Never show an all-clear over a medication check that could not run

[BigSimmo]

Summary

• The panel could show a green all-clear over a check that never ran. medication-considerations.tsx rendered a success-toned "No matching considerations" notice whenever the considerations list was empty, and the "Enter eGFR…" hint was a sibling node — so it printed directly beneath the green banner. The empty state now degrades to neutral whenever any gate went unevaluated, mirroring what the interactions block twelve lines below it already did for unresolved rows.
• Missing gates were discarded twice, not once. evaluateRow collected each row's unevaluated inputs, then dropped them if the row had fired on some other gate (contraindication rows included — a row firing on age while eGFR was blank reported no gap at all), and again for every non-contraindication row. Both discards are closed.
• The gates are partitioned rather than merged. unassessed keeps its exact meaning — contraindication rows only — so the result-row verdict's green-to-grey degrade keeps its meaning too. The new unassessedAdvisory carries dose-adjust, caution and monitor rows, 227 of which were previously dropped outright. action: "info" is excluded from both; an unrecognised future action lands in the advisory tier rather than being dropped.
• The hepatic control could not express "None". HepaticSeverity already includes "none" and the engine already treated it as present-and-non-firing, but the panel wrote value === "none" ? null : value and displayed profile.hepatic ?? "none" — so selecting None stored exactly what never touching the field stored, and the control showed "None" for a profile that had recorded nothing. It now has an explicit Not set state and writes "none" through as a real answer.
• The bare-renal fail-safe and its rationale are untouched.

The single widened set the ledger asked for was measured and rejected: it would have taken the share of medications reading "we could not check something" from 39% to 66% of the catalogue, making grey the background state and diluting the contraindication signal that already works. Splitting the tiers keeps that signal intact.

Governance review changed the copy before push

The advisory sentence originally ended "Enter it to see whether it applies." Because this change now also collects gates from rows that fired, a live clinical alert can render directly above that sentence — and it already applies. A clinician could reasonably read the invitation as permission to defer acting on the alert above it. Confirmed against the corpus, not assumed: profile { allergies: ["nsaid"] } against lithium-carbonate-ir-sr fires the renal dose-adjust row on "NSAID allergy" while eGFR stays unread.

The sentence now reads: "Not assessed. 1 dosing and monitoring entry uses eGFR, which this profile does not include. Enter it to complete that check." No user-visible string claims a medication was assessed and found acceptable; none uses "clear", "safe", or "no issues".

Deliberate trade-off, stated

The advisory tier does not feed composeMedicationVerdict, so a prescribing-search row can still show a green verdict while dosing or monitoring gates went unread. That is unchanged from main — but the code now knows and chooses silence, so it belongs in the record rather than only in a test comment. Folding the advisory tier in would grey roughly two thirds of the catalogue on a thin profile and destroy the band's meaning. unassessed is nonetheless a strict superset of what it was, so the verdict degrade fires in more cases than before, never fewer.

Verification

• npm run test (full unit suite) — Test Files 947 passed (947) / Tests 12067 passed | 1 skipped (12068)
• focused four-file run — Test Files 4 passed (4) / Tests 77 passed (77) (re-run after the label change; still 77 passed)
• npm run typecheck — recorded a pass for "typecheck:internal"
• npx eslint on the changed source files — exit 0
• npm run format (whole tree) — no files changed afterwards

Two negative controls. Reintroducing both original defects (forcing the unassessed flag false, restoring the fired-row continue) produced exactly two failures — the empty-state tone assertion and the "keeps collecting a row's remaining gates after it fires" assertion. Restoring the old advisory wording failed the new DOM guard with the defect printed in one line:

AssertionError: expected 'Considerations for this patient1Renal…' not to match /to see whether/i
"…NSAID allergyReduce dose and monitor levels.Not assessed. 1 dosing and monitoring
entry uses eGFR. Enter it to see whether it applies. …"

That is the fired dose-adjust row rendering as a live alert, immediately followed by the invitation to defer it. Both controls were reverted and the suite re-verified green.

npm run test:focused refuses by design here ("Focused test selection is unsafe: test or configuration paths changed") and instructs the full suite, so the full suite is what ran.

Two failures seen on an earlier run of this branch (tests/clinical-hazard-controls.test.ts, tests/rag-plan-package-parity.test.ts) were a shallow-clone artefact — the container held 98 commits and both tests name commits absent from it. After git fetch --deepen=2000 the suite is green as quoted above, with no code change.

Verification not run: npm run check:production-readiness cannot pass in this repository. check:privacy-readiness:release blocks on six release-blocking legal/provider items (OpenAI ZDR, OpenAI and Railway DPAs, APP 8 cross-border basis, APP 1/APP 5 notice, PHI minimisation). The same command on unmodified main at 45a3dca, with no changes, produces identical output — repository state, not a consequence of this diff, and none of those items is touched here.

