From 6bac6311e1642ceeb0d78896ace11f4d17ace1f7 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 31 Jul 2026 05:44:04 +0800 Subject: [PATCH 1/5] issues: capture the residual id-allocation hazard as #151 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #133 is resolved: #1444 removed merge=union and #1479 excluded the ledger from Prettier, which together fixed conflict frequency. Neither changes id allocation, which is still read-modify-write against the next-id marker, so concurrent branches still claim the same number. Measured on PR #1451: one row was renumbered #135 -> #141 -> #145 -> #147 -> #149 across four sync cycles. The sharper finding is that GitHub's Update-branch button resolved one such collision into duplicate #141 rows with the marker left below main's highest id — git reported success and only check:outstanding-issues caught it. Co-Authored-By: Claude Opus 5 --- docs/outstanding-issues.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index af446e8d15..ece45f5246 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -83,7 +83,7 @@ removed after current-main verification; it is not missing recommended work. | 34 | `#105` | Optional | High — browser/UI verification | When a driven-browser session is available | 30–60 minutes | Decide how the ten `LoadingPanel` fallbacks can be observed at all, then verify or re-scope. A cold-load grep cannot see them — every lazy surface mounts behind interaction state, so nothing renders them on first paint — and a claimed cold-load verification was withdrawn 2026-07-30 after it turned out to be matching `ModeHomePageSkeleton`. Either drive the interaction in a browser and assert the surface's specific label, or record that they are unobservable on cold load. The preconnect half is already verified; do not redo it. **Stop:** do not close this on a cold-load grep. | | 35 | `#126` | Optional | Standard — repository hygiene | Once per UTC calendar quarter, or when the live ledger grows large | 5–15 minutes | Run `npm run ledger:rotate -- --dry-run`, then `npm run ledger:rotate` if the preview looks right; commit the live+archive diff. Stop if dry-run shows unexpected mass moves or archive path collisions. | - + ## Open items @@ -149,6 +149,7 @@ removed after current-main verification; it is not missing recommended work. | #147 | P2 | rec | Mobile CLS breaches four routes, and it reproduces exactly offline | **Outcome:** mobile CLS is under 0.1 on every measured route, or each remaining breach has a recorded reason. **Measured 2026-07-30 with the LOCAL OFFLINE production harness** (`CHROME_PATH=/opt/pw-browsers/chromium npm run verify:lighthouse -- --keep`; Lighthouse 12.8.2, Chromium 141.0.7390.37, demo corpus, inert loopback Supabase). Mobile CLS: `/dsm` 0.363, `/documents/search` 0.220, `/therapy-compass` 0.142, `/` 0.023 — `/forms` did not measure locally (Lighthouse `NO_NAVSTART`, its own "run again" transient), but the live dispatch put it at 0.212. Desktop passes everywhere: 0.016–0.097. **The finding that matters is that these reproduce the live production dispatch EXACTLY.** Against run `30548662649` on `psychiatry.tools`, all four locally measurable mobile routes match to three decimals — 0.023 / 0.142 / 0.220 / 0.363 on both — and the desktop range matches at both endpoints, 0.016–0.097. So CLS on these routes is deterministic layout structure, not network, latency, or production data. Three consequences: (a) the CLS half of `#017` is debuggable and gate-able locally at zero provider cost; (b) `#017`'s recorded blocker "prod server hard-requires Supabase secrets" is stale — `scripts/run-lighthouse-budget.mjs` builds and serves an offline production app precisely to sidestep that, and its earlier note that dev-mode CLS looked "excellent at 0.00–0.04" was measuring DEV, which does not reproduce production; (c) re-dispatching the live workflow to re-measure CLS buys nothing. **LCP does NOT reproduce and must not be read from local runs:** local mobile LCP is 2014–2051 ms against 3639–4716 ms live, because the loopback server has no network latency. The LCP _ranking_ does survive — `/therapy-compass` is the outlier both locally (4978 ms, ~2.4x every other route) and live — which corroborates `#117` rather than