DSM: add diagnosis reference mode

docs/branch-review-ledger.md

@@ -480,6 +480,7 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD
 | 2026-07-14 | HEAD (detached) 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | RAG retrieval/ranking/selection/answer-generation audit (fresh scoped pass; PR #649 D4/D5 governance levers safe-by-default focus, token/effort waste, provider routing) | No P0/P1. Both #649 levers verified safe-by-default and fail-safe: D4 `unknownCurrentnessPenalty` default 0 (no-op, clamped non-negative, activated only via `RAG_RANKING_CONFIG`); D5 `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` unset=false (only tightens display trust high→medium, never exposes more; `NEXT_PUBLIC` correct as `buildAnswerRenderModel` runs client-side in `ClinicalDashboard.tsx`). Reasoning-effort defaults correct (`OPENAI_STRONG_REASONING_EFFORT`=medium, fast=low; `strongReasoningEffortForQueryClass` never raises, caps routine at medium, keeps dose/threshold at configured). Provider mode default `auto`. P3 (reaffirmed): (1) `Math.max(hybrid_score, boosted)` floor at rag.ts:663 can nullify demotion penalties (outdated/unknown/poor/lowIndex) at the list tail, making D4 partly inert when activated; (2) `document_status` defaults to `"unknown"` (source-metadata.ts:34) for unenriched docs, so activating D4 penalizes the corpus-wide fallback status, not a curated signal — same mechanism that dropped selection doc-recall@5 1.0→0.76 (retrieval-selection.ts:340) — eval gate is the safeguard. | Pure review, no mutations except this ledger append. Offline focused Vitest: answer-render-policy + ranking-config + answer-responsiveness-gate 54/54 passed. Provider-backed (Supabase/OpenAI), `eval:retrieval:quality`, browser, and release checks not run (confirmation boundary). |
 | 2026-07-14 | HEAD (detached) 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | frontend/UI/accessibility audit — global-search-shell, master-search-header, composer, answer surfaces, document viewer, clinical dashboard modules; design-token usage, reduced-motion/forced-colors, icon aria, focus traps, composer/header placement | No P0. P2: (1) `aria-describedby`+`aria-hidden="true"` conflict in `mode-action-popup.tsx:622,651` makes menu descriptions invisible to AT; (2) ~25 dynamic `<Icon>` render sites missing `aria-hidden` across dashboard modules — ESLint `require-lucide-icon-aria` rule gap for LucideIcon-typed variables; (3) Mode menu (`role="menu"` in header) does not close on Tab — keyboard users can Tab away from an open menu without dismissing it; (4) No live region on streaming `NaturalLanguageAnswer` — screen reader users not notified of incremental answer content. P3: (5) `--surface-glass`/`--panel-gloss` not remapped in `@media (forced-colors: active)` block — image-lightbox and PDF toolbar control bars could become invisible in high-contrast; (6) `bg-black/45` on Sheet backdrop instead of `var(--overlay-backdrop)` token; (7) `active:scale-[0.99]` on action-popup buttons without `motion-safe:` — still fires as a visual jump under reduced-motion; (8) Microsoft/Google brand hex squares not `forced-color-adjust:none` — lose brand identity in high-contrast mode. | Pure static review, no mutations. Files read: `master-search-header.tsx`, `global-search-shell.tsx`, `globals.css`, `sheet.tsx`, `mode-action-popup.tsx`, `image-lightbox.tsx`, `answer-content.tsx`, `ClinicalDashboard.tsx` (partial), `use-dismissable-layer.ts`, `layout.tsx`, `eslint-rules/require-lucide-icon-aria.mjs`, `ui-accessibility.spec.ts`, `process-hardening.md`. Browser/live checks not run (confirmation boundary). |
 | 2026-07-14 | main / 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | repo-wide multi-skill audit (repo-auditor, security, clinical-governance, RAG, ingestion-worker, API, frontend-ui, release-readiness, testing/code-quality) | Highest code P1: anonymous public catalogs bypass rate limits while serving multi-MB payloads (medications 3.4 MB, services 894 KB, differentials 1.2 MB; `shouldResolvePublicCatalogAccess()` early-return in registry/medications/differentials routes skips `consumeSubjectApiRateLimit()` for requests without session cookie or bearer token). Active OPERATOR/LEGAL launch blockers: PIA-1 APP 8 overseas processing (Railway SG + OpenAI US), PIA-2 Railway `RAG_QUERY_HASH_SECRET` verify, unrun `verify:release`/golden evals, staging soak, Eval Canary trust, operator-backlog staleness vs runbooks. Confirmed code P2 cluster: public-doc DTO leaks (`storage_path`), single-layer service-role tenancy, commit-RPC unreachable fallback (`worker/main.ts:545-547`), recovery plan pending+failed unique-index crash, unwired `decideReindexGate`, CI scope misses (`src/lib/app-modes.ts`/`clinical-safety.ts` skip UI/RAG gates), a11y describedby/icon/Tab/live-region gaps, soft `@critical` safety UI assert, unenforced bundle budget, `.env.example` weak-OR flag. Residual risk: OCR quality upstream labels + hybrid-RPC latency tail. | Specialist audits + `ci-change-scope` probe; structure `verify:cheap` (2,290/2 skipped); focused Vitest governance/RAG/ingestion suites; no provider/live Supabase/OpenAI/`verify:release`/`check:drift` (confirmation boundary). |
+| 2026-07-14 | codex/dsm-diagnosis-mode | f6cda83ca6aed3a24d999ef4ccd38bff167d4788 | DSM diagnosis mode, local clinical catalogue, search/comparison/differential UI, accessibility, and merge-readiness review | One P2 mobile tap-target defect was fixed across the DSM header, filters, comparison controls, and result actions. No remaining high-confidence P0-P2 finding after preserving current `main` and its Specifiers integration during conflict resolution. Residual risk is formal clinical governance and regulatory review of the paraphrased local DSM reference content before broader clinical deployment. | Focused Vitest 48/48; `npm run verify:cheap` passed with 2,321 tests/1 skipped; targeted Chromium DSM redirect/search/detail journey 1/1; CI-mode production readiness READY; `git diff --check`. Provider-backed Supabase/OpenAI and full advisory `verify:ui`/release checks were not run. |
 | 2026-07-14 | PR #655 / codex/release-blocker-remediation | 1ca2f9f372e23f563de0bc4f823cd341d82a562a | review-followup | One P1 offline-startup defect was confirmed: production instrumentation still required OpenAI after readiness and health accepted explicit offline mode. Fixed the boot guard so only explicit `offline` may omit OpenAI while `auto` and `openai` remain fail-closed. | GitHub review-thread inspection; focused instrumentation/readiness/health Vitest 21/21; scoped ESLint; Prettier; `git diff --check`. Hosted required checks on the reviewed head were green, including Gitleaks, PR required, unit coverage, build, UI, SAST, Docker images, and migration replay. |
 | 2026-07-14 | PR #655 / codex/release-blocker-remediation | c8a3dd118b8bf802418598c7cb48083893625004 | production governance preflight follow-up | The live dry-run correctly stopped because 554 registry projections are deliberately public (`owner_id = null`) while 232 differentials remain owner-scoped. No second tenant exists. Updated reconciliation to preserve public/owner scope, reject any foreign owner or label-owner mismatch, and scope generated intent labels to the existing document owner without mutating ownership. | Read-only production ownership and label topology probes; focused registry/governance Vitest 18/18; scoped ESLint; Prettier; full TypeScript; `git diff --check`; production dry-run inspected 786 documents (554 public, 232 owner-scoped), planned 786 metadata updates and 786 intent-label inserts, and reported zero chunk rows/OpenAI calls. |
 | 2026-07-14 | PR #655 / codex/release-blocker-remediation | 3b152ed1f2f4f08b5672adaf0dc3b433f8ba8db1 + reviewed follow-up diff | final review-thread and release-readiness follow-up | Confirmed and fixed one P1 maintenance-path tenancy defect: registry embedding metadata refreshes could re-private public registry documents. The refresh now preserves public/owner scope, keeps generated intent-label ownership aligned, is idempotent, and rejects foreign-owner documents. Three scoped P2 review items were also resolved: answer-owner ref mutation moved out of render, PDF page changes use router navigation without scroll reset, and the worker-free staging harness no longer enqueues a reindex job before cleanup. No other high-confidence issue remained in the reviewed follow-up diff. | GitHub review-thread inspection; bundled Next.js navigation guide; focused Vitest 38/38; scoped ESLint; Prettier; full TypeScript; `git diff --check`. Final-head hosted CI, staging evidence, and provider-free production governance gates remain required after push. |