diff --git a/AGENTS.md b/AGENTS.md
index 5ba42a7797..199173e26b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -292,12 +292,39 @@ action must perform one; a page that ships must be reachable.
   allowlist (redirect targets / legacy-compat routes). Both run in `verify:cheap` and CI. Mockups
   (`src/app/mockups/**`, `*-mockups.tsx`) are design-scratch and exempt from both — **and from
   nothing else**. Mockups are compiled like any other source: they are typechecked, and their client
-  chunks count toward `check:bundle-budget`'s repo-wide total, so a mockup-only PR can still fail
-  `Build` (PR #1580, `+10.1%` against a 10% tolerance). Do not read "exempt" as "free".
+  chunks are still weighed by `check:bundle-budget` — against the separate `mockups` scratch budget,
+  not the `production` one (reconciled 2026-08-09; see "Bundle budget" below). Do not read "exempt"
+  as "free".
 - **Never** add a production page route without either an inbound link or a documented
   reachability allowlist entry plus an `/issues` note, and never silence the button-wiring rule
   with a blanket disable — wire the control or make it an explicit placeholder.
 
+# Bundle budget
+
+`check:bundle-budget` enforces **two** baselines in `bundle-budget.json`, because one number could
+not honestly answer both questions (`#013` vs `#252`, reconciled 2026-08-09):
+
+- **`production`** — every chunk a non-mockup route reaches, plus chunks no route manifest claims
+  (framework, polyfills, runtime). This is user-facing weight and the real regression guard.
+  Tolerance 10%. A failure here means find the regression; do not refresh the baseline to clear it.
+- **`mockups`** — chunks reachable **only** from `/mockups/**`. Nobody downloads these, so this is a
+  repo-hygiene ceiling for unbounded accumulation, not a per-mockup gate. Tolerance 25%.
+
+A chunk shared by a mockup and a production route counts as production — it would be built either
+way. Attribution comes from the per-route `*_client-reference-manifest.js` files under
+`.next/server/app`; if that tree is missing or resolves no routes the check **fails closed** rather
+than collapsing the two buckets.
+
+Why the split rather than a raised ceiling: measured on `main` at `af85cbc`, the repo-wide total was
++9.96% of the old single baseline — 576 bytes from failing `Build` — while production-only was
+**9.06% below** it. Every byte of the apparent regression was design scratch; production had
+actually shrunk since the baseline was captured. Raising the ceiling would have hidden that.
+
+**Measuring:** `npm run build` reuses a cached `.next`, and the check then reads stale output and
+reports byte-identical numbers — it will tell you the budget passes when it does not. Always
+`rm -rf .next` before measuring, and sanity-check `.next/BUILD_ID`'s mtime against the current
+commit before trusting a number.
+
 <!-- END:page-and-button-wiring -->
 
 <!-- BEGIN:search-chrome-behaviour -->
diff --git a/CLAUDE.md b/CLAUDE.md
index 6db0287af1..0df8978ac9 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -192,11 +192,12 @@ These fail builds, so they are worth knowing before you write code:
 - **Mockups are exempt from two gates, not all of them.** `src/app/mockups/**` and `*-mockups.tsx`
   are design scratch and 404 in production, so they sit outside the **wiring** and **reachability**
   gates — and nothing else. They are still compiled: they are typechecked like any source, and their
-  client chunks still count toward `check:bundle-budget`, which totals **every** built chunk rather
-  than the initial production bundle. A mockup-only PR can therefore fail `Build` on bundle budget
-  (PR #1580: `+10.1% vs baseline`, tolerance 10%) even though the routes never serve a user. Budget
-  scope vs. the "not an initial production bundle" position in `/issues` `#013` is unreconciled —
-  see `#252` before assuming either number governs.
+  client chunks are still weighed by `check:bundle-budget` — but since 2026-08-09 against a separate
+  `mockups` scratch baseline (tolerance 25%), not the `production` one (tolerance 10%). That split
+  reconciled `/issues` `#013` and `#252`: the old single total charged design scratch against a
+  ceiling named as though it were production weight, which is how PR #1580 blocked at `+10.1%` for
+  chunks no user can load. See the "Bundle budget" section in `AGENTS.md`; a mockup-only PR can still
+  fail `Build`, just only on genuine runaway growth.
 
 ## Repo-specific tooling
 
diff --git a/bundle-budget.json b/bundle-budget.json
index acf5fb8c05..00a17a1a36 100644
--- a/bundle-budget.json
+++ b/bundle-budget.json
@@ -1,7 +1,15 @@
 {
-  "$comment": "Client JS bundle-size budget captured from a known-good production build. CI fails when total gzip size grows beyond tolerancePct; refresh intentionally with `npm run check:bundle-budget -- --update`.",
+  "$comment": "Client JS bundle-size budgets captured from a known-good production build. Two numbers, two questions (see scripts/check-bundle-budget.mjs): `production` is what users actually download and is the real regression guard; `mockups` is design scratch that 404s in production and is a repo-hygiene ceiling for unbounded accumulation, not a per-mockup gate. CI fails when either grows beyond its tolerancePct; refresh intentionally with `npm run check:bundle-budget -- --update`.",
   "enforce": true,
+  "production": {
+    "gzipBytes": 1309772,
+    "tolerancePct": 10
+  },
+  "mockups": {
+    "gzipBytes": 273873,
+    "tolerancePct": 25
+  },
+  "totalGzipBytes": 1583645,
   "tolerancePct": 10,
-  "totalGzipBytes": 1440201,
-  "updatedAt": "2026-08-04T09:21:11.952Z"
+  "updatedAt": "2026-08-09T07:31:53.000Z"
 }
diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md
index f155750c95..c6be8bd600 100644
--- a/docs/outstanding-issues.md
+++ b/docs/outstanding-issues.md
@@ -159,19 +159,18 @@ removed after current-main verification; it is not missing recommended work.
 | 104 | `#249` | A3 | High — agent process | Next issues-skill / plan touch | 1–2 hours | Extend issues/plan with an agent-safe wins classifier (optional filter; no new skill unless reused thrice). **Stop:** do not outrank A1 operator work. |
 | 105 | `#250` | A2 | High — multi-agent execution | After Wave 0 queue repair on main (done in this capture); run remaining Wave 0/#202 process gates next on the engineering track | multi-wave | Execute the fastest-wins multi-wave plan (Waves 0–4 + operator track) with parallel agents and per-PR gates. Waves do not outrank A1 acuity. **Stop:** provider/RAG approvals still required where flagged. |
 | 106 | `#251` | Optional | High — agent process | Next handoff/gates doc touch | 15–30 min | Handoff checklist pairs gates skill with verification-router; paste decisive proof line. **Stop:** do not stack broad gates by default. |
-| 107 | `#252` | A2 | High — bundling/gates | Next bundle-budget decision | 1–2 hours | Decide whether check:bundle-budget should exclude mockup chunks or keep counting them as hygiene; do not raise tolerance to clear #1580. **Stop:** do not --update without deciding. |
-| 108 | `#253` | A2 | High — phone results UI | Next open-PR sweep | 15–30 min | Decide #1606's fate: the `MobileResultFilterControl` it rewrites was deleted by #247, so there is nothing left to hand-merge. Verify keyboard parity of the replacement sheet on a real device, then close #1606 as superseded. **Stop:** the decision is a human's; do not close #1606 automatically. |
-| 109 | `#254` | A2 | Operator — Codex Cloud | Before #1617 leaves draft | 1–2 hours | Re-run Codex Cloud acceptance at the exact current head or mark head-independent evidence. **Stop:** do not treat stale pins as coverage. |
-| 110 | `#255` | A2 | High — Cloud/browser gates | Next environment image update | 2–4 hours | Align Cloud Playwright browser builds with lockfile pin; document CI delegation until then. **Stop:** do not force mismatched Chromium revisions. |
-| 111 | `#256` | A2 | High — mode section nav | Next information-page / mode-nav pass | 2–4 hours | Declared information-page section sets whose target ids nothing renders — verify each set against the rendered DOM per route; render anchors or delete the set. **Stop:** do not audit by grepping for `id=` alone (sectionId props exist). |
-| 112 | `#257` | Optional | High — formulation/specifiers flake | Standing until second reproduction | 15–30 min | Single unreproduced ui-formulation flake when run with ui-specifiers — record a second sighting only; do not quarantine until three on the same SHA. **Stop:** do not weaken assertions. |
-| 113 | `#286` | A3 | High — in-page nav + frontend | After owner go-ahead for the information-page series | 1–2 days | Convert the six pill-rail information pages onto `InPageNavHeader`, widen Server Component–safe actions, then delete `informationPageSectionDefinitions`. **Gate:** focused DOM/contract tests + `verify:phone-chrome` for touched owners. **Stop:** do not convert DocumentViewer here; do not verify anchors by grepping `id=` alone. |
-| 114 | `#287` | A3 | High — in-page nav + clinical owner | After `#286`; medications needs an owner product call | 0.5–1 day design + convert | Decide medications tab model, presentations MobileTabs vs `InPageNavHeader`, and factsheets heading→id scheme; convert or record lasting exceptions. **Stop:** do not port medications mechanically. |
-| 115 | `#288` | Optional | High — document chrome | After `#286`/`#287`, or when declaring the series complete | 30–60 min | Confirm DocumentViewer non-adoption (already noted in `docs/search-chrome-behaviour.md`) as the final end state, or schedule a separate convergence PR that leaves pinned `--document-*` CSS names untouched. |
-| 116 | `#289` | A2 | High — auth/identity | Next auth module touch | 1–2 hours | Export a named helper (e.g. `authorizationIdentity(headers)`) from the auth module and use it at every property-access call site; consider a lint rule or branded type so `.Authorization` stops type-checking at all. **Stop:** do not change `authorizationHeadersForAccessToken` to emit uppercase — lowercase is the correct Fetch/Headers convention and callers that pass the object wholesale to `fetch` depend on it. |
+| 107 | `#253` | A2 | High — phone results UI | Next open-PR sweep | 15–30 min | Decide #1606's fate: the `MobileResultFilterControl` it rewrites was deleted by #247, so there is nothing left to hand-merge. Verify keyboard parity of the replacement sheet on a real device, then close #1606 as superseded. **Stop:** the decision is a human's; do not close #1606 automatically. |
+| 108 | `#254` | A2 | Operator — Codex Cloud | Before #1617 leaves draft | 1–2 hours | Re-run Codex Cloud acceptance at the exact current head or mark head-independent evidence. **Stop:** do not treat stale pins as coverage. |
+| 109 | `#255` | A2 | High — Cloud/browser gates | Next environment image update | 2–4 hours | Align Cloud Playwright browser builds with lockfile pin; document CI delegation until then. **Stop:** do not force mismatched Chromium revisions. |
+| 110 | `#256` | A2 | High — mode section nav | Next information-page / mode-nav pass | 2–4 hours | Declared information-page section sets whose target ids nothing renders — verify each set against the rendered DOM per route; render anchors or delete the set. **Stop:** do not audit by grepping for `id=` alone (sectionId props exist). |
+| 111 | `#257` | Optional | High — formulation/specifiers flake | Standing until second reproduction | 15–30 min | Single unreproduced ui-formulation flake when run with ui-specifiers — record a second sighting only; do not quarantine until three on the same SHA. **Stop:** do not weaken assertions. |
+| 112 | `#286` | A3 | High — in-page nav + frontend | After owner go-ahead for the information-page series | 1–2 days | Convert the six pill-rail information pages onto `InPageNavHeader`, widen Server Component–safe actions, then delete `informationPageSectionDefinitions`. **Gate:** focused DOM/contract tests + `verify:phone-chrome` for touched owners. **Stop:** do not convert DocumentViewer here; do not verify anchors by grepping `id=` alone. |
+| 113 | `#287` | A3 | High — in-page nav + clinical owner | After `#286`; medications needs an owner product call | 0.5–1 day design + convert | Decide medications tab model, presentations MobileTabs vs `InPageNavHeader`, and factsheets heading→id scheme; convert or record lasting exceptions. **Stop:** do not port medications mechanically. |
+| 114 | `#288` | Optional | High — document chrome | After `#286`/`#287`, or when declaring the series complete | 30–60 min | Confirm DocumentViewer non-adoption (already noted in `docs/search-chrome-behaviour.md`) as the final end state, or schedule a separate convergence PR that leaves pinned `--document-*` CSS names untouched. |
+| 115 | `#289` | A2 | High — auth/identity | Next auth module touch | 1–2 hours | Export a named helper (e.g. `authorizationIdentity(headers)`) from the auth module and use it at every property-access call site; consider a lint rule or branded type so `.Authorization` stops type-checking at all. **Stop:** do not change `authorizationHeadersForAccessToken` to emit uppercase — lowercase is the correct Fetch/Headers convention and callers that pass the object wholesale to `fetch` depend on it. |
 