replacing it. Mobile TBT, local: `/documents/search` 581 ms, `/dsm` 448, `/therapy-compass` 379, `/` 338. **Ranking by measured contribution, which is what `#017` asked for:** 1. `/dsm` CLS 0.363 (3.6x the threshold, the worst single number anywhere); 2. `/documents/search` 0.220; 3. `/forms` 0.212 (live only); 4. `/therapy-compass` 0.142, and separately the sole LCP outlier via `#117`; 5. `/` 0.023, which passes and needs nothing. **Next:** attribute the shifts to elements. Lighthouse's `layout-shift-elements` audit returned **zero items on every route** — the `cumulative-layout-shift` audit carries only `debugdata` — so attribution needs a driven Chromium session with a `PerformanceObserver` on `layout-shift`, reading `entry.sources[].node` and `entry.value`, against the same offline production build. Start with `/dsm`. **Gate — `#118` owns it, and this row supplies a constraint it was missing.** `#118` already tracks flipping `lighthouse-budget.json` to `enforce: true` and says not to do it "before `#117` or the baseline pins a known-slow route". These numbers make that concrete: pinning a baseline today would bake CLS 0.363 on `/dsm` in as the accepted value, so the CLS fixes must land first or the gate ratifies the breach. Separately, no baseline could have been committed from this run anyway — the grader correctly refused it as incomplete evidence because `/forms` produced no report, and that refusal was not overridden. **Reproduction trap:** without `CHROME_PATH`, `chrome-launcher` cannot find a browser in this container and every route fails; the harness reads `CHROME_PATH`/`PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH` (`run-lighthouse-budget.mjs:291`) but nothing sets either, even though `PLAYWRIGHT_BROWSERS_PATH` is set. Related to `#121`. Also seen: a truncated `progress` package in the npx cache broke Lighthouse startup entirely; clearing the npx cache entry fixed it. **Stop:** do not re-dispatch the live Web-Vitals workflow to re-measure CLS — it is reproducible offline for free. Do not commit a budget baseline from a run with a failed route. Do not treat local LCP numbers as production LCP. | `#017` live run `30548662649`; local `verify:lighthouse` 2026-07-30; `lighthouse-budget.json` | 2026-07-30 | | #149 | P2 | issue | `check:installed-lock-parity` only compares seven top-level packages, so transitive drift passes | **Outcome:** a session cannot run local gates against a `node_modules` that silently disagrees with the lockfile. **Evidence 2026-07-30:** the `SessionStart` hook reported "node_modules matches the lockfile, skipping install" while `brace-expansion` was installed at **1.1.16** and the lockfile pinned **1.1.18** — the CVE-2026-14257 patch. Every local gate run in that window was weaker than it appeared, including several `verify:cheap` runs reported as green during PR #1430/#1444 work. It surfaced only because `tests/installed-lock-parity.test.ts` asserts the patched behaviour directly (`maxLength` honoured); its failure was initially mistaken for a pre-existing repo defect, since it also failed on clean `main` **in the same stale container**. `npm ci --include=dev` fixed it. **CORRECTION 2026-07-30 (PR #1496 review, Codex):** an earlier version of this row said the parity check lives only in `verify:ui` and proposed adding it to `verify:cheap`. **Both were wrong** — `verify:cheap:internal` already runs `check:installed-lock-parity`, so that follow-up was a no-op, and it ran green throughout the stale window. The real gap is its **scope**: `scripts/check-installed-lock-parity.mjs` compares only seven top-level packages (`criticalInstalledPackages` = next, react, react-dom, eslint, playwright, typescript, vitest), so a stale **transitive** dependency is invisible to it. Proved by faking `node_modules/brace-expansion` back to `1.1.16` against the `1.1.18` lockfile pin: `npm run check:installed-lock-parity` **exits 0**. That also explains why the hook and the gate both reported parity while the tree was stale — neither was looking at the package that drifted. **Next:** broaden the check beyond the seven names — validate the full installed tree against the lockfile, or stamp the install with the lockfile hash and compare that — so transitive