docs(issues): correct #210 — the prescribed fix would be reverted by Next

[BigSimmo]

Summary

• docs — #210 corrected. The 2026-08-12 re-scope on this row was itself half wrong, and the fix it prescribed would have been silently reverted by Next — so the row as written would have sent the next agent into a no-op diff that reads as churn. Two corrections, both re-verified against a freshly installed, parity-clean tree:
  • The typecheck half is already fixed, and was fixed before that re-scope was written. npm run typecheck runs tsc -p tsconfig.typecheck.json (package.json:38-39), and that config excludes .next/** outright. tsconfig.typecheck.json's own header comment cites #210 by number as the reason it exists. The row's claim that npm run ensure breaks repo-wide npm run typecheck is false.
  • The prescribed fix does not hold. Dropping .next/dev/types/**/*.ts from tsconfig.json's include comes straight back: Next 16 emits that glob deliberately (node_modules/next/dist/lib/typescript/type-paths.js:34-36, "to avoid tsconfig churn when switching between dev/build modes") and writeConfigurationDefaults.js:305-315 pushes any missing type glob back into an existing include on every next dev / next build.
  • What genuinely remains is narrower, and explicitly unproven. scripts/run-playwright.mjs:253-268 writes an isolated tsconfig that sets only extends: "../../tsconfig.json" plus compilerOptions, so it inherits the root include globs including the dev-types one; Next's own dev-types filter (getDevTypesPath, called only from runTypeCheck.js:37) is not reached because experimental.useTypeScriptCli defaults true (config-shared.js:257) and next build therefore shells to the TypeScript CLI. Nobody has reproduced the Playwright build failure since tsconfig.typecheck.json landed, so the row now records this as not proven end-to-end and says reproduce before changing anything.
• Provenance. PR fix(hooks): unblock verify:pr-local in web sessions; answer #248 offline half and correct #210 #1880 reached both corrections independently on 2026-08-12, but its diff touched only .claude/hooks/session-start.sh and docs/database-drift-detection.md — it never edited the ledger. The correction existed solely in that PR body, where nothing reads it, while the canonical row kept directing the opposite change. This PR moves it into the ledger.
• Queued as an inbox request, not a direct ledger edit. A first attempt edited docs/outstanding-issues.md directly and was correctly refused by the pre-push ledger-write guard; that commit was dropped and re-queued through npm run issues:update, which writes an immutable merge-safe request under docs/outstanding-issues-inbox/. Apply with npm run issues:reconcile from a fresh ledger branch after this lands.

Verification

• npm run verify:pr-local

PR-local verification summary:
- completed: check:runtime, check:installed-lock-parity, format:changed, sitemap:check,
  docs:check-index, docs:check-inventory, docs:check-scripts, docs:check-links,
  check:branch-review-ledger, check:outstanding-issues, check:ledger-write-discipline
- failed: (none)
- not reached: (none)

Skipping build: no build-affecting source, config, package, or container changes detected.

Ledger inbox check passed: 15 pending request(s), 0 applied.
Ledger write discipline passed for 2d270392f9cf..HEAD.

check:installed-lock-parity failed on the first gate run after this branch was cut from a main that had moved 591 commits (installed file inventory differs from the trusted post-install stamp). Fixed with npm ci --include=dev, never by re-stamping — and every claim quoted above was then re-read from the reinstalled tree, since the original reads came from a tree that had just failed parity. next 16.3.0; all three cited line numbers hold unchanged.

UI verification not run: no UI, routing, styling, or browser-behaviour change in this diff.

Risk and rollout

• Risk: Low. One added JSON request file under docs/outstanding-issues-inbox/. No application source, no dependency, no schema, no workflow, and the canonical ledger is untouched until a separate reconcile step applies it.
• Rollback: git revert the single commit, or delete the request file before reconciliation.
• Provider or production effects: None. Every finding was derived from committed files plus the locally installed next package; nothing reads or mutates Supabase, OpenAI, Railway or hosted CI.

Notes

• No ## Clinical Governance Preflight section: classifyPullRequestFiles returns clinicalRisk: false, operationalRisk: false, ragRanking: false, ui: false for a single docs/outstanding-issues-inbox/** path, and the diff touches no ingestion, answer-generation, ranking, source-rendering, document-access or privacy surface.
• Not bundled with anything: this is one request file, and the bundling rule's best candidate — same-scope low-risk docs work — has nothing else queued on this branch.