 
-<!-- issues:next-id=295 -->
+<!-- issues:next-id=297 -->
 ## Open items
 
 > **Merged-main canary update (2026-07-23, run `30018289898`):** the new structured report correctly recorded evaluated tree `c24f2e8f2d30d0c59fc1eba025d3dcd63478137e`, run/attempt identity and `cross-region-runner` latency context. Golden retrieval remained 36/36 with document/content recall 1.0 and no failed cases. The 44-case answer gate had grounded-supported and unsupported-correct rates of 1.0, but failed because `neuroleptic-side-effect-escalation` again returned one citation where two are required (citation-failure rate 0.0227). `admission-discharge-comparison` again omitted the specific AKG admission document after `comparison_source_extractive_fallback`; `admission-discharge-coverage-paraphrase` was advisory-only at 24,870 ms. Answer cost was reported as `$0.234736`. Do not retry immediately: retain this as the first structured datapoint, compare it with the scheduled 2026-07-26 report, and keep retrieval/ranking unchanged.
@@ -196,7 +195,7 @@ removed after current-main verification; it is not missing recommended work.
 | #056 | P2 | task | Reconcile the existing staging migration history | `Clinical KB Staging` already exists as a healthy, empty Supabase/Railway tier with distinct secrets and no production clinical data, but it is 24 repository migrations behind (ten earlier history holes plus fourteen after `20260719055623`). In the next approved staging schema window, apply the exact missing migration chain, then re-run indexing, health, identity and data-boundary proof. Do not recreate the environment or copy production clinical documents. | current-main staging verification; `docs/staging-setup.md`; `docs/operator-backlog.md` | 2026-07-27 |
 | #057 | P2 | task | Complete staging soak and rollback rehearsal | After #056, run the documented soak and rollback against an exact candidate; retain latency/error/rollback evidence. Stop on unsafe data, identity mismatch, or an unowned rollback decision. | `docs/launch-operator-runbook.md`; `docs/capacity-review.md` | 2026-07-24 |
 | #011 | P3 | task | Auth DB-connection allocation is operator-only | Supabase Auth (GoTrue) is capped at ~10 absolute DB connections (Supabase perf advisor). Switch to **percentage-based** allocation in the Supabase **dashboard** before the first compute scale-up — **not settable via SQL/MCP** (operator-owned). Verify via a staging soak + an approval-gated read-only advisor re-check. | `docs/auth-connection-cap-runbook.md`; `docs/process-hardening.md` (Known follow-up debts) | 2026-07-21 |
-| #013 | P3 | rec | Route-chunk + mockup catalogue JSON weight | Keep this recommendation open and measurement-gated. `build:analyze` still finds route-scoped catalogue modules: `/specifiers` ships `specifiers-search-index.json` (~180 KB parsed), `/forms` ships `forms-catalog.json` (~132 KB), and `/formulation` ships `formulation-content.json` (~52 KB; client-side local search needs an index/full split or a search endpoint). The approved Lighthouse sample covered `/forms`, but `/specifiers` and `/formulation` remain unmeasured, so the precommitted `#017` rule does not permit archiving their payload work. Development-only `*-mockups.tsx` chunks are not an initial production bundle and production returns 404 for `/mockups/*`; do not restructure them without deploy-artifact or cold-start evidence. **Next:** collect route-specific LCP/CLS and CrUX INP evidence for `/specifiers` and `/formulation`, then close only the routes that meet every `#017` threshold. | session 2026-07-21 (`build:analyze`); PR #1470 review | 2026-07-21 |
+| #013 | P3 | rec | Route-chunk + mockup catalogue JSON weight | Keep this recommendation open and measurement-gated. `build:analyze` still finds route-scoped catalogue modules: `/specifiers` ships `specifiers-search-index.json` (~180 KB parsed), `/forms` ships `forms-catalog.json` (~132 KB), and `/formulation` ships `formulation-content.json` (~52 KB; client-side local search needs an index/full split or a search endpoint). The approved Lighthouse sample covered `/forms`, but `/specifiers` and `/formulation` remain unmeasured, so the precommitted `#017` rule does not permit archiving their payload work. **Next:** collect route-specific LCP/CLS and CrUX INP evidence for `/specifiers` and `/formulation`, then close only the routes that meet every `#017` threshold. **Mockup half settled 2026-08-09 (#252):** this row's position that development-only `*-mockups.tsx` chunks are not an initial production bundle is now enforced rather than merely asserted — `check:bundle-budget` weighs `/mockups/**`-exclusive chunks against a separate `mockups` baseline (273,873 gzip bytes, 25% tolerance) and production against its own (1,309,772, 10%), so mockup growth no longer consumes production headroom and the mockup share is reported on every run. That also supplies the separate-reporting measurement this row asked for before any prune: 267.5 KiB across 76 chunks over 66 mockup routes, 17.29% of the repo-wide total. The 'do not restructure them without deploy-artifact or cold-start evidence' guidance stands unchanged — the split removed the false pressure to prune, it did not authorise pruning. | session 2026-07-21 (`build:analyze`); PR #1470 review | 2026-07-21 |
 | #016 | P3 | rec | "Big but not easy" structural + motion perf | Deferred larger levers: (a) nonce-CSP forces every product route to `╞Æ Dynamic` (zero static generation) — evaluate Partial Prerendering / static shells for the static clinical catalogues (DSM/differentials/therapy/specifiers/formulation); (b) sidebar expand/collapse animates `grid-template-columns` (biggest smoothness cost, motion-gated — needs a transform-overlay rethink); (c) Therapy Compass fetches 692 KB / 2.5 MB JSON client-side (defer until interaction + confirm brotli); (d) settings/setup/admin dialogs static-imported into the home chunk (`next/dynamic` them); (e) **DONE 2026-08-01 in PR-T (ds-v2 therapy teardown):** deleted `therapy-compass.css` and removed its route-group layout import — no longer render-blocking on `/`, `/documents`, `/forms`, `/dsm` and every mode home; (f) `shared-search-app-shell.tsx:8` statically imports the `therapy-compass` barrel, pulling `workspace.tsx` + `bindings.tsx` + `nav.tsx` into every `(search-app)` route; (g) three client waterfalls (`use-app-preferences.ts:156-182`, `ClinicalDashboard.tsx:977-1069`, `signed-image.tsx:60-84` + `use-signed-image-url.ts:39`) and the paint offenders in `globals.css` beyond the sidebar grid — three stacked `backdrop-filter` passes on an always-mounted translating element (`:709-748`), `box-shadow` inside a `transition` list (`:677-684`), and `@keyframes shimmer` animating `background-position` on the shared `Skeleton` (`:2289-2296`). **CORRECTED 2026-07-29 on (c):** the Therapy Compass filenames are unversioned and Next serves `/public` with an ETag, so only the FIRST visit pays 690.6 KB / 2,470 KB — repeat visits pay ~4 revalidation round trips. The fix is content-hashed filenames + `immutable` (touching `scripts/build-therapies-index.mjs` and `check:therapy-data-index`), NOT a bare `Cache-Control` line. See `docs/audit/latency-audit-2026-07-28.md` L3-1/L3-2/L3-3/L3-6/L3-7. | session 2026-07-21 (build route table + design audit) | 2026-07-21 |
 | #018 | P2 | task | Split the lithium, ADHD and metabolic residuals by mechanism | Current evidence keeps the mechanisms separate. **Lithium — closed within this item:** the row/atom-aware subject guard, foreign-parameter rejection and query-specific range promotion returned `0.5–1.0 mmol/L` with correct targeting/citation; the full retrieval canary remained 36/36 with recall 1.0 and zero per-case RR regressions, and the full answer canary passed every blocking gate. **ADHD — open corpus debt:** `CG.MHSP.ADHD.pdf` is absent from the hosted corpus and the retrieved chart exposes `accessible_table_count=0`; repair corpus/fixture or ingestion evidence rather than weakening extractive budgets. **Metabolic — open structured-evidence debt:** the standalone plural classifier worsened the live answer and was reverted; obtain auditable schedule text/table evidence before another candidate. | targeted live lithium/ADHD/metabolic evidence 2026-07-27; `docs/evidence/rag-reliability-evidence-2026-07-27.md`; refuted approaches | 2026-07-21 |
 | #022 | P2 | task | Source-governance metadata refresh (operator) | The selected policy is now encoded locally as auditable `third_party_reference_attested` evidence with policy version, reviewer qualification, evidence references and append-only review history. It deliberately preserves `clinical_validation_status=unverified`; malformed, stale or non-BMJ evidence remains review debt. Migration `20260727010000_bmj_third_party_source_attestation.sql` is prepared but was **not applied**. The ten most visible local-document candidates are captured in `docs/evidence/rag-top-local-review-manifest-2026-07-26.json` with `attestation_applied=false`; qualified human review, deliberate hosted apply/attestation, and warning-rate remeasurement remain operator work. | governance worklist; local policy/migration tests; top-ten evidence manifest | 2026-07-21 |
@@ -297,10 +296,9 @@ removed after current-main verification; it is not missing recommended work.
 | #249 | P2 | rec | Extend issues/plan with an agent-safe wins classifier | **Outcome:** /issues and recommendation answers can filter agent-safe short wins (estimate ≤4h, Capability not Operator-only, no RAG/provider, not blocked on a human decision) without inventing a 35th skill. **Next:** add an optional filter/section to the issues skill (and plan/flightplan when useful) that lists those wins from the open table + queue; keep it as procedure on the existing skills unless the classifier is reused thrice — only then mint a thin wins alias. **Stop:** do not weaken acuity ordering; operator A1s still outrank engineering wins. | session 2026-08-05 fastest-wins plan | 2026-08-05 |
 | #250 | P2 | task | Execute the fastest-wins multi-wave plan (Wave 0–4) | **Outcome:** the 2026-08-04/05 fastest-wins plan is executed with parallel agents, correct gates, and no regression. **Acuity first:** the recommended queue remains acuity-ordered — A1 rows (#059/#053/#231/#207/#226) are not demoted by wave numbers. Operator-track items (#022/#183) retain their A2 priority and approval gates. **A1 track (parallel, not a wave):** run approved A1 work (#059/#053/#231/#207/#226) whenever capability/approvals allow — do not wait for Waves 0–3. **Engineering waves only:** 0 = ledger/process gates (#201 resolved 2026-08-06; continue with remaining #202 work); 1A = #147+#176 phone CLS; 1B = #149+#167+#204+#210 gate integrity; 1C = hygiene/docs #232–#236+#223+#157+#151/#154/#187; 2 = #117 then #118; 3 = #098 then #189 (defer #099 body); 4 = remaining non-A1 clinical/UI packaging once approvals exist (never a holding pen for A1 items). **Next:** continue Wave 0/#202 on a fresh branch off origin/main in parallel with any approved A1 work; use gates + verification-router per PR; respect #155 concurrency. **Stop:** no RAG behaviour without flag+canary; no provider gates without approval; do not mix operationalRisk with clinical/UI in one squash. | session 2026-08-05 fastest-wins plan | 2026-08-05 |
 | #251 | P3 | rec | Handoff checklist should pair gates skill with verification-router | **Outcome:** every PR handoff picks the smallest correct gate and pastes the decisive proof line, using verification-router when scope is unclear. **Next:** add one line to handoff/gates productivity defaults: after flightplan, run verification-router (or gates) before claiming green; never report exit 0 alone. **Stop:** do not stack verify:cheap + verify:ui + verify:release by default. | session 2026-08-05 fastest-wins plan | 2026-08-05 |