drift is caught rather than assumed absent. **Stop:** do not treat a green `check:installed-lock-parity` as proof the install is lockfile-current; today it means seven packages match. | `scripts/check-installed-lock-parity.mjs`; `tests/installed-lock-parity.test.ts`; `package.json` | 2026-07-30 | | #150 | P2 | issue | CodeRabbit reviewed none of a full day's PRs; spending cap reached | **Outcome:** the repo's second automated reviewer is either funded or acknowledged as absent, rather than appearing to review while skipping. **Evidence 2026-07-30:** CodeRabbit posted "Review limit reached … Your organization has reached its usage spending cap" on **every** PR opened that day — #1404, #1430, #1444, #1445, #1479 — reviewing none of them. Each notice renders as an ordinary bot comment, so a skimming reader sees reviewer activity where there was no review. The Codex connector was the sole substantive reviewer across those PRs and found three real defects that had survived local gates and self-review: a proxy-variable inference in #1430, an `unset` vs `unspecified` git-attribute conflation in #1444, and an earlier P1 recursive-delete on an unvalidated `--dir`. **Next:** decide whether to raise the cap, switch to label-based opt-in so the budget lands on PRs that need it, or accept single-reviewer coverage explicitly. **Stop:** do not read a CodeRabbit comment as a completed review without checking it is not a rate-limit notice. | PRs #1404/#1430/#1444/#1445/#1479; `.coderabbit.yaml` | 2026-07-30 | +| #151 | P3 | issue | Outstanding-issues ids are still allocated read-modify-write, and Update-branch corrupts the merge | **Outcome:** two branches cannot silently claim the same outstanding-issues id, and no merge path can commit a file where they have. **Detail:** `#133` fixed the two causes of *conflict frequency* — `#1444` removed `merge=union` and `#1479` excluded the ledger from Prettier so a maximum-width row stops re-padding the whole table. Neither touches **id allocation**, which is still read-modify-write against the `issues:next-id` marker, so two branches open at the same time still pick the same number. Measured on PR #1451 (2026-07-30): one P3 row was renumbered `#135` -> `#141` -> `#145` -> `#147` -> `#149` across four sync cycles, because `main` had taken each id in turn — every renumber was manual. The sharper finding is the resolution path: the GitHub **Update branch** button pushed a sync to that PR head (`df3f3aeed`) whose auto-merge produced **two rows numbered `#141` and two `next-id` markers**, leaving the marker at `142` — below `main`'s highest id, so the next allocation would have reused a live number. `git merge` reported success; only `npm run check:outstanding-issues` caught it. That guard runs in `verify:cheap` and `static-pr`, so such a head cannot merge — but the corruption is produced by a one-click path that runs no guard, and the cost lands on whoever notices. A second session on the same branch later dropped an entire appended evidence block while resolving this file, which the guard cannot detect at all: it validates ids and structure, not whether a merge kept both sides' prose. **Next:** cheapest first — document that Update branch must not be used on PRs touching this file (prefer `npm run sync:pr-branches:apply`, which the repo already prefers for other reasons), then consider allocating ids from a source that cannot collide (per-row files, or a date-plus-slug id) so concurrent branches never contend. **Stop:** do not reintroduce a merge driver here — `#133` settled that; this is about allocation and about merges that silently drop rows, not about the driver. | PR #1451 sync cycles; `df3f3aeed`; session 2026-07-30 | 2026-07-31 | ## Resolved / archive From ce410e44ed62401d5255142f69c0e8f3d9e1e893 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 31 Jul 2026 05:50:01 +0800 Subject: [PATCH 2/5] docs(ledger): record the #151 capture review for PR #1506 Co-Authored-By: Claude Opus 5 --- docs/branch-review-ledger.