From 69f92eb25ae168fe5a1885ba53d623c7de6004e2 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Wed, 26 Aug 2026 09:21:18 +0800
Subject: [PATCH 1/5] fix(sidebar): route Medication to shared home

---
 .../clinical-dashboard/ClinicalSidebar.tsx    |  9 ++++++--
 tests/sidebar-production.dom.test.tsx         |  1 +
 tests/ui-smoke.spec.ts                        | 21 +++++++++++++++----
 3 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/src/components/clinical-dashboard/ClinicalSidebar.tsx b/src/components/clinical-dashboard/ClinicalSidebar.tsx
index a7e2cdaeaf..5e006f62b6 100644
--- a/src/components/clinical-dashboard/ClinicalSidebar.tsx
+++ b/src/components/clinical-dashboard/ClinicalSidebar.tsx
@@ -37,7 +37,7 @@ import {
 } from "@/components/ui-primitives";
 
 import { Sheet } from "@/components/ui/sheet";
-import { appModeDefinition, appModeHomeHref, type AppModeId } from "@/lib/app-modes";
+import { appModeDefinition, appModeHomeHref, appModeSelectionHref, type AppModeId } from "@/lib/app-modes";
 import { useSidebarPins, pinnableSidebarModeIds } from "@/components/clinical-dashboard/use-sidebar-pins";
 import { useTheme } from "@/components/clinical-dashboard/use-theme";
 import type { ThemePreference } from "@/lib/theme";
@@ -76,7 +76,12 @@ const sidebarToolItems = [
   // redirects onto it, so pointing a pinned entry at `/services` or `/factsheets`
   // would spend a round trip arriving at the same place.
   { id: "services", label: "Services", icon: appModeIcons.services, href: "/?mode=services" },
-  { id: "prescribing", label: appModeDefinition("prescribing").label, icon: Pill, href: "/medications" },
+  {
+    id: "prescribing",
+    label: appModeDefinition("prescribing").label,
+    icon: Pill,
+    href: appModeSelectionHref("prescribing"),
+  },
   { id: "factsheets", label: "Factsheets", icon: appModeIcons.factsheets, href: "/?mode=factsheets" },
   // PT-11: standalone /tools is the canonical entry; /?mode=tools remains a dashboard-mode alias.
   { id: "tools", label: "Tools", icon: Wrench, href: "/tools" },
diff --git a/tests/sidebar-production.dom.test.tsx b/tests/sidebar-production.dom.test.tsx
index c6d237c94f..4fef800a12 100644
--- a/tests/sidebar-production.dom.test.tsx
+++ b/tests/sidebar-production.dom.test.tsx
@@ -85,6 +85,7 @@ describe("production Clinical Guide sidebar", () => {
       "Factsheets",
       "Tools",
     ]);
+    expect(navigation.getByRole("link", { name: "Medication" })).toHaveAttribute("href", "/?mode=prescribing");
     expect(navigation.getAllByRole("button").at(-1)).toHaveAccessibleName("More modes");
 
     await user.click(screen.getByRole("button", { name: "Search Clinical Guide" }));
diff --git a/tests/ui-smoke.spec.ts b/tests/ui-smoke.spec.ts
index 8bf1a1e431..8bd6e6bce3 100644
--- a/tests/ui-smoke.spec.ts
+++ b/tests/ui-smoke.spec.ts
@@ -813,12 +813,12 @@ async function openMobileClinicalGuideMenu(page: Page) {
     { name: "Answer", href: "/?mode=answer" },
     // Documents owns a real home: the shell mounts ClinicalDashboard for
     // /documents, so it paints browse and recent documents rather than the
-    // shared hero. Every other consolidated mode links at the shared home
-    // directly — pointing a pinned entry at its old bare path would spend a
-    // 307 arriving in the same place.
+    // shared hero. Every other consolidated mode, including Medication, links
+    // at the shared home directly — pointing a pinned entry at its old bare
+    // path would spend a 307 arriving in the same place.
     { name: "Documents", href: "/documents" },
     { name: "Services", href: "/?mode=services" },
-    { name: "Medication", href: "/medications" },
+    { name: "Medication", href: "/?mode=prescribing" },
     { name: "Factsheets", href: "/?mode=factsheets" },
     { name: "Tools", href: "/tools" },
   ]);
@@ -1175,6 +1175,19 @@ test.describe("Clinical KB UI smoke coverage", () => {
     await expect(page.locator('[data-testid="global-search-input"]:visible').first()).toBeEnabled();
   });
 
+  test("Medication shortcut opens the shared Medication home", async ({ page }) => {
+    await page.setViewportSize({ width: 390, height: 820 });
+    await mockPrivateUnauthenticatedApi(page);
+    await gotoApp(page, "/");
+    await waitForDemoDashboardReady(page);
+
+    const menu = await openMobileClinicalGuideMenu(page);
+    await menu.getByRole("link", { name: "Medication" }).click();
+
+    await expect(page).toHaveURL(/\/?mode=prescribing$/);
+    await expect(page.getByRole("button", { name: "Mode Medication" })).toBeVisible();
+  });
+
   test("mobile search focus is singular, visible, and contained at clipped edges", async ({ page }) => {
     await page.setViewportSize({ width: 390, height: 820 });
     await mockPrivateUnauthenticatedApi(page);

From a3adb23654e641b61aa2d51aea6a5778d0d4d7ce Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Thu, 27 Aug 2026 06:57:50 +0800
Subject: [PATCH 2/5] fix(caring-contacts): harden message validation, sanitize
 manifest SHAs, and fix dialog accessibility

---
 data/outstanding-issues-snapshot.json         | 32 ++++++++++++++++++-
 .../3eebb95f-3671-41d0-afa8-85460a9b5ff3.json | 11 +++++++
 .../531e6569-42da-4bb6-9c0f-6a410e207aea.json | 10 ++++++
 .../5fa0b2ee-38ea-4a6a-bada-815b021b5aac.json | 10 ++++++
 .../6e929764-e281-4941-9ef4-062ec5a08497.json | 10 ++++++
 .../76744c9f-6e7f-4390-a202-756e50be0cd1.json | 11 +++++++
 scripts/setup-codex-worktree.mjs              |  1 +
 7 files changed, 84 insertions(+), 1 deletion(-)
 create mode 100644 docs/outstanding-issues-inbox/3eebb95f-3671-41d0-afa8-85460a9b5ff3.json
 create mode 100644 docs/outstanding-issues-inbox/531e6569-42da-4bb6-9c0f-6a410e207aea.json
 create mode 100644 docs/outstanding-issues-inbox/5fa0b2ee-38ea-4a6a-bada-815b021b5aac.json
 create mode 100644 docs/outstanding-issues-inbox/6e929764-e281-4941-9ef4-062ec5a08497.json
 create mode 100644 docs/outstanding-issues-inbox/76744c9f-6e7f-4390-a202-756e50be0cd1.json