---

Generated by Claude Code

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 52 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 6739aebc-f7e6-48cf-aad9-f50bf6cd7425

📥 Commits

Reviewing files that changed from the base of the PR and between 3086cf1 and 630d66e.

📒 Files selected for processing (3)

• docs/branch-review-records/f8f72a6790fd157daa749c3601ca7af0b3eb1f338a69e0994874dbba42906eb2.record.md
• docs/outstanding-issues-inbox/04470779-8c8d-4c90-ad04-bc6d613fd73a.json
• docs/outstanding-issues-inbox/9fded706-51d9-4d8f-9aa4-c57a6b0ac7aa.json

---

_{Comment @coderabbitai help to get the list of available commands.}

[BigSimmo]

Codex final review summary

Final head: f7054d2ed7ee61b66be173360105f5625b609f4a
Latest base: main at 984f42c07326d7561ebb3d992a8024173c02aaaa
State: open, mergeable, 2 commits ahead / 3 behind. Auto-merge was not changed.

Merge and sync

No base sync was performed. The branch is behind but clean, and there is no merge or required-CI blocker that justifies restarting green CI. The exact-head PR mergeability check recomputed against 984f42c and passed with mergeable: true, mergeable_state: behind. Latest-base changes use distinct paths, and the newly added inbox requests on main do not target #210, so the merged request set has no duplicate-target reconciliation conflict.

The cached refs/pull/1929/merge ref is stale and was not used as the current-base verdict. A literal local git merge-tree was unavailable because this runtime had no materialised checkout; the GitHub server merge computation plus three-way path and ledger-target analysis found the merge clean.

Review result

No confirmed P0, P1 or reproducible P2 defect was found. No file edit, commit or push was warranted.

Validated independently:

• repository typecheck uses tsconfig.typecheck.json, whose include/exclude contract keeps .next/** out
• the Playwright isolated config inherits the root .next/dev/types glob
• Next.js 16.3.0 deliberately emits both type globs and restores a missing glob
• Next.js 16.3.0 defaults to the TypeScript CLI path, while the stale-dev-types filter is in the separate programmatic checker
• the remaining Playwright failure is correctly recorded as not proven end-to-end
• PR fix(hooks): unblock verify:pr-local in web sessions; answer #248 offline half and correct #210 #1880 did not change the ledger, matching the stated provenance
• the inbox JSON passes the repository request schema
• the review-record filename matches the SHA-256 of its ledger row
• the existing review record correctly references substantive commit 615893b24fa2be21e245ef1e47ae2fa1e2e12981

The underlying Playwright reproduction remains pre-existing/deferred work under #210; this PR correctly narrows the ledger entry rather than claiming a runtime fix.

Independent adversarial pass

CodeRabbit selected both files but did not complete a review because its review limit/spending cap was reached. A separate manual adversarial pass against repository contracts and upstream Next.js 16.3.0 source found no correctness, compatibility, concurrency, security, privacy or scope defect.

Threads and checks

• unresolved actionable review threads: 0
• reviews requesting changes: 0
• inbox request schema: PASS
• immutable record content address: PASS
• TypeScript include inheritance proof: PASS
• TypeScript .next/** isolation proof: PASS
• competing current-base mutation for #210: none

Exact-head hosted checks:

• repository-required aggregate PR required: success
• CI: success
• Secret Scan: success
• SAST: success
• latest-base PR mergeability: success
• failed or pending exact-head checks observed: none

Production UI, build, coverage, migration replay, Lighthouse, visual advisory and browser-matrix jobs were skipped by the docs-only scope. GitGuardian succeeded. Supabase preview was ignored as expected because there are no Supabase changes. The branch-protection endpoint was inaccessible to this integration, so protection rules could not be separately enumerated; the repository protocol identifies PR required as the required aggregate.

Limitations and residual risk

A fresh full local verify:pr-local rerun was unavailable without a checkout; exact-head hosted CI supplies the repository-wide evidence. No provider-backed, production, deployment or live-evaluation action was run. Continued hourly background monitoring is unavailable after this active run; the stop condition was reached now because mergeability is clean, required CI is green and no actionable threads remain. Residual risk is limited to the deliberately unproven Playwright reproduction and later application through issues:reconcile.

The PR was not merged. Final merge is left to the user.

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

• Static PR checks — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
• PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #10722 (success).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.