-| #252 | P2 | issue | check:bundle-budget counts mockup chunks, contradicting #013's initial-bundle position | The budget's totalGzipBytes comes from measureChunkPaths(walkJsFiles(CHUNKS_DIR)) — EVERY built client chunk, including routes that 404 in production. The manifest-scoped initialDashboardChunks set is used only for the fixture-payload assertion, not the budget. So two repo positions disagree about mockups and nothing says so: #013 records that mockup chunks 'are not an initial production bundle' and must not be restructured without deploy-artifact evidence, while the gate charges them against a repo-wide ceiling. PR #1580 is the live cost — a mockups-only PR blocked on 'FAIL +10.1% vs baseline (tolerance 10%)' for chunks no user can load; it has sat red and unmerged since 2026-08-02. Docs now state the mechanism (AGENTS.md gate bullet, CLAUDE.md mockups bullet) so it stops being a surprise, but the metric decision is unmade. Next action: pick one and make the script say so — (a) exclude mockup-only chunks from totalGzipBytes so the number means production weight, which matches #013 but removes all back-pressure on mockup growth (59 routes on main today, 4 more in open PRs); or (b) keep counting them, rename the reported metric so it does not read as production bundle weight, and treat the tolerance as a deliberate hygiene ceiling. Option (b) additionally wants the mockup share reported separately, which is the measurement #013 asks for before any prune. Stop: do not raise the tolerance or run --update to clear #1580 — that discards the only back-pressure without deciding anything. Renumbered from this PR's original #249 → #252 because main claimed #249–#251 via PR #1624. **Headroom measured 2026-08-09 (document viewer Phase 3):** a clean production build reports 306 client chunks, 1538.4 KiB gzip against the 1406.4 KiB baseline captured 2026-08-04 — **+9.4% inside a 10% tolerance**, i.e. roughly 8 KiB gzip of headroom before the gate turns red. That tip measurement was not paired with a merge-base build artifact in the Phase 3 session, so do not treat it as proven pre-existing drift; it still means the next feature-sized PR of any kind can trip the gate whatever it touches, and the mockup-counting question this row is about is what decides whether that would be a real signal. **Next action unchanged, now urgent rather than theoretical:** reconcile the counting scope against #013's initial-bundle position, then either refresh the baseline deliberately (npm run check:bundle-budget -- --update) or narrow what the gate totals. Do not refresh the baseline as an incidental step inside an unrelated PR. | session 2026-08-05 open-PR review; PR #1580 Build log; scripts/check-bundle-budget.mjs; ledger #013 | 2026-08-05 |
 | #253 | P3 | task | #1606 needs a hand-merge against merged PR #1615, not a rebase | SUPERSEDED IN PART 2026-08-07: the component both PRs rewrite no longer exists. `MobileResultFilterControl` — the native `<select>` whose system-blue selected-value highlight #1606 set out to fix — was deleted when every mode moved to `ResultFilterTrigger` + `ResultFilterSheet` (#247). The blue-highlight defect is therefore gone by removal rather than by #1606's portal menu, and #1615's iOS 16px anti-zoom rule no longer applies to any phone results filter (it still governs other native selects; see search-chrome-behaviour rule 5). What is left of this row is a decision, not a merge: #1606 is still open and cannot be rebased onto a function that was deleted. Recommend closing it as superseded rather than hand-merging — but that is a human call, and this row stays open until someone makes it. On keyboard parity, correcting an earlier version of this row that claimed otherwise: `ResultFilterSheet` does NOT use native radio inputs. It is `role="radiogroup"` over buttons with a bespoke roving-tabIndex handler — one tab stop per group, Arrow/Home/End moving focus, selection following except onto a dead end — modelled on `SegmentedControl`. That is the same shape #1606 hand-rolled, so parity is plausible but not free; the DOM tests in `tests/search-results-header-band.dom.test.tsx` pin it, and a real-device pass is still worth doing before closing #1606. The Codex P2 about ArrowDown focusing a disabled placeholder is answered by construction: arrowing onto a dead end moves focus so its note is announced but never commits it, asserted by "puts a dead end on the arrow path without ever selecting it". | session 2026-08-05 open-PR review sweep; PR #1606 (open, dirty, verified live); Codex review thread on search-results-header-band.tsx:696 | 2026-08-05 |
 | #254 | P2 | issue | PR #1617's Codex Cloud acceptance evidence is pinned to a head the branch has moved past | PR #1617 is the surviving side of the Codex Cloud MCP dispute (PR #1613 was closed against it on 2026-08-05), and its whole case rests on one first-hand measurement: a fresh Codex Cloud task reporting 'no Railway tool exposed', 'no Supabase tool exposed', 'no GitHub tool exposed' — zero provider tools from repo-written MCP config — while the hosted OAuth path passed in ChatGPT. That evidence is recorded in docs/audit/cloud-connection-acceptance-2026-08-05.md against task head 76dfe85fa93787b3845d0bd460aa18ff753ca2ca, and the PR body states 'The final branch head is 7d485f88db391cc7e8e73c57ddbde61f532375fc'. The branch head is now bf7684a77ef5fa5d53a1e7891cb7f446d4741e4a, so both pins are stale and the acceptance no longer describes what would merge. This matters more than usual because the acceptance IS the argument: #1613 was closed on the strength of it, and its own merge gate is the kind of exact-head check that a moved head invalidates. Next action: before #1617 leaves draft, re-run the fresh Codex Cloud acceptance at the exact current head and update both the report and the body pin, or state explicitly which parts of the evidence are head-independent (the connector-page absence of Railway/Supabase is a product-surface fact and does not depend on the head; the zero-tool discovery result does). Stop: do not treat the 76dfe85f/7d485f88 evidence as covering the current head, and do not reopen #1613 on the basis that #1617's evidence is stale — staleness is not refutation. Renumbered from this PR's original #251 → #254 because main claimed #249–#251 via PR #1624. | session 2026-08-05 open-PR review sweep; PR #1617 body and docs/audit/cloud-connection-acceptance-2026-08-05.md | 2026-08-05 |
-| #255 | P2 | issue | Remote/Cloud containers cannot run any browser gate: Playwright lock drift plus a missing Chromium build | In the 2026-08-05 remote container, npm run verify:pr-local failed closed at its first precondition — 'check:installed-lock-parity ... playwright: installed 1.62.0 does not match locked 1.62.1' — and Chromium could not launch at all: 'Executable doesn't exist at /opt/pw-browsers/chromium_headless_shell-1234/...' while the image only ships chromium-1194 and chromium_headless_shell-1194. So verify:ui, verify:phone-chrome and verify:release are all unrunnable in a remote session regardless of the diff, and verify:pr-local cannot even reach its selected gates. This is not a one-off 'run npm ci': the installed Playwright disagrees with the lockfile, and installing the locked 1.62.1 would request a browser revision the image also does not carry, so the fix is an image/pin alignment rather than an install. Consequence worth writing down: PRs authored from remote sessions can only produce static and unit evidence locally and must delegate browser proof to CI's Production UI jobs, which is what #1620/#1621/#1622 did — #1621's Chromium evidence came entirely from CI (0 failed of 17, all three Production UI shards). Next action: align the container image's Playwright browser builds with the lockfile pin, or document the delegation explicitly in docs/testing.md so a remote session does not read a fail-closed parity error as a defect in its own change. Related but distinct from #149, which is about the parity checker only comparing seven top-level packages rather than about an actual blocking drift. Stop: do not work around it by setting PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD or pointing executablePath at the mismatched 1194 build to force a green browser run — a browser gate run against the wrong revision is not evidence. Renumbered from this PR's original #252 → #255 because main claimed #249–#251 via PR #1624. **Second reproduction 2026-08-07 (remote container, PR #1670):** identical parity failure, same versions — 'playwright: installed 1.62.0 does not match locked 1.62.1' — two days later on a different image instance, so this is a standing property of the remote image rather than one bad container. New detail: the diff was docs-only (two append-only ledger files), and parity still halted `verify:pr-local` at step 2 of a 10-step plan that contained no browser gate at all. So the blast radius is wider than browser proof: a remote session cannot complete the PR-local gate for ANY scope, and has to re-run the selected steps by hand to get evidence (done there: the remaining eight all passed). That strengthens the documentation half of the next action — docs/testing.md should say a remote session may see this on a diff that never touches a browser. | session 2026-08-05 open-PR review sweep; verify:pr-local and verify:phone-chrome attempts on PRs #1620/#1621 | 2026-08-05 |
+| #255 | P2 | issue | Remote/Cloud containers cannot run any browser gate: Playwright lock drift plus a missing Chromium build | **Reframed 2026-08-09: local browser gates CAN be restored in-container; the image is what still needs fixing.** Previous framing ('cannot run any browser gate ... the fix is an image/pin alignment rather than an install') was half right — the image IS the durable defect, but a session is not stuck waiting for it. Root cause is two independent image faults, not lockfile drift: (1) the baked `node_modules` is stale/incomplete — the 2026-08-09 container shipped none at all, and the earlier one reported `playwright: installed 1.62.0 does not match locked 1.62.1` with `tailwind-merge@3.6.0` entirely absent, which is an incomplete install rather than a version skew, so the lockfile pin was never wrong and must not be moved to 1.62.0; (2) the image's Node is v24.13.0 while `jsdom@30.0.1` requires `^22.22.2 \|\| ^24.15.0 \|\| >=26.0.0`, so `npm ci --include=dev` dies on EBADENGINE under `engine-strict=true` — which is why the obvious fix appeared impossible. Working recipe, verified end to end this session: install Node 24.19.0 (LTS Krypton, npm 11.17.0 — satisfies both the repo's `24.x` engine and jsdom's floor) from nodejs.org, which is reachable through the agent proxy; `npm ci --include=dev` then exits 0 with 0 vulnerabilities and `check:installed-lock-parity` prints `playwright: 1.62.1` for all seven pinned packages. Browsers are a separate step: Playwright 1.62.1 wants Chromium revision **1234** and the image ships only **1194**, so `npx playwright install chromium chromium-headless-shell` (with `PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD` unset) is required; it lands 1234 alongside 1194 under `PLAYWRIGHT_BROWSERS_PATH=/opt/pw-browsers` and `chromium.launch()` then succeeds at `151.0.7922.34`. Cost is roughly 5 minutes and ~330 MB (184 MB chromium + 115 MB headless shell + 32 MB node), needs ~29 GB free, and is paid per session because the container is ephemeral. The original Stop still stands and is now cheap to honour: do NOT set `PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD` or point `executablePath` at the mismatched 1194 build — install 1234 instead. **Next:** durable fix is still the image (ship Node >=24.15.0, a complete `npm ci`, and Chromium 1234); until then the recipe is documented in docs/testing.md so a session neither rediscovers the EBADENGINE dead end nor reads a fail-closed parity error as a defect in its own diff. Related but distinct from #149 (parity checker only compares seven top-level packages). | session 2026-08-05 open-PR review sweep; verify:pr-local and verify:phone-chrome attempts on PRs #1620/#1621 | 2026-08-05 |
 | #256 | P2 | issue | Declared information-page section sets whose target ids nothing renders | A page whose declared section ids nothing renders draws no in-page navigation at all, silently. CONFIRMED and PART-RESOLVED 2026-08-09 (PR 2 of the in-page-nav series). Corrections to the 2026-08-07 diagnosis, measured against origin/main by rendering each page component in jsdom rather than grepping source: (1) the Forms half was STALE — form-detail-page.tsx renders all six declared anchors (form-overview, form-decision-context-mobile, form-priority-facts, form-legal-boundary, form-information, form-source-verification-mobile) plus both -desktop twins; the earlier scan missed them because it looked for testIds. (2) The live gaps were the two DSM routes: /dsm/diagnoses/<slug> declared five and rendered three (key-features and record-summary existed nowhere), and /dsm/diagnoses/<slug>/differentials declared four and rendered one (only dsm-differential-filters, and that on an h2 rather than the section). Both are now wired: the missing anchors were added to the sections that already existed, and the filters id moved from the heading to its section with the heading renamed -title. All six converting routes now mount InPageNavHeader and declare their own PageSection[] beside their markup, so a declaration can no longer drift away from the page it describes. The guard this issue asked for is tests/in-page-nav-route-sections.dom.test.tsx: it renders all seven page components with real records and asserts every declared section id resolves to an element in the DOM, plus the shared scroll-mt token on each, plus present-and-absent cases for the conditional anchors. Remaining: /differentials/presentations/<slug> and Factsheets, both PR 3 of the series. Stop rule unchanged and now enforced by the guard: never audit by grepping for id= alone. | session 2026-08-06 PR #1647; diagnosis 2026-08-07 alongside PR #1679; corrected and part-resolved 2026-08-09 in the in-page-nav PR 2 | 2026-08-06 |