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index 0609495363..eeabb70c5c 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -274,3 +274,4 @@ Records before 2026-07-28 were written by hand and had drifted: 146 lines carrie | 2026-07-30 | codex/coverage-scope-policy | 4da2a003bc2254507662d1b8b6e9768e94371abd | issue 139 coverage scope policy post-sync | approved: late main sync preserves deliberate workflow coverage and static-only skill policy | check:ci-scope; check:outstanding-issues; check:branch-review-ledger; diff check | | 2026-07-30 | codex/archive-completed-ci-tasks | 5c902f422ceee78ef68132900fda734c1d5bc1f8 | archive issues 133 and 135 | approved: both rows were already resolved on current main and focused guards prove their contracts | check:ci-scope; check:outstanding-issues; check:branch-review-ledger; diff check | | 2026-07-30 | codex/next-local-task | 3e6d6d69c15fc056773657e15879ba2283fa2899 | archive issues 129 and 132 | approved: documented constraints satisfy both explicit outcomes without overstating client-side enforcement | guard:push:self-test; focused vitest 24/24; check:github-actions; check:outstanding-issues; diff check | +| 2026-07-30 | claude/issues-133-evidence | 6bac6311e1642ceeb0d78896ace11f4d17ace1f7 | docs/outstanding-issues.md: open #151 (residual id-allocation hazard after #133's resolution) | Recorded. #133 resolved conflict frequency (#1444 driver, #1479 Prettier exclusion) but not read-modify-write id allocation; PR #1451 renumbered one row five times, and GitHub Update-branch produced duplicate #141 rows with a stale marker. PR #1506 | check:outstanding-issues exit 0 (149 rows, 51 open, 98 archived, unique ids, next-id=152, no ids deleted from base); pre-push Prettier guard passed on pushed commit, not bypassed; file is .prettierignore-excluded per #1479 | From edbb23a25e8fe24cb4215eab7b8d0e274393d8a2 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 31 Jul 2026 08:03:51 +0800 Subject: [PATCH 3/5] docs(ledger): supersede the #1506 record after re-landing on the synced head Co-Authored-By: Claude Opus 5 --- docs/branch-review-ledger.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index b1b59d6c37..78f4b88f2b 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -327,3 +327,4 @@ Records before 2026-07-28 were written by hand and had drifted: 146 lines carrie | 2026-07-30 | codex/computed-style-assertions | 1f431caa8d80660b8f6d90f557e4b8ea5d82560c | post-sync archive completed rendered-style contract task #094 | APPROVED — no findings after exact current-main sync; archive move and prior review record only. | check:outstanding-issues PASS (151 rows; 44 open, 107 archived); branch-review-ledger PASS (254 live, 1206 archived); git diff --check PASS; merge-tree 9ab802e9ec73132e4a7231b9060bf95be090b9d2 | | 2026-07-30 | codex/computed-style-assertions | a8ee3315f2c9959025b7d652c0b7ea45432ca6be | post-#121 sync archive rendered-style task #094 | APPROVED — no findings; #121 main merge preserved and #094 remains the only issue-state change. | outstanding-issues PASS (151 rows; 43 open, 108 archived); branch-review-ledger PASS (261 live, 1206 archived); diff check PASS; merge-tree 2c567bcbb60f5d3f36eb18b6f7d7f6ee2a7a788b | | 2026-07-30 | codex/computed-style-assertions | a18085a15339f280fff76cad15fafcf1a80084fe | post-#1490 sync archive rendered-style task #094 | APPROVED — no findings; current-main issue additions are preserved and #094 is the sole state change. | outstanding-issues PASS (151 rows; 43 open, 108 archived); branch-review-ledger PASS (271 live, 1206 archived); diff check PASS; merge-tree ab18c4319fcca6c915d340bdea286481caa8ea43 | +| 2026-07-31 | claude/issues-133-evidence | 5bb1bc8d8b1d3ba8aebdce5c348887c596f6b8e6 | docs/outstanding-issues.md: re-land #154 (id-allocation hazard) and #155 (--med-accent-soft) after PR #1506 closed unmerged | Recorded. Branch synced to origin/main; main had since taken #151 so the hazard row moved to #154 and --med-accent-soft landed as #155 (its fifth renumber) - both self-demonstrating the row's own claim. PR #1506 to be reopened by the user. | check:outstanding-issues exit 0 (153 rows, 45 open, 108 archived, unique ids, next-id=156, no ids deleted from base); verified zero origin/main ids lost after taking main's table as canonical; pre-push guard passed on pushed commit | From 56e4c0f0d625305b83d3dfe1d298b5426e470593 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Fri, 31 Jul 2026 00:15:13 +0000 Subject: [PATCH 4/5] docs(ledger): record PR #1506 reopen-prep review after main sync Supersedes the prior #1506 ledger rows for this branch head. Co-authored-by: BigSimmo --- docs/branch-review-ledger.