main-staleness only (`merge-tree` clean); merged `origin/main`. Codex P2: skill wrongly claimed `verify:ui` exits 0 under heavy-lock contention — corrected to 15m queue then exit 1 via `run-playwright.mjs`; mirrored in AGENTS.md. CodeRabbit: marked `${PIPESTATUS[0]}` as Bash-specific. Bugbot: zero `cursor[bot]` findings; confirmed same P2. No CI failures on prior tip. | `prettier --check` PASS; `docs:check-links` 1287 PASS; no provider-backed checks. |
+| 2026-07-28 | PR #1294 / `execute-typography-fixes-clean-2` | `62ddd24dc8ad223cde67373ea35e18aee6065057` | CI green closeout | APPROVE. Hosted Production UI + PR required PASS on product tip `e5543dc6`. Codex/CodeRabbit threads resolved (0 open). Unique delta: diagnosis-detail S: locator + heading hierarchy contract. RAM-guard owned by main #1307. | Hosted Static/Unit/Safety/Advisory/Production UI/PR required PASS; Build/Container skipped (unchanged); Bugbot clean; no provider-backed checks. |
+| 2026-07-28 | PR #1294 / `execute-typography-fixes-clean-2` | `f64fa84a8010008917619c16aac79e4f172a70ff` | Ledger dedupe after main sync | Removed 2 exact duplicate #1307 rows introduced by merge=union during main sync (kept first copies). Hosted required checks green on prior product tip `e5543dc6`; this tip is ledger hygiene + docs-only main sync. | `check:branch-review-ledger` PASS after dedupe; no provider-backed checks. |

tests/answer-evidence-popups-heading-contract.test.ts

@@ -0,0 +1,35 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+
+const pageSource = readFileSync(path.join(process.cwd(), "src/app/mockups/answer-evidence-popups/page.tsx"), "utf8");
+
+function componentBody(source: string, functionName: string): string {
+  const start = source.indexOf(`function ${functionName}(`);
+  expect(start, `missing function ${functionName}`).toBeGreaterThanOrEqual(0);
+  const nextFn = source.slice(start + 1).search(/\nfunction [A-Za-z]/);
+  const end = nextFn === -1 ? source.length : start + 1 + nextFn;
+  return source.slice(start, end);
+}
+
+describe("answer-evidence-popups heading hierarchy", () => {
+  it("keeps Section titles at h2 and nested popup/sheet titles at h3 only", () => {
+    // Gallery sections own the h2 outline; popup/sheet frames nest under them.
+    // Promoting those child titles to h2 flattens the accessibility tree
+    // (confirmed as a hierarchy regression on PR #1200).
+    const section = componentBody(pageSource, "Section");
+    expect(section).toContain('<h2 className="text-base font-semibold text-[color:var(--text-heading)]">{title}</h2>');
+    expect(section).not.toMatch(/<h3\b/);
+
+    for (const [name, titleSnippet] of [
+      ["MobileSheetFrame", "{title}"],
+      ["DesktopEvidenceModal", "Evidence"],
+      ["TableDialog", "Clozapine monitoring table"],
+      ["WeakEvidencePopup", "Evidence support is limited"],
+    ] as const) {
+      const body = componentBody(pageSource, name);
+      expect(body, name).toMatch(new RegExp(`<h3\\b[^>]*>${titleSnippet.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}</h3>`));
+      expect(body, `${name} must not use h2 titles`).not.toMatch(/<h2\b/);
+    }
+  });
+});