 | #257 | P3 | issue | Single unreproduced ui-formulation flake: keeps specifier and formulation route families clinically separate | Observed once on 2026-08-06 at PR #1647 head f5833acc, running tests/ui-formulation.spec.ts + tests/ui-specifiers.spec.ts together against local Chromium (1 failed, 11 passed). Did NOT reproduce: passed in isolation with --grep, and passed again on a full-file re-run (7/7). Recorded only so a second sighting is recognisable as a second rather than looking like a first. Per docs/testing.md this is one reproduction of three — do NOT quarantine, and do not weaken the assertion. Next: no action unless it recurs; if a second reproduction lands on the same SHA, note it here, and only on a third open a tests/flake-ledger.json entry with @quarantine and a <=30-day expiry. | session 2026-08-06; PR #1647 | 2026-08-06 |
 | #258 | P2 | rec | The PR-handoff stop rule is enforced for Claude Code only; Codex and Cursor get prose with no gate | **Outcome:** a session that opens a PR stops following it in every agent this repo supports, not just Claude Code. **Detail:** PR #1649 added `.claude/hooks/pr-handoff-stop.sh` plus the AGENTS.md "Stop when the pull request is open" section. The hook is registered in `.claude/settings.json`, which only Claude Code reads, so the PostToolUse marker and the PreToolUse denials (shell `gh pr checks/status/view/run watch`, GitHub MCP tools named pull_request/workflow_run/workflow_job/check_run/check_suite/job_log/update_branch, and Monitor/ScheduleWakeup/CronCreate) simply do not exist for Codex or Cursor sessions. Those agents get the AGENTS.md prose and nothing else — and prose alone is exactly what was already in force, and already insufficient, before #1649. Cost is the same long tail of post-handoff CI polling the hook was built to cut, just relocated to whichever agent lacks the gate; a cloud Codex session is the worst case because nothing naturally ends it. **Next:** cheapest first — check whether Codex and Cursor expose any pre-tool interception this repo can register (Codex plugin hooks under `plugins/clinical-kb/`, Cursor rules under `.cursor/`); if neither offers a deny path, the fallback is a shared marker file plus a wrapper the agent is told to route `gh` through, which is weaker but still detectable. If no mechanism exists at all, record that explicitly here so the gap is a known limit rather than an open task. **Stop:** do not weaken the Claude Code hook to make the tools symmetric, and do not add a second copy of the deny list — one script, multiple registrations. | PR #1649; .claude/hooks/pr-handoff-stop.sh; .claude/settings.json; AGENTS.md "Stop when the pull request is open"; session 2026-08-07 | 2026-08-07 |
@@ -333,6 +331,7 @@ removed after current-main verification; it is not missing recommended work.
 | #292 | P2 | rec | Two assistants built the same queued conversion twice because neither workflow checks the open-PR list before starting | **Outcome:** picking up a queued ledger item cannot silently duplicate work another session already has in flight. **Detail:** on 2026-08-09 two assistants took the same queued `/issues` item roughly four hours apart and independently built the same in-page-nav conversion — PR #1766 (merged) and PR #1767 (closed as duplicate). Neither had any way to see the other: the ledger row was the only shared state. Correcting an earlier version of this row after CodeRabbit's review on PR #1773: it is not true that the ledger "has no in-progress state" — some rows do carry a progress marker in their prose (`IN PROGRESS` appears on two, and `IMPLEMENTED in PR #1766` on another). The accurate gap is narrower and worse: there is no structured status field and no atomic claim, so a marker is written by whoever did the work, usually after the fact, and nothing requires or checks one — which means the ABSENCE of a marker carries no information at all. Both sessions read it, both correctly concluded it was open, both built it. The wasted effort is the smaller cost; the larger one is that the two implementations diverged in shape, which is what forced the separate `PageSection` ownership decision recorded in `docs/search-chrome-behaviour.md`. Distinct from `#156`/`#168`, which are about two branches colliding on an **id** while appending; this is two sessions colliding on the **work** a row describes, and a collision-free id scheme would leave it untouched. **Mitigation landed 2026-08-09 (same PR as this row):** the check is now written into the three places an assistant actually reads before starting queued work — `.claude/skills/newtask/SKILL.md` "Before you start" (which already performed an open-PR read for PR bundling, so this asks that same list a second question and costs no extra call), `.claude/skills/issues/SKILL.md` after the read-only flow, and the `/issues` section of `AGENTS.md` so Codex and Cursor get it too rather than Claude Code only. All three say to scan for the **route, component or surface**, not the ledger id, because a duplicate PR rarely quotes the id; all three degrade to a warning when GitHub is unreachable so an offline session can still start work. **Next:** leave open for one or two queued-item cycles to see whether prose is enough. If a second duplicate lands anyway, this becomes the same class as `#258` — a rule enforced for one tool by prose with no gate — and the answer is a check, not more wording. **Stop:** do not implement a claim marker written back into the row when a session starts an item; that reintroduces exactly the read-modify-write contention `#168` exists to remove. Do not make the open-PR read a hard blocker. | session 2026-08-09; PR #1766 (merged); PR #1767 (closed duplicate) | 2026-08-09 |
 | #293 | P2 | issue | Controls declare min-h-tap and compute min-height 0px; a rendered-interactive tap audit needs a deterministic surface first | Two findings, one robust and one that blocked the gate. FINDING 1 (robust, reproduced in ALL SIX runs): controls that carry min-h-tap compute min-height 0px and render far below the 48px floor. Six distinct shapes seen across runs - 'a.inline-flex min-h-tap items-center' 16px, 'a.inline-flex min-h-tap shrink-0' 16.5px, 'button.flex min-h-tap w-full' 26.6px, 'button.grid min-h-tap min-w-tap' 36px, 'button.inline-flex min-h-tap items-center' 16px, 'button.inline-flex min-h-tap min-w-[94px]' 36px. min-h-tap works in general (the existing declared-carrier audit still measures carriers at or above 48px), so these elements have the declaration overridden to 0 rather than the utility being absent; likely an unlayered component class in globals.css, which by design outranks Tailwind utilities here. This was invisible because the pre-existing audit in tests/ui-style-contract.spec.ts only measures elements whose COMPUTED min-height is already at or above the floor (declared < tapFloor - 0.5 continue), so a floor overridden downward is skipped rather than flagged - the same structural blind spot as the h-10 case #265 named. FINDING 2 (why gate 2 did NOT land 2026-08-09): a rendered-interactive enumeration on /services?q=CMHT&run=1 is NOT DETERMINISTIC. Six runs against one production build returned 6, 5, 4, 3, 3 and 9 distinct control shapes, largely disjoint - one run saw answer-suggestion chips and a sort band, another a settled services results list. waitForLoadState('networkidle') plus deduplication to distinct shapes (instance counts measure how many results the query returned, and gave 9 vs 39) did NOT fix it; two consecutive agreeing runs were coincidence, and the next run differed again. The enumeration was written, proven to find real defects, and then REVERTED rather than landed, because tests/ui-style-contract.spec.ts runs in the required Production UI job via productionSpecPattern and scripts/playwright-pr-shards.mjs, so an intermittent version of it would block every merge in the repo. Next, in order: (1) find a deterministic surface for the audit - a static route with no async search, or a fixed seeded state - before re-attempting the enumeration; (2) separately, find what zeroes min-height on the min-h-tap carriers and fix or write a stated exception. Stop: do not re-land the enumeration on a live-search route, do not quarantine a brand-new test to get it merged (quarantine is for keeping flaky tests we already trust, and repo policy needs three reproductions on one SHA via tests/flake-ledger.json), do not lower any production tap target, and never to min-h-11 (known ui-smoke sub-pixel flake; production uses min-h-12). | session 2026-08-09 — M2 gate 2 enumeration (#265) | 2026-08-09 |
 | #294 | P3 | rec | OffscreenCanvas for the PDF raster is unjustified until the page-flip cost is read from CI | **Outcome:** the worker-raster question is settled by a number rather than left as a standing 'optional' item in the redesign plan. **Detail:** docs/plans/document-viewer-redesign-plan.md conditions OffscreenCanvas on 'measured main-thread paint cost'. Phase 3 (Task 5) did not implement it, deliberately: virtualization now keeps the reader's page and one neighbour already rastered, so the cold-render-per-flip cost that motivated a worker raster is largely gone before any threading work starts, and moving pdf.js rendering off the main thread would put the canvas the clinical source is drawn into behind a transfer boundary — a real risk on the one surface where a blank page is a clinical failure. **No number exists yet and none could be produced locally:** pdfjs-dist@6 needs Map.prototype.getOrInsertComputed, which this container's Chromium 141 lacks and Node 24.13.0 also lacks, so neither a browser nor a headless harness here can raster a page (see #279). **Next:** read the measurement the gate already captures. tests/ui-document-canvas.spec.ts attaches page-flip-raster-cost.json (flipToPaintedMs, longTaskCount, longTaskTotalMs, longestTaskMs, canvasBackingPixels) and logs a '[viewer-canvas] page flip painted in Nms' line, on every Production UI run and on any host with the pinned Chromium 151 build: npm ci --include=dev && npx playwright install chromium && npm run ensure && npm run test:e2e -- tests/ui-document-canvas.spec.ts --project=chromium. Close this as not-worth-doing and strike the row from the plan's Phase 3 table only when a Production UI (or equivalent Chromium 151) run records decisive log lines for all three: longestTaskMs comfortably under ~50ms, plus explicit flipToPaintedMs and longTaskTotalMs budgets agreed for that host class and met on the same run. Do not close on longestTaskMs alone. **Stop:** do not implement OffscreenCanvas on principle because the plan lists it — the plan conditions it on the measurement, and the measurement is now cheap to obtain. | session 2026-08-09 document viewer Phase 3, Task 5; docs/plans/document-viewer-phase3-handover.md | 2026-08-09 |
+| #296 | P3 | issue | tests/pr-handoff-stop.test.ts fails whenever the unit suite runs as root | The case 'emits handoff context only when the marker file exists' chmods the fixture git dir to 0o555 to force the marker write to fail, then asserts the hook failed open with no marker. Root ignores permission bits, so the write succeeds and the assertion flips: 'expected true to be false' at tests/pr-handoff-stop.test.ts:180. Confirmed environmental and pre-existing, not diff-induced — reproduced on a clean checkout of af85cbc with every working change stashed (1 failed \| 10 passed), and 'id -u' returns 0 in the remote container. Cost is that 'npm run test' and therefore 'npm run verify:pr-local' cannot reach a clean exit in any root container, so a real regression later in the run is masked by a known-red file and the gate has to be interpreted by hand every time. CI is unaffected because its runner is non-root, which is why this has not surfaced there. Next action: make the test skip or change technique when 'process.getuid?.() === 0' — either skip with an explicit reason, or force the write failure a way root cannot bypass (point the marker path at a directory that does not exist, or at a path whose parent is a file), which is portable and keeps the assertion meaningful for every user. Stop: do not delete the case or relax it to 'marker may or may not exist' — failing open without telling the model that tools are denied is the actual contract it guards. | session 2026-08-09; verify:pr-local run on af85cbc | 2026-08-09 |
 