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index 39d7df1e3a..df6b7fc1da 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -331,3 +331,4 @@ Records before 2026-07-28 were written by hand and had drifted: 146 lines carrie | 2026-07-31 | claude/root-dir-coverage-gate-v2 | 398660144d93aeefc2e5649c156948a68925cb64 | docs:check-index repo-root coverage, stale script counts, ledger correction | MERGED as PR #1458 (squash 907fd9f4a). Root-directory coverage pass for docs:check-index, red-then-green proven (flagged .cursor/.design-sync/.vscode, then 49 entries vs 31). Main landed an equivalent pass independently in #1480, so the two overlapped; no duplication reached main. Row not recorded at the time - appended retrospectively | verify:cheap exit 0, 435 test files / 4574 tests pass; codebase-index-coverage 10/10 incl 4 new root cases; eslint clean; docs gates green; prettier clean | | 2026-07-31 | claude/pre-commit-fail-open | 7b96a09b8500adc917cf5549b1c61142b2244b39 | pre-commit hook fail-open when the inventory script is absent | MERGED as PR #1494 (squash 387c3b653). Resolves ledger #153: core.hooksPath is absolute to the primary checkout, so the hook ran in worktrees lacking scripts/update-docs-inventory.mjs and aborted with MODULE_NOT_FOUND. Guard drops the inventory task and re-checks the all-tasks-empty exit; grep carries \|\| true because set -e treats a fully-filtering grep as failure | isolated-repo probe with the script genuinely absent: prints skipping inventory sync, commit succeeds; sh -n clean; no-op when the script is present; prettier does not parse shell so format:check skips it | | 2026-07-31 | claude/ledger-relanding | 30ec06964e4235d9f0b4bb782f357e6b4fb59430 | re-land the three session findings lost when PR #1490 was closed | MERGED as PR #1508 (squash 7b551abc4). Ledger-only: #151 corrects the claim that CI is unreadable (PAT has Actions:read though not Checks:read), #152 re-lands the at-risk worktree inventory with the four preservation snapshots, #153 archives the hook fix. Verified landed by content on main, not by PR state or row id | CI, PR Policy, PR mergeability, SAST, Secret Scan all completed/success via the Actions API; check:outstanding-issues 151 rows 45 open unique ids next-id=154; docs:check-links 1414 refs; prettier clean | +| 2026-07-31 | claude/issues-133-evidence | 37f71f02f731175e4fed500f95529c3ef9eb568f | PR #1506 reopen prep: sync main, renumber hazard to #155, supersede #112 residual | READY — conflict cleared vs origin/main; main #154 preserved; hazard=#155 with archived #112 residual cross-link; med-accent=#156; false #155 evidence clause removed; Codex P2 addressed; Bugbot P1/P2 fixed; PR left CLOSED | check:outstanding-issues 154 rows/46 open next-id=157; check:branch-review-ledger 277 live; merge-tree clean da0c63d0; format no-op | From d4adcb6bb80b4efe3785b13701e8e12e11282c6e Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 31 Jul 2026 08:20:34 +0800 Subject: [PATCH 5/5] issues: track the two mockup hover tokens #141 left undefined as #156 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #141 closed on the production defect, but --primary-hover and --success-hover are still undefined on main (referenced at favourites-library-redesign-page.tsx :203 and :217, zero definitions in the stylesheet). Impact is low — mockups are gate-exempt design scratch — but with #141 archived nothing in the ledger owned them, and .design-sync/NOTES.md is prose in a tooling file, not a tracked item. Co-Authored-By: Claude Opus 5 --- docs/outstanding-issues.