Verification not run: npm run verify:pr-local was not run; its risk-routed selection adds no failure class this diff can reach beyond the full unit suite already run above.

UI verified in a browser. npm run ensure (server identity confirmed via /api/local-project-id), then Chromium at 320px, 360px and 390px on /medications/lithium-carbonate-ir-sr with the Patient details sheet open.

This caught a real defect that measurement missed. The hepatic segment label was "Not recorded", and in a five-segment layout="equal" control each segment is ~50px at 320px, so it rendered as "Not recor…" directly beside a fully legible "None" — truncating the default state of the one control whose entire purpose is separating "no answer" from "answered: no impairment". A scrollWidth comparison reported no truncation at any width; the screenshot showed it plainly. The label is now "Not set" and all five segments render in full at 320, 360 and 390px.

UI verification not run: the full Chromium journey gate npm run verify:ui was not run because the remaining rendered changes are notice tone and sentence copy, pinned by the new DOM assertions. No routing, layout, chrome-ownership or tap-target change; SegmentedControl supplies the handler, role="radio", aria-checked and min-h-tap, so button-wiring and tap-target contracts are inherited unchanged.

Risk and rollout

• Risk: medium — this changes clinician-facing safety text on the medication panel. The change only ever adds a withheld-input notice and downgrades a green all-clear to neutral, so it cannot hide an existing warning; considerations, counts and highestTone are byte-identical across the whole corpus.
• Rollback: revert this branch's commits. No data, schema or stored state changes, so a revert restores the previous behaviour immediately. A profile saved before this change is not reinterpreted: sanitizeProfile and HEPATIC_LEVELS are untouched, and the stored byte for both "None" and "never touched" was always null.
• Provider or production effects: None
• RAG impact: none

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

Two knowingly-retained gaps, neither a regression, both worth recording rather than discovering later:

action: "info" rows are excluded from both tiers, so a green empty state stays reachable for them. 63 info rows exist, only 8 carry a readable gate, and they affect three medications where both other tiers are empty (nystatin, levetiracetam, lorazepam). Their own source notes justify it — lorazepam's hepatic row describes the drug as the safer option in hepatic impairment, to be shown as information rather than a caution.

isProfileEmpty is unchanged, so a profile whose only entry is hepatic "None" still shows "Enter patient details above" rather than evaluating. Both surfaces degrade conservatively there (no verdict at all in the workspace, no all-clear in the panel), and changing it would make a one-field profile start producing evaluated output — its own change, with its own tests.

This branch is two commits behind main (569d8565, a1aa449a). git merge-tree --write-tree origin/main reports a clean merge, and check:gate-manifest reads only CLAUDE.md and .claude/skills/gates/SKILL.md, neither of which this branch touches — so it is behind, not conflicted, and deliberately not re-synced to avoid restarting CI for nothing.

🤖 Generated with Claude Code

https://claude.ai/code/session_0183EiexuZe6uKqoACXGuANL

---

Note

Medium Risk
Changes clinician-facing safety messaging on the medication detail panel and alert evaluation semantics; impact is conservative (more gaps surfaced, no green all-clear over unread gates) but touches clinical decision-support presentation.

Overview
Stops the medication Considerations panel from showing a green “no matching considerations” notice when contraindication or dosing/monitoring gates were never evaluated. The empty state drops to neutral and calls out incomplete checks, aligned with the interactions block.

evaluatePatientAlerts now keeps missing inputs even when a row fired on another criterion, and splits gaps into unassessed (contraindication only, still driving search verdict grey degrade) versus unassessedAdvisory / unassessedAdvisoryCount (dose-adjust, caution, monitor). The UI shows separate copy for each tier; advisory wording avoids “to see whether it applies” when an alert already fired above.

The hepatic control gains a Not set segment (stored as null) so None (hepatic: "none") is a real assessed answer, not the same as leaving the field blank.

Tests cover tone degradation, tier copy, fired-row gaps, verdict partition, and hepatic UI behavior.

^{Reviewed by Cursor Bugbot for commit d5099a9. Configure here.}

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: f67c0c3f-9f56-477e-ac31-5df7d3638d73

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T06:00:20.058779Z	108f4e5	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_4329ed0d-08aa-4f38-8b2b-e3a6a7fe6906)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_ccf50e7c-2231-44c9-b634-e117065a724d)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_fbc4bf34-3b8e-4a2f-a75f-5e0beb470cd7)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_b4500cf3-28ff-46f8-a69e-5dad90988a3d)

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

• Production UI (3) — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
• PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #15029 (failure).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_33d879be-a7f1-4449-afe2-8405f19f1f01)