 
 ## Resolved / archive
@@ -496,4 +495,6 @@ Move resolved rows here with the resolution date and a one-line outcome. Keep th
 | #279 | issue | pdf.js 6 cannot raster in this container's Chromium, so no browser gate covers the viewer canvas | Resolved by tests/ui-document-canvas.spec.ts (Phase 3 Task 0, PR for claude/document-viewer-phase-3-bj5k5v): a Chromium viewer-canvas journey that reads the raster back — non-blank ink pixels on page 1, the real page count in the one toolbar readout, and a page flip whose FNV pixel signature differs from page 1's. Registered in all three hand-maintained lists (playwright.config.ts testMatch + productionSpecPattern, scripts/playwright-pr-shards.mjs productionSpecFilePattern + shard group 3) with a new fail-closed assertion in tests/playwright-project-isolation.test.ts so a future regex edit cannot silently drop it. The container skip is guarded asymmetrically: without CI it skips with a reason naming the browser version, with CI set it FAILS — verified both ways on 2026-08-09 (local run: 3 skipped; CI=1 run: 1 failed at the probe). Measurements re-derived after npm ci and they match the corrected row exactly: playwright-core/browsers.json chromium revision 1234 = 151.0.7922.34, container /opt/pw-browsers/chromium-1194 = 141.0.7390.37, pdfjs-dist 6.2.108 calling Map.prototype.getOrInsertComputed at pdf.mjs:2454/6889/6896. New datapoint: Node 24.13.0 also lacks getOrInsertComputed, so pdf.js 6 cannot be driven headlessly from this runtime either. Neither refuted remedy was actioned. | 2026-08-09 |
 | #264 | task | DS Track A5: gate the six ungated design-system prohibitions | CLOSED 2026-08-09. All six prohibitions named in this row now have a gate. Measured against origin/main 8db1e53937 before writing: FOUR of the six were ALREADY gated and GATES.md said otherwise - border+ring co-occurrence (edgeOwnershipConflicts), the 1px shadow spread check (onePixelShadowSpreads), layout-property animation (layoutTransitionExceptions) and the --shadow-tight alias lint (legacyShadowAliases) are all live ratchets in scripts/design-system-contract-baseline.json, and because findDebtPathRegressions compares per path a new violation in any file already failed. Their section 3 rows read planned; that understatement is what deferred this task twice and is corrected in GATES.md section 5. The dark: override lint closed 7 Aug. Genuinely new here: statusColouredNumerals (ratcheted 2) and colourOnlyStatusIndicators (ratcheted 4) for the colour-boundary rule, and imageInversions pinned at zero for the PDF/diagram/clinical-image invert rule. Also tightened two ratchets carrying stale slack to their measured values - edgeOwnershipConflicts 28 to 27 and legacyShadowAliases 231 to 224 - which closed headroom for up to seven new violations across seven files that had paid debt down without a baseline refresh. All new checks mutation-verified. Recorded debt that remains is NOT this row: the 224 shadow aliases are #262, the 27 edge conflicts and 2 spreads are gate 8 in #265. | 2026-08-09 |
 | #277 | issue | docs/design-system/HANDOVER-2026-08-07.md is cited as provenance by nine ledger rows but is measurably wrong | CLOSED 2026-08-09 as already satisfied — verified against origin/main 8db1e53937, not inferred. Both halves of this row's own 'cheapest fix' are present: docs/design-system/HANDOVER-2026-08-07.md carries a SUPERSEDED IMPORTANT callout naming docs/outstanding-issues.md as the current source of truth, listing the nine citing rows (#261, #262, #264-#270) and enumerating each disproved figure; and docs/design-system/README.md line 12 already reads 'superseded and must not be used to ...'. The file was correctly kept rather than deleted, preserving the nine Source citations as provenance. One note for whoever reads the banner next: its quoted figures have themselves drifted, which is precisely why this row insisted corrections live in the rows and not in the document. Measured today at 8db1e53937: legacyShadowAliases total 224, not the banner's 228, and the manifest reports 53 registered components with 31 product-imported, i.e. 22 unadopted rather than 23. Do NOT edit those numbers into the banner - re-stating live figures in a superseded document is the drift this row exists to stop. Also note the banner did still mislead one session despite existing: the M2 session of 2026-08-09 was scoped from a handover that repeated its claims, and four of #264's six prohibitions turned out to be already gated. The remaining risk is downstream documents copying the figures, not this file. | 2026-08-09 |
+| #252 | issue | check:bundle-budget counts mockup chunks, contradicting #013's initial-bundle position | RESOLVED 2026-08-09. Reconciled with #013 by splitting the one blurred number into two named budgets in scripts/check-bundle-budget.mjs and bundle-budget.json: production (every chunk a non-mockup route reaches, plus chunks no route manifest claims — framework, polyfills, runtime) at 10% tolerance, and mockups (chunks reachable ONLY from /mockups/**) at a deliberately looser 25% as a runaway detector rather than a per-mockup gate. A chunk shared by both counts as production because it would be built either way. Attribution reads the per-route *_client-reference-manifest.js files under .next/server/app (Next 16 webpack emits no app-build-manifest.json) and fails closed when that tree is missing or resolves no routes, so the buckets can never silently collapse. Chose the split over option (a) exclude-and-lose-back-pressure or option (b) rename-and-keep-one-number because the measurement made both inadequate: on a clean build of main at af85cbc the repo-wide total was 1546.5 KiB gzip = +9.96% of the 1406.4 KiB baseline, i.e. 576 bytes from failing Build, while production-only was 1279.1 KiB = 9.06% BELOW that same baseline. Every byte of the apparent regression was design scratch (267.5 KiB across 76 chunks exclusive to 66 mockup routes, 17.29% of the measured total) and production had actually shrunk. Corroborated by docs/audit/latency-audit-2026-07-28.md, which recorded 1,309,274 gzip bytes on 2026-07-28 against 1,309,772 production-only today — production weight is flat to +0.04% over that period, so the 2026-08-04 bump of the single baseline to 1,440,201 had absorbed mockup growth as though it were production growth. Raising the ceiling again would have hidden that permanently. New baselines: production 1,309,772, mockups 273,873. Both fail paths proven to exit 1 against the real build by temporarily lowering each baseline; attribution fail-closed proven by tests/bundle-budget.test.ts. Docs updated in AGENTS.md (new Bundle budget section, incl. the stale-.next measurement trap), CLAUDE.md, docs/plans/document-viewer-phase3-handover.md. | 2026-08-09 |
+| #295 | issue | Factsheet detail renders two h1 elements — hero plus the portaled print sheet | RESOLVED 2026-08-09 as WONTFIX-by-design, with the invariant now asserted instead. Investigated and concluded the print sheet's <h1> is correct and must stay. The two headings are mutually exclusive by construction, so no state ever exposes both to the accessibility tree: on screen `.factsheet-print-sheet { display: none }` removes the print subtree entirely, and in print `html.factsheets-printing body > *:not(.factsheet-print-portal)` is `display: none !important`, which removes the entire shell that owns the hero heading (src/app/globals.css ~3409-3427). Demoting the print sheet to <h2> would be a regression, not a fix: the printed PDF is a separate document whose section headings are already <h2>, so it would ship with no top-level heading and an outline starting at level 2. The real residual was the one this row named — the DOM test had been scoped to the page testid, so the document-level invariant was asserted nowhere and a genuinely stray third <h1> would not have been caught. Closed that instead: tests/factsheet-detail-header.dom.test.tsx now censuses every <h1> in the document, pinning exactly two, one inside the page shell and one inside .factsheet-print-portal, both carrying the factsheet title, plus at least one <h2> in the printed outline. jsdom applies no stylesheet, so a census is the right shape of guard rather than a visibility assertion. No component was moved: FactsheetPrintSheet stays in factsheet-detail-page.tsx, as scripts/design-system-contract-utils.mjs scopes its raw-colour exemption to the literal factsheet-print-sheet marker and fails closed if it moves. 6 tests pass. | 2026-08-09 |
 