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index 62a41ad36c..5cd4a6875c 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -83,7 +83,7 @@ removed after current-main verification; it is not missing recommended work. | 34 | `#105` | Optional | High — browser/UI verification | When a driven-browser session is available | 30–60 minutes | Decide how the ten `LoadingPanel` fallbacks can be observed at all, then verify or re-scope. A cold-load grep cannot see them — every lazy surface mounts behind interaction state, so nothing renders them on first paint — and a claimed cold-load verification was withdrawn 2026-07-30 after it turned out to be matching `ModeHomePageSkeleton`. Either drive the interaction in a browser and assert the surface's specific label, or record that they are unobservable on cold load. The preconnect half is already verified; do not redo it. **Stop:** do not close this on a cold-load grep. | | 35 | `#126` | Optional | Standard — repository hygiene | Once per UTC calendar quarter, or when the live ledger grows large | 5–15 minutes | Run `npm run ledger:rotate -- --dry-run`, then `npm run ledger:rotate` if the preview looks right; commit the live+archive diff. Stop if dry-run shows unexpected mass moves or archive path collisions. | - + ## Open items @@ -144,6 +144,7 @@ removed after current-main verification; it is not missing recommended work. | #152 | P2 | issue | Uncommitted work sits in worktrees whose branches are already merged | **Outcome:** work that exists in no branch and no PR is either committed or knowingly discarded, not lost to a disk reclaim. **Inventory 2026-07-30**, all from worktrees whose pre-snapshot branch tips were fully merged into `origin/main`, so the uncommitted changes existed nowhere else: `codex/reconcile-immediate-20260730` — 21 files, +395/-200 across 19 tracked, including `.github/workflows/ci.yml`, `package.json` and `docs/scripts-index.md`; `codex/document-results-mockup-20260730` — 8 files (+13/-3 tracked) plus an untracked `document-search-results/page.tsx` under `src/app/mockups/` (named without a full path here because it does not resolve in this repo); `codex/chat-ledger-triage-d344` — `docs/outstanding-issues.md` +59/-61; `claude/section-spy-browser-coverage` — `tests/ui-smoke.spec.ts` +51. A fifth (`claude/frosty-mayer-2c6167`) self-resolved to clean during the session. **Preserved 2026-07-30, not reviewed:** each was committed on its own branch as an unpushed `wip: preserve uncommitted work before worktree cleanup` snapshot, so the work now survives a worktree reclaim — `codex/reconcile-immediate-20260730` `748ef018f`, `codex/document-results-mockup-20260730` `5dbd9f965`, `codex/chat-ledger-triage-d344` `b7eae51a4`, `claude/section-spy-browser-coverage` `d949859c3`. All four worktrees are now clean. None is pushed and none is reviewed or verified; the snapshots exist to stop silent loss, not to endorse the content. First captured in PR #1490, which was closed unmerged; re-landed on `main` by PR #1508. **Next:** per snapshot, review and either promote it to a real branch/PR or `git reset --hard HEAD~1` to drop it. Do not bulk-delete worktrees without this check — it is why only one of the two "safe" candidates was removed in the 2026-07-30 cleanup. | session 2026-07-30 worktree cleanup; PR #1490 (closed); PR #1508 | 2026-07-30 | | #154 | P3 | issue | Outstanding-issues ids are still allocated read-modify-write, and Update-branch corrupts the merge | **Outcome:** two branches cannot silently claim the same outstanding-issues id, and no merge path can commit a file where they have. **Detail:** `#133` fixed the two causes of *conflict frequency* — `#1444` removed `merge=union` and `#1479` excluded the ledger from Prettier so a maximum-width row stops re-padding the whole table. Neither touches **id allocation**, which is still read-modify-write against the `issues:next-id` marker, so two branches open at the same time still pick the same number. Measured on PR #1451 (2026-07-30): one P3 row was renumbered `#135` -> `#141` -> `#145` -> `#147` -> `#149` across four sync cycles, because `main` had taken each id in turn — every renumber was manual. It collided a fifth time when it was re-landed as `#155` below, and this row itself was first written as `#151` and had to move to `#154` for the same reason. Both of those happened *after* `#133` was closed, which is the point: the fixes in `#1444` and `#1479` were real, but they were fixes to conflict frequency, and allocation was never the same problem. The sharper finding is the resolution path: the GitHub **Update branch** button pushed a sync to that PR head (`df3f3aeed`) whose auto-merge produced **two rows numbered `#141` and two `next-id` markers**, leaving