docs(ledger): maturity tests/packages audit record

[BigSimmo]

Summary

Read-only maturity audit of whether this repo needs more tests or packages. Conclusion: already high-maturity — prefer a few targeted additions over new frameworks.

This PR only appends the required docs/branch-review-ledger.md row for scope maturity-tests-packages-audit at HEAD 8b27cb4b69b41948a64f91cbbf4b487e5f789b39.

Recommendations (do not implement in this PR)

Worth doing (no/low new npm packages)

1. Account API route Vitest coverage for /api/account/preferences and /api/account/favourites — auth reject, Zod reject, upsert/delete. Helpers/schema are tested; routes are not.
2. #040 Playwright visual baselines — small stable desktop/mobile/a11y set via toHaveScreenshot; do not add Chromatic/Percy.
3. Python OCR packaging — pyproject.toml + lock (uv/pip-tools), Ruff, Pytest, pip-audit/OSV for worker/python (clearest tooling gap vs Node).
4. Mark maturity workorder X6 largely satisfied — clinical coverage floors already ratcheted in vitest.config.mts (2026-07-29); residual is filling gaps, not adding a package.
5. #094 computed-style proofs where the visual is the contract (rails, forced-colors, tap targets).

Optional / later

• Small mutation-testing pilot (Stryker) on pure sanitizer/chunking only — not repo-wide.
• OSV Scanner / CycloneDX SBOM if supply-chain evidence is needed for clinical compliance beyond npm audit + Dependabot.

Do not add

Chromatic/Percy, MSW, OpenAPI generators, semantic-release/changesets, commitlint/husky, Renovate (Dependabot exists), size-limit (custom bundle budget exists), repo-wide dependency-cruiser / load-test suites without a measured production pain.

Aligns with docs/audit/2026-07-20-repository-maturity.md and docs/maturity-backlog-workorders.md: risk of over-engineering is higher than under-tooling.

Clinical Governance Preflight

• No clinical retrieval, answer generation, source governance, ingestion, privacy, or production-env behaviour change (ledger-only docs append).
• Failure behaviour unchanged (no runtime code).
• No rollback needed beyond reverting the ledger row.
• Verification: ledger append via npm run ledger:append; no provider checks.

RAG impact: no retrieval behaviour change — documentation/ledger only.

  

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 13 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 3c28893d-f643-46a6-bfd1-36e2a97d22db

📥 Commits

Reviewing files that changed from the base of the PR and between f937493 and 4aab7cf.

📒 Files selected for processing (1)

• docs/branch-review-ledger.md

---

_{Comment @coderabbitai help to get the list of available commands.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.