diff --git a/docs/plans/document-viewer-phase3-handover.md b/docs/plans/document-viewer-phase3-handover.md
index ac6fe1335f..b018d89f5b 100644
--- a/docs/plans/document-viewer-phase3-handover.md
+++ b/docs/plans/document-viewer-phase3-handover.md
@@ -137,8 +137,10 @@ npm run verify:pr-local
 
 Two gates will move and must not be silenced:
 
-- **`check:bundle-budget`** totals _every_ built chunk against 1,440,201 gzip bytes at 10% tolerance
-  (`bundle-budget.json`). A virtualization dependency would land straight on it — prefer none.
+- **`check:bundle-budget`** weighs production chunks against 1,309,772 gzip bytes at 10% tolerance,
+  and `/mockups/**`-only chunks against a separate 273,873-byte scratch baseline at 25%
+  (`bundle-budget.json`; split from the old single 1,440,201-byte total on 2026-08-09). A
+  virtualization dependency would land straight on the production budget — prefer none.
 - **The `document-viewer` visual golden will shift.** Per ledger `#278` that target composites
   viewport-pinned chrome over content, and its position tracks total content height, so any
   content-height change inflates the diff. Expect it; fix it by narrowing the clip or masking the
diff --git a/docs/testing.md b/docs/testing.md
index 73a75b57fe..04b28a7f7c 100644
--- a/docs/testing.md
+++ b/docs/testing.md
@@ -46,7 +46,28 @@ export PLAYWRIGHT_KEEP_BUILD_ROOT=true
 
 **Refuted levers (do not revive):** persistent Actions cache for the Next webpack tree (~804 MB, evicts browser cache); splitting `ui-phone-scroll*` to rebalance `--shard` (siblings still co-land); renaming specs to game alphabetical shard order; Playwright `workers > 1` or blocking retries; dropping Production UI from ordinary UI PRs; Firefox/WebKit on every PR (main/weekly matrix only).
 
-**Remote / Cloud browser drift.** When `check:installed-lock-parity` fails on `playwright`, or `check:playwright-browser-revision` reports `/opt/pw-browsers` revision drift, do **not** point `PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH` at a mismatched shell. Delegate browser proof to CI Production UI (or refresh the image/install matching browsers). See `#255` and [codex-cloud.md](codex-cloud.md).
+**Remote / Cloud browser drift.** When `check:installed-lock-parity` fails on `playwright`, or `check:playwright-browser-revision` reports `/opt/pw-browsers` revision drift, do **not** point `PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH` at a mismatched shell and do **not** set `PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD` to force a run — a browser gate against the wrong revision is not evidence. Delegating browser proof to CI Production UI is always valid. Restoring the gates locally is also possible; the recipe below was verified end to end on 2026-08-09 (`#255`). See also [codex-cloud.md](codex-cloud.md).
+
+Two separate image faults produce this, and the second is why the obvious fix looks impossible:
+
+1. **The baked `node_modules` is stale or incomplete.** Symptoms range from no `node_modules` at all to `playwright: installed 1.62.0 does not match locked 1.62.1` with `tailwind-merge` missing entirely. The lockfile is not wrong — do not re-pin it to the installed version.
+2. **The image's Node is too old to run `npm ci`.** `jsdom@30.0.1` requires `^22.22.2 || ^24.15.0 || >=26.0.0`; images have shipped v24.13.0, so `npm ci --include=dev` dies on `EBADENGINE` under `engine-strict=true`. Never bypass with `--force`, `--legacy-peer-deps`, or `--engine-strict=false`.
+
+```bash
+# 1. Node >= 24.15.0 (satisfies both the repo's 24.x engine and jsdom's floor).
+curl -sSL -o /tmp/node24.tar.xz https://nodejs.org/dist/v24.19.0/node-v24.19.0-linux-x64.tar.xz
+mkdir -p /root/.node24 && tar -xf /tmp/node24.tar.xz -C /root/.node24/
+export PATH=/root/.node24/node-v24.19.0-linux-x64/bin:$PATH   # node v24.19.0, npm 11.17.0
+
+# 2. Real install. Expect exit 0; then parity prints all seven pinned packages.
+npm ci --include=dev && npm run check:installed-lock-parity
+
+# 3. Browsers. Playwright 1.62.1 wants Chromium 1234; images have shipped only 1194.
+unset PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD
+npx playwright install chromium chromium-headless-shell   # installs into PLAYWRIGHT_BROWSERS_PATH
+```
+
+Costs roughly 5 minutes and ~330 MB (184 MB chromium + 115 MB headless shell + 32 MB node), needs a few GB free, and is paid **per session** because the container is ephemeral. The durable fix is still an image that ships Node ≥ 24.15.0, a complete `npm ci`, and the locked Chromium revision.
 
 Codex Cloud agents remain provider-free. Run authenticated Supabase tests through the
 manual `.github/workflows/authenticated-live-tests.yml` workflow, which requires the
diff --git a/scripts/check-bundle-budget.mjs b/scripts/check-bundle-budget.mjs
index ebdb54cc20..b55aac89af 100644
--- a/scripts/check-bundle-budget.mjs
+++ b/scripts/check-bundle-budget.mjs
@@ -8,10 +8,40 @@
  * client chunks and compares total gzip size against a committed baseline
  * (bundle-budget.json), failing when growth exceeds the tolerance.
  *
- * STATUS: enforced. `bundle-budget.json` carries `enforce: true` and a committed
- * `totalGzipBytes` baseline, so CI fails on >tolerancePct gzip growth.
+ * WHICH QUESTION THIS ANSWERS — two, separately, on purpose.
+ *
+ * It used to answer one blurred question. `totalGzipBytes` summed EVERY built
+ * client chunk, including `src/app/mockups/**` design scratch that 404s in
+ * production, and compared that to a ceiling named as though it were production
+ * weight. Two repo positions then disagreed with nothing to arbitrate them:
+ * `#013` held that mockup chunks "are not an initial production bundle", while
+ * this gate charged them against the ceiling anyway — which is how PR #1580
+ * blocked on "+10.1% vs baseline" for chunks no user can load.
+ *
+ * Measured on `main` at af85cbc (2026-08-09), the blur had become the whole
+ * signal: 1546.5 KiB total was +9.96% of the old baseline — 576 bytes from
+ * failing — while the production-only number was 1279.1 KiB, or 9.06% BELOW
+ * that same baseline. Every byte of the apparent regression was design scratch;
+ * production had actually shrunk. So the split is not a way to raise a ceiling,
+ * it is the only way either number means anything.
+ *
+ *   - `production` — chunks any non-mockup route reaches, plus every chunk no
+ *     route manifest claims (framework, polyfills, runtime). This is user-facing
+ *     weight and the regression guard the budget was written for. Enforced at
+ *     `production.tolerancePct` (default 10%).
+ *   - `mockups` — chunks reachable ONLY from `/mockups/**`. Nobody downloads
+ *     these, so this is a repo-hygiene ceiling that exists to catch unbounded
+ *     accumulation (66 mockup routes today), not to gate the next mockup.
+ *     Enforced at the deliberately looser `mockups.tolerancePct` (default 25%).
+ *
+ * A chunk shared by both is production: it would be built with or without the
+ * mockup. Attribution failures fail the check rather than collapsing the
+ * buckets.
+ *
+ * STATUS: enforced. `bundle-budget.json` carries `enforce: true` and committed
+ * `production.gzipBytes` / `mockups.gzipBytes` baselines.
  *   - After an intentional, known-good production build, run
- *     `npm run check:bundle-budget -- --update` to refresh the baseline.
+ *     `npm run check:bundle-budget -- --update` to refresh both baselines.
  *   - Set `enforce: false` to fall back to warn-only.
  * Reads .next/static/chunks/**.js. If no build output exists it prints a note and
  * exits 0 (so it never breaks a run that didn't build).
@@ -45,6 +75,16 @@ const ROOT_PAGE_CLIENT_REFERENCE_MANIFEST_PATH = path.join(
   "app",
   "page_client-reference-manifest.js",
 );
+const SERVER_APP_DIR = path.join(root, ".next", "server", "app");
+
+/**
+ * Route segment that marks design-scratch routes. `src/app/mockups/**` 404s in
+ * production (see next.config.ts) and is exempt from the wiring and
+ * reachability gates, so its client chunks are not production weight — but they
+ * are still built, so they are still repo weight. Everything downstream of this
+ * constant exists to keep those two facts in separate numbers.
+ */
+export const MOCKUP_ROUTE_SEGMENT = "mockups";
 