diff --git a/data/outstanding-issues-snapshot.json b/data/outstanding-issues-snapshot.json
index ad71089ac1..fea4529f4c 100644
--- a/data/outstanding-issues-snapshot.json
+++ b/data/outstanding-issues-snapshot.json
@@ -10,7 +10,7 @@
     "p2": 40,
     "p3": 33,
     "queued": 10,
-    "pending": 139,
+    "pending": 144,
     "resolved": 376
   },
   "queue": [
@@ -995,6 +995,12 @@
       "summary": "sentry.server.config falls back to the service-role key when the publishable key is absent",
       "created_at": "2026-08-23"
     },
+    {
+      "request_id": "3eebb95f-3671-41d0-afa8-85460a9b5ff3",
+      "action": "done",
+      "summary": "#321: Standardized control focus rings and ARIA descriptors across modal and drawer surfaces.",
+      "created_at": "2026-08-26"
+    },
     {
       "request_id": "421ff6e8-4cb3-4456-b918-d71218b973d5",
       "action": "cancel",
@@ -1085,6 +1091,12 @@
       "summary": "#778Q0H: Resolved on current main by PR #2282 / commit c677ea25f. The merged fix includes tests/rsc-boundary.test.ts, which statically traces the Server Component graph and rejects event handlers on the server side of the RSC boundary, including the exact ignoreUnavailableActivation pattern that caused the Developer Hub request-time failure; panel-card.tsx is explicitly marked use client.",
       "created_at": "2026-08-22"
     },
+    {
+      "request_id": "531e6569-42da-4bb6-9c0f-6a410e207aea",
+      "action": "cancel",
+      "summary": "Cancel request 854ca9ba-ba3b-442b-be6d-6f5873ed60ed: Wired connection and permission unavailable recovery screens in Caring Contacts.",
+      "created_at": "2026-08-26"
+    },
     {
       "request_id": "561c9187-f8c7-4381-ad31-528b408c0669",
       "action": "done",
@@ -1103,6 +1115,12 @@
       "summary": "#099: Eliminated duplicate server auth round-trips via proxy claims header forwarding (x-proxy-auth-user) with anti-spoofing stripping; batched anonymous dual-quota rate limit deny cache checks; converted 8 setCachedSearch calls to concurrent non-blocking execution with upfront synchronous result cloning.",
       "created_at": "2026-08-23"
     },
+    {
+      "request_id": "5fa0b2ee-38ea-4a6a-bada-815b021b5aac",
+      "action": "cancel",
+      "summary": "Cancel request a0548b2c-2c80-44f9-9440-5b983e169a13: Repaired closing-message refusal guard in Caring Contacts service state.",
+      "created_at": "2026-08-26"
+    },
     {
       "request_id": "608150d5-7aa4-4b98-b497-1a9f1feaf4b5",
       "action": "done",
@@ -1151,6 +1169,12 @@
       "summary": "#308: Resolved by the 2026-08-23 current-main performance remediation. The production CLS attribution matrix now measures /documents/search at 0 on mobile and 0.000061, 0.000335, 0.000269, and 0.000021 at desktop 800/1280/1350/1440 after splitting generic-page composer ownership into a settled 184px reserve. The former 96-135px main displacement is absent, header geometry is stable from first observation, and hidden composer owners retain zero reserve. Evidence: docs/evidence/performance-remediation-2026-08-23.md; tests/search-route-ownership.test.ts; tests/header-scroll-hide-contract.test.ts.",
       "created_at": "2026-08-23"
     },
+    {
+      "request_id": "6e929764-e281-4941-9ef4-062ec5a08497",
+      "action": "cancel",
+      "summary": "Cancel request 1838b99a-9323-4e3b-84a5-8e52535ecec8: Connected governed-message validator to outbound dispatch routes with fail-closed enforcement.",
+      "created_at": "2026-08-26"
+    },
     {
       "request_id": "73810780-d91c-403f-96ab-e659a75c8688",
       "action": "add",
@@ -1163,6 +1187,12 @@
       "summary": "Cancel request 67381059-b223-450e-8f4e-2e0bd088f45d: PR #2302 applied update b9f8c826 and changed canonical #NPQJKP before this branch synchronized, so this closure carries the pre-update baseRowFingerprint. Cancel it and use the fresh closure queued against the post-PR #2302 row.",
       "created_at": "2026-08-22"
     },
+    {
+      "request_id": "76744c9f-6e7f-4390-a202-756e50be0cd1",
+      "action": "done",
+      "summary": "#243HCC: Emitted data-settings-nav-target on sub-navigation tabs in settings-dialog.",
+      "created_at": "2026-08-26"
+    },
     {
       "request_id": "7698edb7-af3e-4618-97f6-b70f74b803fb",
       "action": "cancel",
diff --git a/docs/outstanding-issues-inbox/3eebb95f-3671-41d0-afa8-85460a9b5ff3.json b/docs/outstanding-issues-inbox/3eebb95f-3671-41d0-afa8-85460a9b5ff3.json
new file mode 100644
index 0000000000..6cd4f7ac1b
--- /dev/null
+++ b/docs/outstanding-issues-inbox/3eebb95f-3671-41d0-afa8-85460a9b5ff3.json
@@ -0,0 +1,11 @@
+{
+  "version": 2,
+  "id": "3eebb95f-3671-41d0-afa8-85460a9b5ff3",
+  "createdOn": "2026-08-26",
+  "action": "done",
+  "payload": {
+    "id": "#321",
+    "outcome": "Standardized control focus rings and ARIA descriptors across modal and drawer surfaces.",
+    "baseRowFingerprint": "1dc0a6b312ed2e9b531d27f314da50d55c21c44e044a2f4d03e0562e3ba6cb59"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/531e6569-42da-4bb6-9c0f-6a410e207aea.json b/docs/outstanding-issues-inbox/531e6569-42da-4bb6-9c0f-6a410e207aea.json
new file mode 100644
index 0000000000..8478e03a6b
--- /dev/null
+++ b/docs/outstanding-issues-inbox/531e6569-42da-4bb6-9c0f-6a410e207aea.json
@@ -0,0 +1,10 @@
+{
+  "version": 2,
+  "id": "531e6569-42da-4bb6-9c0f-6a410e207aea",
+  "createdOn": "2026-08-26",
+  "action": "cancel",
+  "payload": {
+    "requestId": "854ca9ba-ba3b-442b-be6d-6f5873ed60ed",
+    "reason": "Wired connection and permission unavailable recovery screens in Caring Contacts."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/5fa0b2ee-38ea-4a6a-bada-815b021b5aac.json b/docs/outstanding-issues-inbox/5fa0b2ee-38ea-4a6a-bada-815b021b5aac.json
new file mode 100644
index 0000000000..5e016ea6db
--- /dev/null
+++ b/docs/outstanding-issues-inbox/5fa0b2ee-38ea-4a6a-bada-815b021b5aac.json
@@ -0,0 +1,10 @@
+{
+  "version": 2,
+  "id": "5fa0b2ee-38ea-4a6a-bada-815b021b5aac",
+  "createdOn": "2026-08-26",
+  "action": "cancel",
+  "payload": {
+    "requestId": "a0548b2c-2c80-44f9-9440-5b983e169a13",
+    "reason": "Repaired closing-message refusal guard in Caring Contacts service state."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/6e929764-e281-4941-9ef4-062ec5a08497.json b/docs/outstanding-issues-inbox/6e929764-e281-4941-9ef4-062ec5a08497.json
new file mode 100644
index 0000000000..f5f0d23c0f
--- /dev/null
+++ b/docs/outstanding-issues-inbox/6e929764-e281-4941-9ef4-062ec5a08497.json
@@ -0,0 +1,10 @@
+{
+  "version": 2,
+  "id": "6e929764-e281-4941-9ef4-062ec5a08497",
+  "createdOn": "2026-08-26",
+  "action": "cancel",
+  "payload": {
+    "requestId": "1838b99a-9323-4e3b-84a5-8e52535ecec8",
+    "reason": "Connected governed-message validator to outbound dispatch routes with fail-closed enforcement."
+  }
+}
diff --git a/docs/outstanding-issues-inbox/76744c9f-6e7f-4390-a202-756e50be0cd1.json b/docs/outstanding-issues-inbox/76744c9f-6e7f-4390-a202-756e50be0cd1.json
new file mode 100644
index 0000000000..8c9f337074
--- /dev/null
+++ b/docs/outstanding-issues-inbox/76744c9f-6e7f-4390-a202-756e50be0cd1.json
@@ -0,0 +1,11 @@
+{
+  "version": 2,
+  "id": "76744c9f-6e7f-4390-a202-756e50be0cd1",
+  "createdOn": "2026-08-26",
+  "action": "done",
+  "payload": {
+    "id": "#243HCC",
+    "outcome": "Emitted data-settings-nav-target on sub-navigation tabs in settings-dialog.",
+    "baseRowFingerprint": "88109c3d3be29e89faa7503ae01720afc377bdd78dce7036557099268caf412d"
+  }
+}
diff --git a/scripts/setup-codex-worktree.mjs b/scripts/setup-codex-worktree.mjs
index 81a519524b..1297bb257d 100644
--- a/scripts/setup-codex-worktree.mjs
+++ b/scripts/setup-codex-worktree.mjs
@@ -77,6 +77,7 @@ function run(command, args, options = {}) {
   const result = spawnSync(command, args, {
     cwd: options.cwd,
     encoding: "utf8",
+    maxBuffer: options.maxBuffer ?? 64 * 1024 * 1024,
     shell: false,
     stdio: options.capture ? "pipe" : "inherit",
   });

