docs(issues): archive #028 after production Sentry enablement

docs/outstanding-issues.md

@@ -115,7 +115,6 @@ removed after current-main verification; it is not missing recommended work.
 | #024 | P2 | issue | WebKit e2e `_rsc` prefetch access-control errors | PR #1205 narrowed catch-all interception and duplicate navigation, but Next 16.2.11 still raises `_rsc` access-control `pageerror`s after document-source fallbacks: `/documents/source?id=<demo-id>&page=2&chunk=safety%20plan` → `/documents/<demo-id>?page=2&chunk=safety+plan`; `/documents/source/evidence?id=not-a-uuid&page=2` → `/documents/search`. The invalid-id failure survived removing every Playwright route; Chromium passed both. **Next:** on a provider-free macOS host, run both URLs in stable Safari and Safari Technology Preview without interception, capture console text plus `_rsc` status/access-control headers, and compare Playwright WebKit with routing on/off. Treat as an app defect only if native Safari reproduces; otherwise return to the harness. Never suppress `pageerror` or change CORS without native evidence. | PRs #1179/#1205; current-main local WebKit evidence; session 2026-07-28 | 2026-07-28 |
 | #025 | P2 | task | Activate the three webhooks (operator secrets) | Merged (#968/#1100) + deployed but inert — verified live: `POST /api/webhooks/railway` returns `503 webhook_not_configured`; the Supabase document-change trigger exists but lacks both activation inputs. To turn on: (1) Railway ΓåÆ set `RAILWAY_WEBHOOK_SECRET` + add the `?token=…` webhook URL; (2) set `SLACK_WEBHOOK_URL`/`DISCORD_WEBHOOK_URL` in BOTH the Railway **app/server env** and **GitHub repo secrets**; (3) set one matching document-change secret in the Railway app env as `SUPABASE_INGESTION_WEBHOOK_SECRET` and in Supabase Vault as `ingestion_webhook_secret`, then set the per-environment database GUC `app.ingestion_webhook_base_url` to the deployed app origin. Each path fails closed until fully configured, so this is pure ops. See `docs/webhooks.md` for verification and rotation. | sessions 2026-07-22/24; PRs #968/#1100; docs/webhooks.md | 2026-07-22 |
 | #027 | P3 | rec | External uptime monitor independent of GitHub/Railway | `live-domain-monitor.yml` runs on GitHub's cron, so it won't run in exactly the outage it should catch (Actions or the deploy itself down). Add an off-platform synthetic monitor (UptimeRobot / Better Stack / Checkly) hitting `/api/health` with a webhook alert. Provider setup, not code. | session 2026-07-22 webhook review | 2026-07-22 |
-| #028 | P3 | rec | Runtime error tracking (Sentry or similar) | No error tracking in the repo — production exceptions on `psychiatry.tools`, including how often `RAG_PROVIDER_MODE=auto` silently degrades to source-only, are invisible. Weigh adding `@sentry/nextjs` (dependency + DSN secret + instrumentation) vs cost; alert ΓåÆ chat/issue. Provider-backed; needs explicit sign-off before adding the dependency. | session 2026-07-22 webhook review | 2026-07-22 |
 | #033 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same "unknown Γëá bad" hazard as #032 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 |
 | #035 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 |
 | #036 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 |
@@ -294,4 +293,5 @@ Move resolved rows here with the resolution date and a one-line outcome. Keep th
 | #140 | issue | Union-driver table duplication — duplicate of #133 | CLOSED 2026-07-30 as a duplicate, superseded by `#133` and resolved by PR #1444. This row was opened mid-session for the union-driver damage before its author noticed `#133` had already recorded the same finding — and recorded it _earlier_, with the same conclusion ("**Do not** apply a `merge=union` driver — tested 2026-07-30 and it is worse"). Keeping both would have left two open rows describing one condition, and that condition no longer exists: PR #1444 removed `merge=union` from `.gitattributes`, inverted `check:outstanding-issues` to require an unspecified `merge` attribute, and added regression tests covering `union`, `-merge` and an unparsed reading. The surviving evidence — four merges on PR #1430 each reporting success while duplicating the entire open-items table — lives in `#133`, whose still-open half is the real conflict-frequency cause: fixed-width column padding makes any one-row edit re-pad every row, so git sees the whole table as one hunk. Read `#133`, not this. | 2026-07-30 |
 | #130 | issue | Phone-chrome physical-device acceptance never run (#1396) — not pursued | CLOSED 2026-07-30 by owner decision — **not because the gate was run.** Stating that plainly so the record is not read as evidence later: `docs/phone-chrome-physical-acceptance.md` on `main` is still the blank checklist template, no PR comment attaches device evidence, and PR #1396's shared phone-chrome overlay change therefore shipped without the physical-device acceptance its own body and review thread said applied before merge (restated at least three times, including after the final fix). The owner has decided not to pursue it. Residual risk is unchanged and unmeasured: headless Chromium was explicitly stated as unable to certify Safari chrome-minimisation or cold-launch PWA paint (invariant 23), so nothing in CI covers what that checklist covers. The separately-identified missing guard — a pre-paint/cold-load hydration test comparing content position before and after hydration — was also never filed and is also not pursued. Reopen a new row if phone-chrome behaviour is reported wrong on a real device. | 2026-07-30 |
 | #103 | issue | Wide table-facts trigram index missing from `schema.sql` | Refuted and archived 2026-07-31. The terminal migration chain already drops `document_table_facts_text_trgm_idx` in `20260717010000_harden_rag_scalability_patch.sql`; `schema.sql` deliberately retains only the expression-matching narrow index, and `tests/supabase-schema.test.ts` pins both facts. No hosted inspection or index re-addition is required. Verified against origin/main before landing: the drop is present in that migration and the index name appears nowhere in schema.sql. Disposition authored in another session's worktree and landed here. | 2026-07-31 |
+| #028 | rec | Runtime error tracking (Sentry or similar) | Enabled production Sentry server error + DB tracing on Railway Database/production (SENTRY_DSN, SENTRY_ENVIRONMENT=production, SENTRY_TRACES_SAMPLE_RATE=0.1); staging app enabled with environment=staging; browser DSN/source-map tokens intentionally unset; verified production span.op:db in Sentry. | 2026-07-31 |