 /** Hard ceiling so a stuck stdio drain cannot burn the whole Build job timeout. */
 export const EXIT_FAILSAFE_MS = 1_000;
@@ -104,7 +144,9 @@ export function measureChunkPaths(paths, readFile = readFileSync) {
     measured.push({ name: path.relative(CHUNKS_DIR, full), rawBytes, gzipBytes });
   }
   const largest = [...measured].sort((a, b) => b.gzipBytes - a.gzipBytes).slice(0, 5);
-  return { files: measured.length, totalRawBytes, totalGzipBytes, largest };
+  // `measured` carries names and byte counts only — no buffers — so exposing it
+  // for per-bucket subtotals does not reintroduce the RSS problem above.
+  return { files: measured.length, totalRawBytes, totalGzipBytes, largest, measured };
 }
 
 /**
@@ -120,11 +162,20 @@ export function compareToBudget(current, budget) {
   if (baseline == null) {
     return { status: "warn", reason: "no baseline recorded", overPct: null, baseline, tolerancePct, enforce };
   }
-  const overPct = ((current.totalGzipBytes - baseline) / baseline) * 100;
-  const withinTolerance = overPct <= tolerancePct;
+  // A zero baseline is valid (e.g. `--update` after a build with no mockup-exclusive
+  // chunks). `(0 - 0) / 0` is NaN and would permanently fail an unchanged empty
+  // budget; treat that as within tolerance, and any growth from zero as unbounded.
+  const overPct =
+    baseline === 0
+      ? current.totalGzipBytes === 0
+        ? 0
+        : Number.POSITIVE_INFINITY
+      : ((current.totalGzipBytes - baseline) / baseline) * 100;
+  const withinTolerance = Number.isFinite(overPct) && overPct <= tolerancePct;
+  const overPctLabel = Number.isFinite(overPct) ? overPct.toFixed(1) : "∞";
   return {
     status: withinTolerance ? "ok" : enforce ? "fail" : "warn",
-    reason: withinTolerance ? "within tolerance" : `+${overPct.toFixed(1)}% vs baseline (tolerance ${tolerancePct}%)`,
+    reason: withinTolerance ? "within tolerance" : `+${overPctLabel}% vs baseline (tolerance ${tolerancePct}%)`,
     overPct,
     baseline,
     tolerancePct,
@@ -161,6 +212,105 @@ function loadRootPageClientReferenceManifest() {
   return JSON.parse(source.slice(jsonStart, jsonEnd));
 }
 
+/**
+ * Parse any per-route `*_client-reference-manifest.js` and return the client
+ * chunk names it references. Next 16 (webpack) emits no `app-build-manifest.json`,
+ * so these per-route manifests are the only route -> chunk mapping available.
+ * Returns `null` when the file cannot be decoded so callers can fail closed —
+ * an empty set only means a successfully parsed route with no client chunks.
+ *
+ * @param {string} source raw manifest file contents
+ * @returns {Set<string>|null} chunk names relative to `.next/static/chunks`, or null
+ */
+export function clientChunkNamesFromManifestSource(source) {
+  const names = new Set();
+  const marker = "globalThis.__RSC_MANIFEST[";
+  const start = source.indexOf(marker);
+  if (start < 0) return null;
+  const assign = source.indexOf("]=", start);
+  if (assign < 0) return null;
+  const end = source.lastIndexOf(";");
+  if (end <= assign) return null;
+  let manifest;
+  try {
+    manifest = JSON.parse(source.slice(assign + 2, end));
+  } catch {
+    return null;
+  }
+  for (const clientModule of Object.values(manifest?.clientModules ?? {})) {
+    for (const chunk of Array.isArray(clientModule?.chunks) ? clientModule.chunks : []) {
+      if (typeof chunk === "string" && chunk.endsWith(".js")) {
+        names.add(chunk.replace(/^\/?static\/chunks\//, ""));
+      }
+    }
+  }
+  return names;
+}
+
+/**
+ * Walk `.next/server/app` and split client chunk names into the ones reachable
+ * only from `/mockups/**` and the ones any production route reaches.
+ *
+ * A chunk shared by a mockup route and a production route is **production**: it
+ * would be built regardless of whether the mockup existed, so charging it to
+ * design scratch would understate production weight. Chunks no manifest
+ * references at all (framework, polyfills, webpack runtime) are likewise
+ * production — attribution failures must never shrink the production number,
+ * because that is the number with the enforced ceiling.
+ *
+ * Every discovered `*_client-reference-manifest.js` must decode. Counting a
+ * malformed file toward `routeCount` would bypass the later "none resolved"
+ * checks, and a production parse failure with a surviving mockup parse would
+ * leave shared chunks only in `mockupChunks`, understating the production budget.
+ *
+ * @returns {{
+ *   mockupExclusive: Set<string>,
+ *   routeCount: number,
+ *   mockupRouteCount: number,
+ *   unparseable: string[],
+ * }}
+ */
+export function partitionRouteClientChunks(serverAppDir, deps = {}) {
+  const { readDir = readdirSync, readFile = readFileSync } = deps;
+  const mockupChunks = new Set();
+  const productionChunks = new Set();
+  const unparseable = [];
+  let routeCount = 0;
+  let mockupRouteCount = 0;
+
+  const walk = (dir, isMockup) => {
+    for (const entry of readDir(dir, { withFileTypes: true })) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        walk(full, isMockup || entry.name === MOCKUP_ROUTE_SEGMENT);
+        continue;
+      }
+      if (!entry.isFile() || !entry.name.endsWith("_client-reference-manifest.js")) continue;
+      const names = clientChunkNamesFromManifestSource(readFile(full, "utf8"));
+      if (names == null) {
+        unparseable.push(full);
+        continue;
+      }
+      routeCount += 1;
+      if (isMockup) mockupRouteCount += 1;
+      const target = isMockup ? mockupChunks : productionChunks;
+      for (const name of names) target.add(name);
+    }
+  };
+  walk(serverAppDir, false);
+
+  const mockupExclusive = new Set([...mockupChunks].filter((name) => !productionChunks.has(name)));
+  return { mockupExclusive, routeCount, mockupRouteCount, unparseable };
+}
+
+/** Sum the gzip bytes of the measured chunks whose names are in `names`. */
+export function gzipBytesOf(measuredFiles, names) {
+  return measuredFiles.reduce(
+    (sum, file) => (names.has(file.name.replace(/\\/g, "/")) ? sum + file.gzipBytes : sum),
+    0,
+  );
+}
+
 /** Identify large fixture payloads from stable groups of serialized keys/slugs.
  * Requiring every marker in a group avoids failing on ordinary UI copy that
  * happens to mention one fixture term. */
@@ -294,24 +444,111 @@ export function runBundleBudgetCheck(argv = process.argv.slice(2)) {
   // Drop fixture buffers before the full-tree gzip pass so peak RSS stays low.
   for (const chunk of initialDashboardChunks) chunk.buffer = Buffer.alloc(0);
   const current = measureChunkPaths(chunkPaths);
+
+  // Attribute chunks to production vs design scratch. Fail closed: a broken or
+  // missing route manifest tree must not silently collapse the two buckets,
+  // because "everything is production" inflates the enforced number and
+  // "everything is scratch" would hide a real regression.
+  if (!existsSync(SERVER_APP_DIR)) {
+    console.error(
+      `[bundle-budget] FAIL — no route manifests at ${path.relative(root, SERVER_APP_DIR)}; cannot separate production weight from ${MOCKUP_ROUTE_SEGMENT}/ scratch.`,
+    );
+    return 1;
+  }
+  const { mockupExclusive, routeCount, mockupRouteCount, unparseable } = partitionRouteClientChunks(SERVER_APP_DIR);
+  if (unparseable.length > 0) {
+    console.error(
+      `[bundle-budget] FAIL — ${unparseable.length} route manifest(s) could not be decoded; chunk attribution is broken.`,
+    );
+    for (const full of unparseable.slice(0, 5)) {
+      console.error(`  ${path.relative(root, full)}`);
+    }
+    return 1;
+  }
+  if (routeCount === 0) {
+    console.error("[bundle-budget] FAIL — the route manifest tree resolved no routes; chunk attribution is broken.");
+    return 1;
+  }
+  const mockupRoutesBuilt = existsSync(path.join(SERVER_APP_DIR, MOCKUP_ROUTE_SEGMENT));
+  if (mockupRoutesBuilt && mockupRouteCount === 0) {
+    console.error(
+      `[bundle-budget] FAIL — ${MOCKUP_ROUTE_SEGMENT}/ routes were built but none resolved a client manifest; chunk attribution is broken.`,
+    );
+    return 1;
+  }
+
+  const mockupGzipBytes = gzipBytesOf(current.measured, mockupExclusive);
+  const productionGzipBytes = current.totalGzipBytes - mockupGzipBytes;
   const budget = loadBudget();
 
   if (update) {
-    const next = { ...budget, totalGzipBytes: current.totalGzipBytes, updatedAt: new Date().toISOString() };
+    const next = {
+      ...budget,
+      production: { ...(budget.production ?? {}), gzipBytes: productionGzipBytes },
+      mockups: { ...(budget.mockups ?? {}), gzipBytes: mockupGzipBytes },
+      totalGzipBytes: current.totalGzipBytes,
+      updatedAt: new Date().toISOString(),
+    };
     writeFileSync(BUDGET_PATH, JSON.stringify(next, null, 2) + "\n");
-    console.log(`[bundle-budget] baseline updated to ${kb(current.totalGzipBytes)} gzip (${current.files} chunks).`);
+    console.log(
+      `[bundle-budget] baselines updated — production ${kb(productionGzipBytes)}, ${MOCKUP_ROUTE_SEGMENT} ${kb(mockupGzipBytes)}, total ${kb(current.totalGzipBytes)} gzip (${current.files} chunks).`,
+    );
     return 0;
   }
 