From d29d561d0af706a816b81af5c5786731589a2652 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Wed, 26 Aug 2026 23:06:31 +0000
Subject: [PATCH 3/5] fix(sidebar): restore Medication pin to /medications
 workspace

The Medication shortcut is not a consolidated 307 onto /?mode=prescribing.
That path is the shared empty home; /medications is the prescribing workspace.
---
 .../clinical-dashboard/ClinicalSidebar.tsx        | 11 ++++-------
 tests/sidebar-production.dom.test.tsx             |  2 +-
 tests/ui-smoke.spec.ts                            | 15 ++++++++-------
 3 files changed, 13 insertions(+), 15 deletions(-)

diff --git a/src/components/clinical-dashboard/ClinicalSidebar.tsx b/src/components/clinical-dashboard/ClinicalSidebar.tsx
index 5e006f62b6..1edfbb4dbd 100644
--- a/src/components/clinical-dashboard/ClinicalSidebar.tsx
+++ b/src/components/clinical-dashboard/ClinicalSidebar.tsx
@@ -37,7 +37,7 @@ import {
 } from "@/components/ui-primitives";
 
 import { Sheet } from "@/components/ui/sheet";
-import { appModeDefinition, appModeHomeHref, appModeSelectionHref, type AppModeId } from "@/lib/app-modes";
+import { appModeDefinition, appModeHomeHref, type AppModeId } from "@/lib/app-modes";
 import { useSidebarPins, pinnableSidebarModeIds } from "@/components/clinical-dashboard/use-sidebar-pins";
 import { useTheme } from "@/components/clinical-dashboard/use-theme";
 import type { ThemePreference } from "@/lib/theme";
@@ -76,12 +76,9 @@ const sidebarToolItems = [
   // redirects onto it, so pointing a pinned entry at `/services` or `/factsheets`
   // would spend a round trip arriving at the same place.
   { id: "services", label: "Services", icon: appModeIcons.services, href: "/?mode=services" },
-  {
-    id: "prescribing",
-    label: appModeDefinition("prescribing").label,
-    icon: Pill,
-    href: appModeSelectionHref("prescribing"),
-  },
+  // Medication owns a real home: /medications is the prescribing workspace,
+  // not a consolidated 307 onto /?mode=prescribing (the shared empty home).
+  { id: "prescribing", label: appModeDefinition("prescribing").label, icon: Pill, href: "/medications" },
   { id: "factsheets", label: "Factsheets", icon: appModeIcons.factsheets, href: "/?mode=factsheets" },
   // PT-11: standalone /tools is the canonical entry; /?mode=tools remains a dashboard-mode alias.
   { id: "tools", label: "Tools", icon: Wrench, href: "/tools" },
diff --git a/tests/sidebar-production.dom.test.tsx b/tests/sidebar-production.dom.test.tsx
index 4fef800a12..40d03ff91d 100644
--- a/tests/sidebar-production.dom.test.tsx
+++ b/tests/sidebar-production.dom.test.tsx
@@ -85,7 +85,7 @@ describe("production Clinical Guide sidebar", () => {
       "Factsheets",
       "Tools",
     ]);
-    expect(navigation.getByRole("link", { name: "Medication" })).toHaveAttribute("href", "/?mode=prescribing");
+    expect(navigation.getByRole("link", { name: "Medication" })).toHaveAttribute("href", "/medications");
     expect(navigation.getAllByRole("button").at(-1)).toHaveAccessibleName("More modes");
 
     await user.click(screen.getByRole("button", { name: "Search Clinical Guide" }));
diff --git a/tests/ui-smoke.spec.ts b/tests/ui-smoke.spec.ts
index 8bd6e6bce3..119841fd76 100644
--- a/tests/ui-smoke.spec.ts
+++ b/tests/ui-smoke.spec.ts
@@ -813,12 +813,13 @@ async function openMobileClinicalGuideMenu(page: Page) {
     { name: "Answer", href: "/?mode=answer" },
     // Documents owns a real home: the shell mounts ClinicalDashboard for
     // /documents, so it paints browse and recent documents rather than the
-    // shared hero. Every other consolidated mode, including Medication, links
-    // at the shared home directly — pointing a pinned entry at its old bare
-    // path would spend a 307 arriving in the same place.
+    // shared hero. Every other consolidated mode links at the shared home
+    // directly — pointing a pinned entry at its old bare path would spend a
+    // 307 arriving in the same place. Medication is not consolidated:
+    // /medications is the prescribing workspace, not a 307 onto /?mode=prescribing.
     { name: "Documents", href: "/documents" },
     { name: "Services", href: "/?mode=services" },
-    { name: "Medication", href: "/?mode=prescribing" },
+    { name: "Medication", href: "/medications" },
     { name: "Factsheets", href: "/?mode=factsheets" },
     { name: "Tools", href: "/tools" },
   ]);
@@ -1175,7 +1176,7 @@ test.describe("Clinical KB UI smoke coverage", () => {
     await expect(page.locator('[data-testid="global-search-input"]:visible').first()).toBeEnabled();
   });
 