the marker at `142` — below `main`'s highest id, so the next allocation would have reused a live number. `git merge` reported success; only `npm run check:outstanding-issues` caught it. That guard runs in `verify:cheap` and `static-pr`, so such a head cannot merge — but the corruption is produced by a one-click path that runs no guard, and the cost lands on whoever notices. A second session on the same branch later dropped an entire appended evidence block while resolving this file, which the guard cannot detect at all: it validates ids and structure, not whether a merge kept both sides' prose. **Next:** cheapest first — document that Update branch must not be used on PRs touching this file (prefer `npm run sync:pr-branches:apply`, which the repo already prefers for other reasons), then consider allocating ids from a source that cannot collide (per-row files, or a date-plus-slug id) so concurrent branches never contend. **Stop:** do not reintroduce a merge driver here — `#133` settled that; this is about allocation and about merges that silently drop rows, not about the driver. | PR #1451 sync cycles; `df3f3aeed`; session 2026-07-30 | 2026-07-31 | | #155 | P3 | issue | `--med-accent-soft` is dead plumbing | **Outcome:** the medication accent trio has no unused member, or its presence is deliberate and recorded. **Detail:** `medicationAccentStyle()` at `src/components/clinical-dashboard/medication-record-page.tsx:92` sets `--med-accent-soft` via `color-mix`, but nothing in the repo reads it — `--med-accent` and `--med-accent-border` are both consumed (lines 396/398/407/447). Found while triaging the design-sync `[TOKENS_MISSING]` report that produced `#141`; left in place rather than deleted because it plausibly mirrors the `--clinical-accent-soft` idiom at line 82 as deliberate headroom, and the comment block at lines 84-87 documents the trio as a contract. Verified 2026-07-30 by computed style that the other two members do render: all four consuming sites paint `rgb(225,29,72)` on `/medications/acamprosate` in light and dark. **Next:** either consume it for the section wash or drop the declaration — a two-line change either way. **Stop:** do not delete it as a drive-by inside an unrelated change; confirm the intent first, since the documented contract is the reason it survived the `#141` pass. | Design-sync `[TOKENS_MISSING]` triage, session 2026-07-30 | 2026-07-31 | +| #156 | P3 | issue | Two mockup hover tokens are still undefined after `#141` closed | **Outcome:** every `var(--token)` in the repo either resolves or is knowingly exempt, with no unowned exceptions. **Detail:** `#141` closed on the production defect (`--clinical-accent-strong`, now defined in `globals.css` for light, dark and forced-colors), but two of the three genuinely-undefined references it listed are still undefined on `main`: `--primary-hover` and `--success-hover`, referenced at `src/components/favourites-page-mockups/favourites-library-redesign-page.tsx:203` and `:217`, with zero `--name:` definitions anywhere in the stylesheet. Confirmed against `origin/main` on 2026-07-31. Both declarations are therefore dropped at CSS parse time and those hover states silently do nothing. Impact is genuinely low — `*-mockups` is design scratch, 404s in production, and is exempt from the wiring and reachability gates — and `.design-sync/NOTES.md` already calls them lowest priority. This row exists because that note is prose in a tooling file, not a tracked item: with `#141` archived, nothing in this ledger owned them. **Next:** two-line fix when someone is next in that file — `--primary-hover` maps cleanly to `--primary-strong` (the existing `bg-[color:var(--primary)]` + `hover:bg-[color:var(--primary-strong)]` pattern in `badge.tsx:14`); `--success-hover` has no token to map to, since the success triad is text/bg/border with no darker step, so use a utility such as `hover:brightness-110` rather than inventing `--success-strong` for scratch. **Stop:** do not add a `--success-strong` token to `@theme` solely for a mockup, and do not treat this as production-urgent — it is a tidy-up, not a defect users can reach. | `#141` residue; verified against `origin/main` 2026-07-31 | 2026-07-31 | ## Resolved / archive