Close verified ledger and CI follow-ups

[BigSimmo]

Summary

• Archive verified ledger follow-ups while preserving current-main evidence, including the final PR: Production readiness improvements and E2E fixes #105 and Harden RAG telemetry and production guardrails #136 dispositions and restored Optimize retrieval search and simplify document search home #85/Fix flowchart-next-step retrieval: surface red-zone action evidence #119 history.
• Surface partial favourites-source failures without hiding valid loaded counts, with accessible retry behavior and regression coverage.
• Harden ready-for-review CI triggering, ledger table/merge-driver validation, workflow-only scope classification, quarterly review-ledger rotation guidance, and the indexed-source search hydration journey.

RAG impact: no retrieval behaviour change — no protected retrieval, ranking, selection, chunking, citation rendering, or answer-contract source changed.

Verification

• npm run verify:pr-local
  • Verification not run as one final wrapper: all selected stages were run individually; runtime, installed-lock parity, format, lint, typecheck, production build, client secret scan, and RAG fixture validation passed. The refreshed full unit run reported 4597 passed, 3 skipped, and one stale shared-dependency failure; after relinking an exact-lock install, the brace-expansion contract passed directly. Hosted CI will provide the authoritative clean-install full suite.
• npm run verify:ui when UI, routing, styling, browser behavior, reduced-motion, or forced-colors behavior changed
  • UI verification not run to a single full-green aggregate: the full Chromium run reported 342 passed and one indexed-source search hydration failure. After adding the existing React-handler readiness guard, that exact production journey passed: 1 passed (9.3s).
• npm run verify:release before release or handoff confidence claims
  • Verification not run: release confidence depends on required hosted checks and final exact-head audit below.
• npm run check:production-readiness -- --ci
  • Passed provider-free with expected missing-local-secret warnings.
• npm run check:rag:fixtures
  • Passed: 36 golden cases across 22 suites.
• Ledger, CI, docs, and formatting guards
  • check:branch-review-ledger, check:outstanding-issues, check:github-actions, check:ci-scope, docs:check-scripts, docs:check-links, whole-tree format, and git diff --check passed.

Risk and rollout

• Risk: Low-to-moderate UI/governance risk. Favourites now disclose partial source states while preserving valid rows; CI and ledger guards become stricter.
• Rollback: Revert the squash commit. No data migration, provider configuration, secret, or production state change is involved.
• Provider or production effects: GitHub branch, PR, and hosted CI only. No OpenAI, Supabase, Railway, or production application mutation.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

• Exact reviewed substantive head: 268b201a1dbaed7cca6dff4a146b0319a5275216.
• Review-ledger tip: 763846f938a8a734cf307ccdc9f528f0d87ba95c.
• No provider-backed clinical, retrieval, or production checks were run.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 10 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b6695a12-2e28-4bd0-beaf-293dc7192fc3

📥 Commits

Reviewing files that changed from the base of the PR and between 9af15e1 and 6d386e7.

📒 Files selected for processing (7)

• docs/branch-review-ledger.md
• docs/codex-review-protocol.md
• docs/outstanding-issues.md
• scripts/check-github-action-pins.mjs
• scripts/check-outstanding-issues.mjs
• scripts/ci-change-scope.mjs
• tests/ui-smoke.spec.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 763846f938

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".