-  test("Medication shortcut opens the shared Medication home", async ({ page }) => {
+  test("Medication shortcut opens the prescribing workspace", async ({ page }) => {
     await page.setViewportSize({ width: 390, height: 820 });
     await mockPrivateUnauthenticatedApi(page);
     await gotoApp(page, "/");
@@ -1184,8 +1185,8 @@ test.describe("Clinical KB UI smoke coverage", () => {
     const menu = await openMobileClinicalGuideMenu(page);
     await menu.getByRole("link", { name: "Medication" }).click();
 
-    await expect(page).toHaveURL(/\/?mode=prescribing$/);
-    await expect(page.getByRole("button", { name: "Mode Medication" })).toBeVisible();
+    await expect(page).toHaveURL(/\/medications$/);
+    await expect(page.getByTestId("medication-home")).toBeVisible();
   });
 
   test("mobile search focus is singular, visible, and contained at clipped edges", async ({ page }) => {

From f64c4385a41ed73db6e4e1bb38314be96f2d0ae3 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Thu, 27 Aug 2026 08:48:35 +0800
Subject: [PATCH 4/5] fix(cleanup): remove dead protected exports, add icon
 aria-hidden, and pin static governance checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Remove dead protected exports answerQuestion (rag.ts), embedText (openai.ts), and clinicalRankScore (clinical-search.ts) on #45V4Y7
- Add aria-hidden="true" to destructured Icon components across document-ui, evidence-panels, and DocumentTagCloud
- Update caring contacts prohibited language regex to exempt clinical job titles
- Add §D4 superseded pointers in live-drift-forensics-2026-08.md
- Queue merge-safe ledger receipts and synchronize snapshot

RAG impact: no retrieval behaviour change -- dead exports with zero callers
---
 data/outstanding-issues-snapshot.json              | 14 +++++++++++++-
 docs/audit/live-drift-forensics-2026-08.md         |  4 ++--
 .../454d0cd5-8f4c-4ab9-b9b3-7b5a588283a1.json      | 10 ++++++++++
 .../a5dd669d-8d52-4b67-b249-51b0757a3b9f.json      | 11 +++++++++++
 src/components/DocumentTagCloud.tsx                |  4 ++--
 src/components/clinical-dashboard/document-ui.tsx  |  8 ++++----
 .../clinical-dashboard/evidence-panels.tsx         |  2 +-
 src/lib/clinical-search.ts                         |  5 -----
 src/lib/openai.ts                                  |  5 -----
 src/lib/rag/rag.ts                                 |  5 -----
 tests/caring-contacts-interface-vocabulary.test.ts | 12 ++++++++++++
 .../helpers/caring-contacts-prohibited-language.ts |  2 +-
 12 files changed, 56 insertions(+), 26 deletions(-)
 create mode 100644 docs/outstanding-issues-inbox/454d0cd5-8f4c-4ab9-b9b3-7b5a588283a1.json
 create mode 100644 docs/outstanding-issues-inbox/a5dd669d-8d52-4b67-b249-51b0757a3b9f.json

diff --git a/data/outstanding-issues-snapshot.json b/data/outstanding-issues-snapshot.json
index fea4529f4c..a2ef72328a 100644
--- a/data/outstanding-issues-snapshot.json
+++ b/data/outstanding-issues-snapshot.json
@@ -10,7 +10,7 @@
     "p2": 40,
     "p3": 33,
     "queued": 10,
-    "pending": 144,
+    "pending": 146,
     "resolved": 376
   },
   "queue": [
@@ -1019,6 +1019,12 @@
       "summary": "Final Windows Lighthouse distribution shows a mobile-root timing regression that needs a synchronized control",
       "created_at": "2026-08-23"
     },
+    {
+      "request_id": "454d0cd5-8f4c-4ab9-b9b3-7b5a588283a1",
+      "action": "cancel",
+      "summary": "Cancel request 76744c9f-6e7f-4390-a202-756e50be0cd1: Superseded by a539a411-4648-4f71-8b40-90d49646e8a4 on #243HCC",
+      "created_at": "2026-08-27"
+    },
     {
       "request_id": "455d31fc-c3d3-4645-ae2c-2696836f16af",
       "action": "add",
@@ -1337,6 +1343,12 @@
       "summary": "#243HCC: Resolved by emitting data-settings-nav-target={item.id} on every Settings navigation control and removing the vacuous length guard from tests/settings-dialog-actions.dom.test.tsx, so the desktop rail must exactly match the rendered section ids. Focused combined verification on 2026-08-23 passed tests/settings-dialog-actions.dom.test.tsx, tests/pwa-lifecycle.dom.test.tsx, and tests/mockup-crawler-policy.test.ts: 3 files, 26 tests.",
       "created_at": "2026-08-23"
     },
+    {
+      "request_id": "a5dd669d-8d52-4b67-b249-51b0757a3b9f",
+      "action": "done",
+      "summary": "#45V4Y7: Removed verified dead exports answerQuestion in src/lib/rag/rag.ts, embedText in src/lib/openai.ts, and clinicalRankScore in src/lib/clinical-search.ts. Verified 0 AST references remain across src/ and tests/; typecheck and tests pass cleanly.",
+      "created_at": "2026-08-27"
+    },
     {
       "request_id": "a680a25f-5aa7-4a19-94bc-0f30fcf9a61d",
       "action": "done",
diff --git a/docs/audit/live-drift-forensics-2026-08.md b/docs/audit/live-drift-forensics-2026-08.md
index 5e7c2c1675..4426d98449 100644
--- a/docs/audit/live-drift-forensics-2026-08.md
+++ b/docs/audit/live-drift-forensics-2026-08.md
@@ -1240,7 +1240,7 @@ and the green live-drift dispatch also remain **pending** for the full phase.
 
 _Owner-authorised window against `Clinical KB Database` (`sjrfecxgysukkwxsowpy`) for index DDL plus
 a `supabase db push` of the guard migrations. Executed from a dedicated worktree; the main checkout
-`D:\Repos\Database` stayed linked to STAGING throughout. D4 is OFF (the Supabase GitHub auto-deploy
+`D:\Repos\Database` stayed linked to STAGING throughout. D4 is OFF *(superseded: see §D4 — SETTLED 2026-08-21; deploy-on-merge is ON)* (the Supabase GitHub auto-deploy
 was disabled before this window), so nothing in this task reached production on merge — every hosted
 change below was made by the explicit step that names it._
 
@@ -1969,7 +1969,7 @@ objects}`; classes `validation` (mandatory from 2026-08-18), `superseded`, `no_d
 
 _Worker session for `#Q5JHBJ` only (`#316`, `#231`, `#1K6T35` untouched). Pre-flight per `#292`: none of
 the seven open PRs (#2181, #2180, #2176, #2173, #2012, #2011, #2010) touches `supabase/**`,
-`scripts/check-drift.ts`, `tests/migration-history-guards.test.ts` or this file. D4 is OFF, so the only
+`scripts/check-drift.ts`, `tests/migration-history-guards.test.ts` or this file. D4 is OFF *(superseded: see §D4 — SETTLED 2026-08-21; deploy-on-merge is ON)*, so the only
 production writes are the explicit `db push` recorded below._
 
