Align the therapy and services fact cards, clear stale dev output, and re-sign the lexicon

[BigSimmo]

Summary

Three follow-ups from the session that produced #2670, done as one PR because each is small and they do not interact.

• Two card grids still carried the layout Balance the four priority-facts cards on the form detail page #2670 fixed on the form detail page. Therapy key facts had the full fault: an interactive card filled its height while a card with no "Tap for detail" line dropped that line entirely, so no two card bottoms agreed. Both variants now lay out in the same three zones — header pinned top, face centred in the shared height, footnote pinned bottom and always occupying a line. Services priority facts had the milder half: nothing misaligned, but a short card printed its text hard against the top of a tall box; the block is centred instead, with title and detail kept together since there is no separate footnote zone there to pin.
• guard-next-build now discards .next/dev once it has established no dev server is running. A dev server stopped mid-write leaves a truncated .next/dev/types/validator.ts, and next build type-checks it, so the build fails with a syntax error in a generated file nobody wrote on a tree where nothing is wrong. That cost a full verify:pr-local run on 2026-09-06. guard-push.mjs already works around the same artefact for Prettier. Production output (.next/server, .next/static, .next/types) is untouched, and the cost of being wrong is one slower dev start.
• The medication interaction lexicon sign-off is re-recorded and bound to a mappings hash. The 2026-08-22 sign-off recorded no hash, so nothing bound it to the table it had reviewed and every verify run warned about it.

The other half of the container-quirk item needed nothing: the shallow-clone deepening landed on main earlier the same day in 5c6f196, so the three reviewedCommit does not exist failures no longer occur.

Verification

• npm run verify:pr-local

All 40 steps green on the head of this branch — failed: (none), not reached: (none) — including lint, typecheck, the full offline unit suite, build, and the trailing check:rag:fixtures / check:medication-interactions / check:medication-lexicon-report steps. The lexicon check no longer prints the stale-sign-off warning.

An earlier run of the same gate failed two tests, both caused by the first two commits here; the third commit fixes them and is described below.

• npm run verify:ui — not run locally by cost policy. npm run plan:browser fails an unattributable UI change closed to the full suite, which is exactly what Production UI runs on a non-draft PR. Visual proof was taken instead by driving Chromium against the local dev server: the therapy record page and a services detail page at 1440px, both showing the four cards aligned.
• npm run eval:retrieval:quality — not applicable; no retrieval, ranking, selection, chunking or scoring behaviour changed.
• npm run check:production-readiness — not applicable; no clinical workflow, privacy, environment, Supabase, deployment or answer behaviour changed. Source governance is touched only in that a clinical sign-off is recorded, which is the subject of the preflight section below.

Risk and rollout

• Risk: Low. Two presentation-only changes on /therapy-compass/[slug] and /services/[slug], one local build-tooling change that cannot run in CI's path before a build, and one document. No runtime, data, schema or configuration change.
• Rollback: Revert whichever of the three commits is at fault; they are independent.
• Provider or production effects: None.
• RAG impact: none

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use — unchanged.
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed — no decision-support behaviour changed

The sign-off is a clinical record, so what it now asserts is set out in full. It was reviewed and accepted by the Repository Lead before being recorded. Four things had moved since 2026-08-22, none of which reopened a term reviewed then:

1. acei and antihypertensives gained ramipril, and statins gained simvastatin. No selector was touched — the catalogue grew from 328 to 330 medications with the cardiovascular set, and the already-reviewed selectors resolved the new drugs.
2. statins and fibrates gained sourceDenySlugs for simvastatin and atorvastatin, because those drugs' own gemfibrozil rows name their own class rather than a second interacting family. Accepted as a narrowing of the same too-broad shape as the three corrections made on 2026-08-22.

The document's scope statement is unchanged and now reads against the recorded hash rather than against a date alone.

Notes

• tests/medication-lexicon-report-signoff.test.ts pinned the state the sheet was in when the test was written — an unsigned 2026-08-22 block — under a name calling that state temporary ("until it is re-recorded with a mappings hash"), so re-recording it turned the fix into a failure. The guard it was actually written for is that the status line is derived and cannot claim a review the recorded hash does not cover; that assertion is untouched and the hardcoded date becomes a shape check. Staleness deliberately stays a generator warning rather than a test failure, so an ordinary lexicon edit does not go red until a clinician is available to re-sign it.
• tests/guard-next-build.test.ts gains three cases for the new cleanup, including one proving production build output survives it. Its scratch-directory cleanup is bounded with maxRetries, per tests/test-runner-safety.test.ts.
• No text is clamped or truncated in any of these cards, deliberately: hiding part of a clinical sentence to win vertical alignment is the wrong trade on these surfaces.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DZmPsaAQSnYjtTLJhS5Xdc

---

Generated by Claude Code

---

Note

Low Risk
Presentation and local build-tooling only, plus a clinical governance document; no runtime API, data, or interaction-routing code changes in this diff.

Overview
Three independent follow-ups: UI alignment on therapy and service detail fact cards, local build guard cleanup, and clinical lexicon sign-off documentation.

Therapy key facts now use the same three-zone layout as form priority-fact cards: header top, face vertically centred in the shared grid height, and a bottom footnote line that always reserves space (CardFootnote with a non-breaking blank when empty). Interactive cards use items-stretch so “Tap for detail” stays pinned at the bottom and row baselines match non-interactive neighbours.

Service priority summary cards add flex flex-col justify-center so short cards centre their content in a row sized by the tallest card instead of hugging the top.

guard-next-build exports and runs discardDevServerTypes() after confirming no dev server is running, recursively removing .next/dev so truncated dev-generated validator.ts cannot break next build typecheck. Production paths under .next/server, .next/static, and .next/types are untouched.

The medication interaction lexicon review sheet is re-signed 2026-09-06 with a mappings hash, documents acceptance of four interim mapping changes (ramipril/simvastatin catalogue growth and sourceDenySlugs on statins/fibrates), and updates the status line. medication-lexicon-report-signoff.test.ts stops pinning a specific stale date and instead asserts the status line matches the derived hash check.

^{Reviewed by Cursor Bugbot for commit 8c6cd55. Configure here.}

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: ffa56660-41fe-4f20-8eba-9826157cec9e

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T11:30:45.005485Z	8c6cd55	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_617ee485-a632-4769-9cb3-8dfe1a2c82ae)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8c6cd557b1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".