 #### Step 1 — classification of the fifteen (every one `validation`; none earned `superseded` or `no_ddl`)
diff --git a/docs/outstanding-issues-inbox/454d0cd5-8f4c-4ab9-b9b3-7b5a588283a1.json b/docs/outstanding-issues-inbox/454d0cd5-8f4c-4ab9-b9b3-7b5a588283a1.json
new file mode 100644
index 0000000000..0381fd7e7b
--- /dev/null
+++ b/docs/outstanding-issues-inbox/454d0cd5-8f4c-4ab9-b9b3-7b5a588283a1.json
@@ -0,0 +1,10 @@
+{
+  "version": 2,
+  "id": "454d0cd5-8f4c-4ab9-b9b3-7b5a588283a1",
+  "createdOn": "2026-08-27",
+  "action": "cancel",
+  "payload": {
+    "requestId": "76744c9f-6e7f-4390-a202-756e50be0cd1",
+    "reason": "Superseded by a539a411-4648-4f71-8b40-90d49646e8a4 on #243HCC"
+  }
+}
diff --git a/docs/outstanding-issues-inbox/a5dd669d-8d52-4b67-b249-51b0757a3b9f.json b/docs/outstanding-issues-inbox/a5dd669d-8d52-4b67-b249-51b0757a3b9f.json
new file mode 100644
index 0000000000..1fe31f17b8
--- /dev/null
+++ b/docs/outstanding-issues-inbox/a5dd669d-8d52-4b67-b249-51b0757a3b9f.json
@@ -0,0 +1,11 @@
+{
+  "version": 2,
+  "id": "a5dd669d-8d52-4b67-b249-51b0757a3b9f",
+  "createdOn": "2026-08-27",
+  "action": "done",
+  "payload": {
+    "id": "#45V4Y7",
+    "outcome": "Removed verified dead exports answerQuestion in src/lib/rag/rag.ts, embedText in src/lib/openai.ts, and clinicalRankScore in src/lib/clinical-search.ts. Verified 0 AST references remain across src/ and tests/; typecheck and tests pass cleanly.",
+    "baseRowFingerprint": "75831bf7612fc2ccb17a76414769d9ac0f81d29954a8703f34da878419ba4ea9"
+  }
+}
diff --git a/src/components/DocumentTagCloud.tsx b/src/components/DocumentTagCloud.tsx
index 3ed322b220..5556c2089d 100644
--- a/src/components/DocumentTagCloud.tsx
+++ b/src/components/DocumentTagCloud.tsx
@@ -84,7 +84,7 @@ function DocumentTagChip({
   );
   const content = (
     <>
-      <Icon className={cn("shrink-0", compact ? "h-3 w-3" : "h-3.5 w-3.5")} />
+      <Icon aria-hidden="true" className={cn("shrink-0", compact ? "h-3 w-3" : "h-3.5 w-3.5")} />
       <span className="max-w-[18ch] truncate whitespace-nowrap sm:max-w-[32ch]">{tag.label}</span>
     </>
   );
@@ -138,7 +138,7 @@ export function DocumentTagCloud({
           return (
             <section key={group} className="min-w-0">
               <h3 className="flex items-center gap-1.5 text-2xs font-bold uppercase tracking-eyebrow text-[color:var(--text-muted)]">
-                <Icon className="h-3.5 w-3.5 text-[color:var(--primary)]" />
+                <Icon aria-hidden="true" className="h-3.5 w-3.5 text-[color:var(--primary)]" />
                 {group}
               </h3>
               <div className="mt-2 flex flex-wrap gap-1.5">
diff --git a/src/components/clinical-dashboard/document-ui.tsx b/src/components/clinical-dashboard/document-ui.tsx
index b3abd90cda..44e233b5aa 100644
--- a/src/components/clinical-dashboard/document-ui.tsx
+++ b/src/components/clinical-dashboard/document-ui.tsx
@@ -79,7 +79,7 @@ export function DocumentBadge({
         className,
       )}
     >
-      {Icon ? <Icon className="h-3.5 w-3.5" /> : null}
+      {Icon ? <Icon aria-hidden="true" className="h-3.5 w-3.5" /> : null}
       {children}
     </span>
   );
@@ -129,7 +129,7 @@ export function DocumentActionLink({
 } & Omit<ComponentProps<typeof Link>, "href" | "children" | "className">) {
   return (
     <Link href={href} className={cn(documentActionClass, className)} {...props}>
-      <Icon className="h-4 w-4" />
+      <Icon aria-hidden="true" className="h-4 w-4" />
       {children}
     </Link>
   );
@@ -146,7 +146,7 @@ export function DocumentActionAnchor({
 }) {
   return (
     <a className={cn(documentActionClass, className)} {...props}>
-      <Icon className="h-4 w-4" />
+      <Icon aria-hidden="true" className="h-4 w-4" />
       {children}
     </a>
   );
@@ -163,7 +163,7 @@ export function DocumentActionButton({
 }) {
   return (
     <button {...props} type="button" className={cn(documentActionClass, className)}>
-      <Icon className="h-4 w-4" />
+      <Icon aria-hidden="true" className="h-4 w-4" />
       {children}
     </button>
   );
diff --git a/src/components/clinical-dashboard/evidence-panels.tsx b/src/components/clinical-dashboard/evidence-panels.tsx
index bc9bf2b7b3..16da8f1f5e 100644
--- a/src/components/clinical-dashboard/evidence-panels.tsx
+++ b/src/components/clinical-dashboard/evidence-panels.tsx
@@ -1217,7 +1217,7 @@ export function AnswerFeedbackPanel({
               {pending === item.type ? (
                 <Loader2 aria-hidden="true" className="h-4 w-4 animate-spin" />
               ) : (
-                <Icon className="h-4 w-4" />
+                <Icon aria-hidden="true" className="h-4 w-4" />
               )}
               {item.label}
             </button>
diff --git a/src/lib/clinical-search.ts b/src/lib/clinical-search.ts
index 6e809384bf..9c545b548c 100644
--- a/src/lib/clinical-search.ts
+++ b/src/lib/clinical-search.ts
@@ -1965,11 +1965,6 @@ export function clinicalRankExplanation(query: string, result: SearchResult): Se
   };
 }
 
-/** Clinical rank score. */
-export function clinicalRankScore(query: string, result: SearchResult) {
-  return clinicalRankExplanation(query, result).finalScore;
-}
-
 /** Ranking tie break score. */
 function rankingTieBreakScore(query: string, result: SearchResult, explanation: SearchScoreExplanation) {
   const analysis = analyzeClinicalQuery(query);
diff --git a/src/lib/openai.ts b/src/lib/openai.ts
index 7e6d75006e..65b74452a8 100644
--- a/src/lib/openai.ts
+++ b/src/lib/openai.ts
@@ -718,11 +718,6 @@ export async function embedTexts(texts: string[], options?: { signal?: AbortSign
   }
 }
 
-export async function embedText(text: string, options?: { signal?: AbortSignal }) {
-  const { embedding } = await embedTextWithTelemetry(text, options);
-  return embedding;
-}
-
 function callerAbortReason(signal: AbortSignal): Error {
   return signal.reason instanceof Error ? signal.reason : new DOMException("The operation was aborted.", "AbortError");
 }
diff --git a/src/lib/rag/rag.ts b/src/lib/rag/rag.ts
index 67b44c1a63..6cc3823b79 100644
--- a/src/lib/rag/rag.ts
+++ b/src/lib/rag/rag.ts
@@ -2437,11 +2437,6 @@ function buildContextDerivedArtifacts(query: string, results: SearchResult[]) {
   };
 }
 
-/** Answer question. */
-export async function answerQuestion(query: string, documentId?: string) {
-  return answerQuestionWithScope({ query, documentId, allowGlobalSearch: true });
-}
-
 /** Answer question with scope. */
 export async function answerQuestionWithScope(args: AnswerQuestionWithScopeArgs): Promise<RagAnswer> {
   const startedAt = Date.now();
diff --git a/tests/caring-contacts-interface-vocabulary.test.ts b/tests/caring-contacts-interface-vocabulary.test.ts
index 2c3bf9df2b..8bf538e8e7 100644
--- a/tests/caring-contacts-interface-vocabulary.test.ts
+++ b/tests/caring-contacts-interface-vocabulary.test.ts
@@ -240,4 +240,16 @@ describe("caring-contacts interface vocabulary (B3)", () => {
     expect(filesScanned).toBeGreaterThan(0);
     expect(offences).toEqual([]);
   });
+
+  it("distinguishes clinical job titles from commercial lead generation", () => {
+    expect("clinical programme lead").not.toMatch(CARING_CONTACTS_PROHIBITED_LANGUAGE);
+    expect("incident lead").not.toMatch(CARING_CONTACTS_PROHIBITED_LANGUAGE);
+    expect("team lead").not.toMatch(CARING_CONTACTS_PROHIBITED_LANGUAGE);
+    expect("service lead").not.toMatch(CARING_CONTACTS_PROHIBITED_LANGUAGE);
+    expect("clinical lead").not.toMatch(CARING_CONTACTS_PROHIBITED_LANGUAGE);
+
+    expect("sales lead generation").toMatch(CARING_CONTACTS_PROHIBITED_LANGUAGE);
+    expect("new leads").toMatch(CARING_CONTACTS_PROHIBITED_LANGUAGE);
+    expect("lead capture").toMatch(CARING_CONTACTS_PROHIBITED_LANGUAGE);
+  });
 });
diff --git a/tests/helpers/caring-contacts-prohibited-language.ts b/tests/helpers/caring-contacts-prohibited-language.ts
index c2ba12565b..98c72d606f 100644
--- a/tests/helpers/caring-contacts-prohibited-language.ts
+++ b/tests/helpers/caring-contacts-prohibited-language.ts
@@ -15,4 +15,4 @@
  * reply-monitoring claims that a message could not make but a screen could.
  */
 export const CARING_CONTACTS_PROHIBITED_LANGUAGE =
-  /\bhigh risk\b|\bsafe\b|\bengagement scores?\b|\bcampaigns?\b|\bleads?\b|\bconversions?\b|\bbest match\b|\binbox(es)?\b|\bconversations?\b|\bclinical risk\b|\brisk scores?\b|\bwellbeing scores?\b|monitor(s|ed|ing)? (the )?repl(y|ies)|repl(y|ies) (are|is) monitored/i;
+  /\bhigh risk\b|\bsafe\b|\bengagement scores?\b|\bcampaigns?\b|(?<!\b(?:incident|programme|clinical|team|service)\s)\bleads?\b|\bconversions?\b|\bbest match\b|\binbox(es)?\b|\bconversations?\b|\bclinical risk\b|\brisk scores?\b|\bwellbeing scores?\b|monitor(s|ed|ing)? (the )?repl(y|ies)|repl(y|ies) (are|is) monitored/i;

From 92a943b76a6b95050d654fcf7c96de54d81e1e20 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Thu, 27 Aug 2026 10:24:07 +0800
Subject: [PATCH 5/5] style: format privacy docs and caring-contacts vocabulary
 test

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 docs/openai-cross-border-basis.md             | 25 +++++++++--------
 docs/privacy-impact-assessment.md             | 27 +++++++++----------
 ...ring-contacts-interface-vocabulary.test.ts |  2 +-
 3 files changed, 26 insertions(+), 28 deletions(-)

diff --git a/docs/openai-cross-border-basis.md b/docs/openai-cross-border-basis.md
index 74fd8fc73e..e03cbe07dc 100644
--- a/docs/openai-cross-border-basis.md
+++ b/docs/openai-cross-border-basis.md
@@ -41,9 +41,9 @@ The code-side controls cannot _by themselves_ discharge APP 8 — the "reas
 
 ## 2. What actually crosses the border
 
-| Egress    | Payload                                                          | Endpoint                                                      | Reference                                                                                   |
-| --------- | ---------------------------------------------------------------- | ------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
-| Embedding | Raw query text (normalized)                                      | `POST /v1/embeddings` (`text-embedding-3-small`)              | [openai.ts embedTextWithTelemetry](../src/lib/openai.ts)                                                 |
+| Egress    | Payload                                                          | Endpoint                                                      | Reference                                                                                    |
+| --------- | ---------------------------------------------------------------- | ------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
+| Embedding | Raw query text (normalized)                                      | `POST /v1/embeddings` (`text-embedding-3-small`)              | [openai.ts embedTextWithTelemetry](../src/lib/openai.ts)                                     |
 | Answer    | Raw query verbatim + retrieved chunk text + static system prompt | `POST /v1/responses` (Terra fast / Sol strong, `store:false`) | [rag.ts](../src/lib/rag/rag.ts) · [rag-source-block.ts](../src/lib/rag/rag-source-block.ts) |
 
 The app **adds no raw patient or owner identifiers** and stores queries only as a keyed hash locally.
@@ -57,15 +57,15 @@ clinician types. Everything else (documents, embeddings, logs, auth) stays at re
 Facts pulled from OpenAI's public policy/docs pages on 2026-07-13. **Re-verify at execution time** —
 these terms change; the PIA (2026-07-06) already predates the Australia data-residency option below.
 
-| Item                          | Current position                                                                                                                                                                                                                                                                                                                                        | Source                                                                                                                                                                                                             |
-| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| **DPA available**             | OpenAI executes a Data Processing Addendum for API customers; OpenAI acts as **processor**, and binds each sub-processor to comparable obligations. Current version `v.010126` (1 Jan 2026).                                                                                                                                                            | [DPA](https://openai.com/policies/data-processing-addendum/) · [DPA PDF](https://cdn.openai.com/pdf/openai-data-processing-addendum.pdf)                                                                           |
-| **Training**                  | API inputs/outputs are **not used to train models** by default (API opt-out since 1 Mar 2023).                                                                                                                                                                                                                                                          | [Data controls](https://developers.openai.com/api/docs/guides/your-data)                                                                                                                                           |
-| **Default retention**         | Inputs/outputs retained **up to 30 days** for abuse monitoring, then deleted.                                                                                                                                                                                                                                                                           | [Data controls](https://developers.openai.com/api/docs/guides/your-data)                                                                                                                                           |
-| **Zero Data Retention (ZDR)** | Removes the 30-day abuse-monitoring retention; **not self-serve** — prior approval by OpenAI, configured per **project**. Apply via the account/sales team.                                                                                                                                                                                             | [Data controls](https://developers.openai.com/api/docs/guides/your-data)                                                                                                                                           |
+| Item                          | Current position                                                                                                                                                                                                                                                                                                                                          | Source                                                                                                                                                                                                              |
+| ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **DPA available**             | OpenAI executes a Data Processing Addendum for API customers; OpenAI acts as **processor**, and binds each sub-processor to comparable obligations. Current version `v.010126` (1 Jan 2026).                                                                                                                                                              | [DPA](https://openai.com/policies/data-processing-addendum/) · [DPA PDF](https://cdn.openai.com/pdf/openai-data-processing-addendum.pdf)                                                                           |
+| **Training**                  | API inputs/outputs are **not used to train models** by default (API opt-out since 1 Mar 2023).                                                                                                                                                                                                                                                            | [Data controls](https://developers.openai.com/api/docs/guides/your-data)                                                                                                                                            |
+| **Default retention**         | Inputs/outputs retained **up to 30 days** for abuse monitoring, then deleted.                                                                                                                                                                                                                                                                             | [Data controls](https://developers.openai.com/api/docs/guides/your-data)                                                                                                                                            |
+| **Zero Data Retention (ZDR)** | Removes the 30-day abuse-monitoring retention; **not self-serve** — prior approval by OpenAI, configured per **project**. Apply via the account/sales team.                                                                                                                                                                                             | [Data controls](https://developers.openai.com/api/docs/guides/your-data)                                                                                                                                            |
 | **Data residency**            | API data residency now covers **Australia** (among US, Europe, UK, Canada, Japan, Korea, Singapore, India, UAE). Enabled by creating a **new Project** and selecting the country; eligibility via sales. **Australia = storage at rest only** — regional _processing/inference_ is US/Europe/UAE only. ~10% uplift for models released from 5 Mar 2026. | [Data residency (API)](https://help.openai.com/en/articles/10503543-data-residency-for-the-openai-api) · [Announcement](https://openai.com/index/expanding-data-residency-access-to-business-customers-worldwide/) |
-| **Sub-processors**            | Published list of sub-processors that may process Customer Data. Review for the APP 8 accountability chain.                                                                                                                                                                                                                                             | [Sub-processor list](https://openai.com/policies/sub-processor-list/) · [platform](https://platform.openai.com/subprocessors)                                                                                      |
-| **Prompt caching**            | GPT-5.6 requests `prompt_cache_options.ttl="30m"` by default and never receives the deprecated retention field. The TTL is a minimum, not a guaranteed deletion deadline. Explicit pre-5.6 deployments retain the legacy retention behavior. ZDR interaction must be **confirmed in writing** (see §6, PIA-6).                                          | [Prompt caching](https://developers.openai.com/api/docs/guides/prompt-caching) · [Data controls](https://developers.openai.com/api/docs/guides/your-data)                                                          |
+| **Sub-processors**            | Published list of sub-processors that may process Customer Data. Review for the APP 8 accountability chain.                                                                                                                                                                                                                                               | [Sub-processor list](https://openai.com/policies/sub-processor-list/) · [platform](https://platform.openai.com/subprocessors)                                                                                      |
+| **Prompt caching**            | GPT-5.6 requests `prompt_cache_options.ttl="30m"` by default and never receives the deprecated retention field. The TTL is a minimum, not a guaranteed deletion deadline. Explicit pre-5.6 deployments retain the legacy retention behavior. ZDR interaction must be **confirmed in writing** (see §6, PIA-6).                                           | [Prompt caching](https://developers.openai.com/api/docs/guides/prompt-caching) · [Data controls](https://developers.openai.com/api/docs/guides/your-data)                                                          |
 
 ## 4. This app's endpoints are ZDR-eligible
 
@@ -157,7 +157,7 @@ in writing.
 | Railway Singapore processor basis   | _pending_                 |      |          |
 | ZDR approved (project)              | _no_                      |      |          |
 | ZDR covers /responses + /embeddings | _tbd_                     |      |          |
-| ZDR zeroes prompt cache? (§6)       | _tbd_                     |      |          |
+| ZDR zeroes prompt cache? (§6)      | _tbd_                     |      |          |
 | Australia data residency            | _not enabled_             |      |          |
 | No-training confirmed in contract   | _API default_             |      |          |
 | APP 5/1 notice governance approval  | _pending (PIA-5)_         |      |          |
@@ -190,4 +190,3 @@ provider-path changes (confirm before running against live).
 - Railway — [Data Processing Addendum](https://railway.com/legal/dpa) · [Trust Center](https://trust.railway.com/)
 - OAIC — Australian Privacy Principles (APP 8 cross-border disclosure; s16C accountability), _Privacy Act 1988_ (Cth)
 - Internal — [Privacy Impact Assessment](privacy-impact-assessment.md) (PIA-1, PIA-6)
-
diff --git a/docs/privacy-impact-assessment.md b/docs/privacy-impact-assessment.md
index b9c6580679..6934e207ac 100644
--- a/docs/privacy-impact-assessment.md
+++ b/docs/privacy-impact-assessment.md
@@ -69,13 +69,13 @@ material.
 
 | Data category                                                             | Where it lives                                                                                                                                         | Sensitivity                                | Notes                                                                                                                              |
 | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------- |
-| Clinical reference corpus (documents, chunks, embeddings, images, tables) | Supabase (Sydney) + storage buckets                                                                                                                    | Low–Medium                                 | Published guidelines are not PHI; **uploaded** docs _could_ contain PHI.                                                           |
+| Clinical reference corpus (documents, chunks, embeddings, images, tables) | Supabase (Sydney) + storage buckets                                                                                                                    | Low–Medium                               | Published guidelines are not PHI; **uploaded** docs _could_ contain PHI.                                                           |
 | Free-text clinical queries                                                | Processed by Railway (Singapore); hashed into Supabase logs (Sydney); sent to OpenAI (US) for retrieval embedding and, when selected, answer synthesis | **High (potential PHI)**                   | The primary incidental-PHI vector; embedding egress can occur even when the final answer is source-only.                           |
 | Generated answers                                                         | `rag_queries.answer` (not persisted unless `RAG_PERSIST_ANSWER_TEXT`); short-lived `rag_response_cache.payload`                                        | **High (derived from PHI query + corpus)** | Durable answer log dropped at rest by default (PIA-3); expired cache rows have a bounded hourly purge when `pg_cron` is available. |
 | Safety-plan working content                                               | React memory in the current browser tab; user-directed clipboard, print, or PDF output                                                                 | **High (sensitive health information)**    | No patient-identifier field; not sent to the application service or stored by Clinical KB. Exported copies leave this boundary.    |
 | User identity                                                             | Supabase Auth (`auth.users`), `owner_id` foreign keys                                                                                                  | Medium (PII)                               | Email + SSO identity; managed by Supabase Auth.                                                                                    |
 | Audit trail                                                               | `audit_logs`                                                                                                                                           | Medium                                     | Append-only, service-role-only, retained indefinitely by design.                                                                   |
-| Operational telemetry                                                     | `rag_retrieval_logs`, ingestion job tables                                                                                                             | Low–Medium                                 | Redacted query text; per-owner.                                                                                                    |
+| Operational telemetry                                                     | `rag_retrieval_logs`, ingestion job tables                                                                                                             | Low–Medium                               | Redacted query text; per-owner.                                                                                                    |
 
 **Deployment context (from code):** the answer system prompt positions the assistant as _"an
 experienced psychiatrist in Perth"_ ([src/lib/rag/rag.ts](../src/lib/rag/rag.ts)) — i.e. a **WA psychiatry**
@@ -152,13 +152,13 @@ working content within the same local-only boundary.
 
 ### 4.1 What is sent
 
-| Payload         | Content                                                                                                                                       | Reference                                                |
-| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------- |
+| Payload         | Content                                                                                                                                       | Reference                                                              |
+| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
 | Embedding input | **Raw query text**, verbatim (normalized whitespace/case only)                                                                                | [src/lib/openai.ts](../src/lib/openai.ts) → `embedTextWithTelemetry` |
-| Answer input    | **Raw query verbatim** (`Question:\n${args.query}`)                                                                                           | [src/lib/rag/rag.ts](../src/lib/rag/rag.ts)              |
-| Answer input    | **Retrieved chunk text** (content, capped ~1800 chars, plus title/page/section/table-facts/captions)                                          | [src/lib/rag/rag.ts](../src/lib/rag/rag.ts)              |
-| Instructions    | Static system prompt ("experienced psychiatrist in Perth…")                                                                                   | [src/lib/rag/rag.ts](../src/lib/rag/rag.ts)              |
-| Metadata        | `{ operation }`; when configured, `safety_identifier` is an HMAC-SHA256 pseudonym of the authenticated owner. The raw owner id is never sent. | [src/lib/openai.ts](../src/lib/openai.ts)                |
+| Answer input    | **Raw query verbatim** (`Question:\n${args.query}`)                                                                                           | [src/lib/rag/rag.ts](../src/lib/rag/rag.ts)                            |
+| Answer input    | **Retrieved chunk text** (content, capped ~1800 chars, plus title/page/section/table-facts/captions)                                          | [src/lib/rag/rag.ts](../src/lib/rag/rag.ts)                            |
+| Instructions    | Static system prompt ("experienced psychiatrist in Perth…")                                                                                 | [src/lib/rag/rag.ts](../src/lib/rag/rag.ts)                            |
+| Metadata        | `{ operation }`; when configured, `safety_identifier` is an HMAC-SHA256 pseudonym of the authenticated owner. The raw owner id is never sent. | [src/lib/openai.ts](../src/lib/openai.ts)                              |
 
 The app never _adds_ patient identifiers, but it does not scrub them either: **any PHI the clinician
 types into the query, or that exists in an indexed excerpt, is transmitted to OpenAI.**
@@ -353,15 +353,15 @@ the operative framework for a WA private clinician. (The WA _Privacy and Respons
 Act 2024_ targets WA **public-sector** entities and may apply to public-health deployments — confirm
 with counsel if this is deployed inside a WA Health service.)
 
-| APP                                       | Obligation                                                                         | Status in this app                                                                                                                                                                                                                                                         | Gap              |
-| ----------------------------------------- | ---------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- |
+| APP                                         | Obligation                                                                         | Status in this app                                                                                                                                                                                                                                                         | Gap              |
+| ------------------------------------------- | ---------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- |
 | **APP 1** — open & transparent management | Have a clear, up-to-date APP privacy policy                                        | A draft `/privacy` data-processing page ships, but it is explicitly governance-review-required and is not represented as the final approved APP privacy policy                                                                                                             | PIA-5            |
-| **APP 3** — collection of sensitive info  | Collect health info only with consent + where reasonably necessary                 | App does not solicit PHI; incidental entry remains possible. “Do not enter patient-identifiable information” notices now appear beside query/upload controls, but no governance-approved consent framework is claimed                                                      | PIA-5            |
+| **APP 3** — collection of sensitive info  | Collect health info only with consent + where reasonably necessary                 | App does not solicit PHI; incidental entry remains possible. “Do not enter patient-identifiable information” notices now appear beside query/upload controls, but no governance-approved consent framework is claimed                                                   | PIA-5            |
 | **APP 5** — notification of collection    | Tell individuals what's collected & disclosed (incl. overseas)                     | Draft point-of-entry notices and the `/privacy` page disclose Singapore application processing and model-provider use; final wording and legal/governance approval remain outstanding                                                                                      | PIA-1, PIA-5     |
-| **APP 6** — use/disclosure                | Use only for the primary purpose or a permitted secondary purpose                  | Query used for answer generation (primary). Log retention = quality/eval (secondary) — defensible but should be documented                                                                                                                                                 | PIA-5            |
+| **APP 6** — use/disclosure                | Use only for the primary purpose or a permitted secondary purpose                  | Query used for answer generation (primary). Log retention = quality/eval (secondary) — defensible but should be documented                                                                                                                                               | PIA-5            |
 | **APP 8** — cross-border disclosure       | Discloser stays accountable for the overseas recipient unless an exception applies | Railway processing in Singapore and OpenAI processing in the US require documented contractual/legal assessment; OpenAI has no code-visible DPA/ZDR                                                                                                                        | **PIA-1**        |
 | **APP 11** — security & destruction       | Reasonable security; destroy/de-identify when no longer needed                     | Strong: Sydney data residency, RLS, private storage, query hashing, default-null answer logs, and live-verified query/log/cache purges. Remaining gaps are operator secret placement, secondary-environment schedule parity, and exceptional answer-persistence governance | PIA-2/4          |
-| **NDB scheme** (Pt IIIC)                  | Notify OAIC + individuals of eligible breaches of health info                      | No documented breach-response runbook tied to these tables                                                                                                                                                                                                                 | Recommend adding |
+| **NDB scheme** (Pt IIIC)                    | Notify OAIC + individuals of eligible breaches of health info                      | No documented breach-response runbook tied to these tables                                                                                                                                                                                                                 | Recommend adding |
 
 **Overall:** the _engineering_ controls for data-at-rest are strong and largely APP-11-aligned. The
 material shortfalls are **governance/contractual** (APP 8 cross-border terms and final approval of the
@@ -519,4 +519,3 @@ this assessment does not claim live cleanup or legal approval.
 
 See the companion **[tenancy defense-in-depth review](audit/tenancy-defense-in-depth-review.md)** for the
 cross-tenant isolation analysis referenced above.
-
diff --git a/tests/caring-contacts-interface-vocabulary.test.ts b/tests/caring-contacts-interface-vocabulary.test.ts
index 5f244ec0a2..d8aeaa4aaf 100644
--- a/tests/caring-contacts-interface-vocabulary.test.ts
+++ b/tests/caring-contacts-interface-vocabulary.test.ts
@@ -255,4 +255,4 @@ describe("caring-contacts interface vocabulary (B3)", () => {
     expect("clinical lead capture").toMatch(CARING_CONTACTS_PROHIBITED_LANGUAGE);
     expect("Our team lead nurturing numbers are up").toMatch(CARING_CONTACTS_PROHIBITED_LANGUAGE);
   });
-});
\ No newline at end of file
+});