-  const verdict = compareToBudget(current, budget);
+  const enforce = Boolean(budget?.enforce);
+  const productionVerdict = compareToBudget(
+    { totalGzipBytes: productionGzipBytes },
+    {
+      totalGzipBytes: budget?.production?.gzipBytes ?? null,
+      tolerancePct: budget?.production?.tolerancePct ?? 10,
+      enforce,
+    },
+  );
+  // Scratch weight is a runaway detector, not a per-mockup gate: a ceiling tight
+  // enough to fire on the next mockup would just be `--update`d reflexively,
+  // which is worse than no gate. It is always reported, enforced only on a jump.
+  const mockupVerdict = compareToBudget(
+    { totalGzipBytes: mockupGzipBytes },
+    { totalGzipBytes: budget?.mockups?.gzipBytes ?? null, tolerancePct: budget?.mockups?.tolerancePct ?? 25, enforce },
+  );
+
   if (asJson) {
-    console.log(JSON.stringify({ current, verdict, initialDashboardChunks: initialDashboardChunks.length }, null, 2));
+    console.log(
+      JSON.stringify(
+        {
+          current: { ...current, measured: undefined },
+          production: { gzipBytes: productionGzipBytes, verdict: productionVerdict },
+          mockups: {
+            gzipBytes: mockupGzipBytes,
+            chunks: mockupExclusive.size,
+            routes: mockupRouteCount,
+            verdict: mockupVerdict,
+          },
+          initialDashboardChunks: initialDashboardChunks.length,
+        },
+        null,
+        2,
+      ),
+    );
   } else {
     console.log(
-      `[bundle-budget] client chunks: ${current.files} files, ${kb(current.totalGzipBytes)} gzip (${kb(current.totalRawBytes)} raw).`,
+      `[bundle-budget] client chunks: ${current.files} files, ${kb(current.totalGzipBytes)} gzip (${kb(current.totalRawBytes)} raw) across ${routeCount} routes.`,
+    );
+    // Say which question each number answers — the ambiguity these two lines
+    // remove is the whole point of splitting the budget (`#013`/`#252`).
+    console.log(
+      `[bundle-budget] production (what users download, ${routeCount - mockupRouteCount} routes): ${kb(productionGzipBytes)} gzip` +
+        (productionVerdict.baseline != null
+          ? ` — baseline ${kb(productionVerdict.baseline)}, ${productionVerdict.reason}.`
+          : " — no baseline recorded."),
+    );
+    console.log(
+      `[bundle-budget] ${MOCKUP_ROUTE_SEGMENT} (design scratch, 404s in production, ${mockupRouteCount} routes, ${mockupExclusive.size} exclusive chunks): ${kb(mockupGzipBytes)} gzip` +
+        (mockupVerdict.baseline != null
+          ? ` — baseline ${kb(mockupVerdict.baseline)}, ${mockupVerdict.reason}.`
+          : " — no baseline recorded."),
     );
-    if (verdict.baseline != null)
-      console.log(`[bundle-budget] baseline ${kb(verdict.baseline)} gzip; ${verdict.reason}.`);
     console.log("[bundle-budget] largest chunks (gzip):");
     for (const c of current.largest) console.log(`  ${kb(c.gzipBytes).padStart(12)}  ${c.name}`);
     console.log(
@@ -319,18 +556,33 @@ export function runBundleBudgetCheck(argv = process.argv.slice(2)) {
     );
   }
 
-  if (verdict.status === "fail") {
+  let failed = false;
+  if (productionVerdict.status === "fail") {
     console.error(
-      `[bundle-budget] FAIL — ${verdict.reason}. Refresh intentionally with \`npm run check:bundle-budget -- --update\`.`,
+      `[bundle-budget] FAIL — production bundle ${productionVerdict.reason}. This is user-facing weight; find the regression before refreshing the baseline.`,
     );
-    return 1;
+    failed = true;
   }
-  if (verdict.status === "warn" && verdict.baseline == null) {
-    console.log(
-      "[bundle-budget] warn-only: capture a baseline with --update after a known-good build, then set enforce:true.",
+  if (mockupVerdict.status === "fail") {
+    console.error(
+      `[bundle-budget] FAIL — ${MOCKUP_ROUTE_SEGMENT} scratch ${mockupVerdict.reason}. No user loads these chunks, so this is a hygiene ceiling: prune stale mockups, or refresh deliberately with \`npm run check:bundle-budget -- --update\` and say why in the PR.`,
     );
-  } else if (verdict.status === "warn") {
-    console.warn(`[bundle-budget] WARN (not enforced) — ${verdict.reason}.`);
+    failed = true;
+  }
+  if (failed) return 1;
+
+  for (const [label, verdict] of [
+    ["production bundle", productionVerdict],
+    [`${MOCKUP_ROUTE_SEGMENT} scratch`, mockupVerdict],
+  ]) {
+    if (verdict.status !== "warn") continue;
+    if (verdict.baseline == null) {
+      console.log(
+        `[bundle-budget] warn-only: no ${label} baseline — capture one with --update after a known-good build, then set enforce:true.`,
+      );
+    } else {
+      console.warn(`[bundle-budget] WARN (not enforced) — ${label} ${verdict.reason}.`);
+    }
   }
   console.log("[bundle-budget] done.");
   return 0;
diff --git a/tests/bundle-budget.test.ts b/tests/bundle-budget.test.ts
index 9ce7e00d08..56fa9f3d69 100644
--- a/tests/bundle-budget.test.ts
+++ b/tests/bundle-budget.test.ts
@@ -4,13 +4,17 @@ import { tmpdir } from "node:os";
 import path from "node:path";
 import { describe, expect, it, vi } from "vitest";
 import {
+  clientChunkNamesFromManifestSource,
   compareToBudget,
   EXIT_FAILSAFE_MS,
   exitProcess,
   findFixtureSnapshotsInChunks,
+  gzipBytesOf,
   initialDashboardChunkNames,
   measureChunkPaths,
   measureChunks,
+  MOCKUP_ROUTE_SEGMENT,
+  partitionRouteClientChunks,
 } from "../scripts/check-bundle-budget.mjs";
 
 const buf = (n: number) => Buffer.alloc(n, "a"); // highly compressible; gzip < raw
@@ -84,7 +88,8 @@ describe("exitProcess", () => {
 });
 
 describe("check-bundle-budget CLI exit", () => {
-  it("terminates within a deadline after printing success", async () => {
+  /** Minimal build tree: one chunk, a build manifest, and one production route. */
+  function makeSandbox({ withRouteManifests = true } = {}) {
     const sandbox = mkdtempSync(path.join(tmpdir(), "bundle-budget-cli-"));
     const chunksDir = path.join(sandbox, ".next", "static", "chunks");
     mkdirSync(chunksDir, { recursive: true });
@@ -96,15 +101,31 @@ describe("check-bundle-budget CLI exit", () => {
         pages: { "/layout": [], "/page": [] },
       }),
     );
+    if (withRouteManifests) {
+      const appDir = path.join(sandbox, ".next", "server", "app");
+      mkdirSync(appDir, { recursive: true });
+      writeFileSync(
+        path.join(appDir, "page_client-reference-manifest.js"),
+        `globalThis.__RSC_MANIFEST["/page"]=${JSON.stringify({
+          clientModules: { mod: { chunks: ["static/chunks/main.js"] } },
+        })};`,
+      );
+    }
     writeFileSync(
       path.join(sandbox, "bundle-budget.json"),
-      // Baseline well above the tiny fixture chunk so the CLI takes the success path.
-      JSON.stringify({ enforce: true, tolerancePct: 10, totalGzipBytes: 100_000 }),
+      // Baselines well above the tiny fixture chunk so the CLI takes the success path.
+      JSON.stringify({
+        enforce: true,
+        production: { gzipBytes: 100_000, tolerancePct: 10 },
+        mockups: { gzipBytes: 100_000, tolerancePct: 25 },
+      }),
     );
+    return sandbox;
+  }
 
+  function runCli(sandbox: string) {
     const script = path.join(process.cwd(), "scripts/check-bundle-budget.mjs");
-    const started = Date.now();
-    const result = await new Promise<{ code: number | null; stdout: string; stderr: string }>((resolve, reject) => {
+    return new Promise<{ code: number | null; stdout: string; stderr: string }>((resolve, reject) => {
       const child = spawn(process.execPath, [script], {
         cwd: sandbox,
         env: { ...process.env, NODE_OPTIONS: "", BUNDLE_BUDGET_ROOT: sandbox },
@@ -120,7 +141,7 @@ describe("check-bundle-budget CLI exit", () => {
       });
       const killTimer = setTimeout(() => {
         child.kill("SIGKILL");
-        reject(new Error(`CLI hung after success (stdout=${JSON.stringify(stdout)} stderr=${JSON.stringify(stderr)})`));
+        reject(new Error(`CLI hung (stdout=${JSON.stringify(stdout)} stderr=${JSON.stringify(stderr)})`));
       }, 5_000);
       child.on("error", (error) => {
         clearTimeout(killTimer);
@@ -131,7 +152,12 @@ describe("check-bundle-budget CLI exit", () => {
         resolve({ code, stdout, stderr });
       });
     });
+  }
 
+  it("terminates within a deadline after printing done", async () => {
+    const sandbox = makeSandbox();
+    const started = Date.now();
+    const result = await runCli(sandbox);
     try {
       expect(
         { code: result.code, stdout: result.stdout, stderr: result.stderr },
@@ -143,6 +169,49 @@ describe("check-bundle-budget CLI exit", () => {
       rmSync(sandbox, { recursive: true, force: true });
     }
   });
+
+  it("names both budgets so neither number reads as the other", async () => {
+    // The reconciliation of `#013`/`#252` is only real if the output says which
+    // question each number answers.
+    const sandbox = makeSandbox();
+    const result = await runCli(sandbox);
+    try {
+      expect(result.stdout).toContain("production (what users download");
+      expect(result.stdout).toContain(`${MOCKUP_ROUTE_SEGMENT} (design scratch, 404s in production`);
+    } finally {
+      rmSync(sandbox, { recursive: true, force: true });
+    }
+  });
+
+  it("fails closed when chunks cannot be attributed to routes", async () => {
+    // Without attribution the two buckets silently collapse into one, which is
+    // the ambiguity this gate exists to remove.
+    const sandbox = makeSandbox({ withRouteManifests: false });
+    const result = await runCli(sandbox);
+    try {
+      expect(result.code).toBe(1);
+      expect(result.stderr).toContain("cannot separate production weight");
+    } finally {
+      rmSync(sandbox, { recursive: true, force: true });
+    }
+  });
+
+  it("fails closed when a discovered route manifest cannot be decoded", async () => {
+    const sandbox = makeSandbox();
+    const appDir = path.join(sandbox, ".next", "server", "app");
+    mkdirSync(path.join(appDir, MOCKUP_ROUTE_SEGMENT, "demo"), { recursive: true });
+    writeFileSync(
+      path.join(appDir, MOCKUP_ROUTE_SEGMENT, "demo", "page_client-reference-manifest.js"),
+      'globalThis.__RSC_MANIFEST["/mockups/demo"]={truncated',
+    );
+    const result = await runCli(sandbox);
+    try {
+      expect(result.code).toBe(1);
+      expect(result.stderr).toContain("could not be decoded");
+    } finally {
+      rmSync(sandbox, { recursive: true, force: true });
+    }
+  });
 });
 
 describe("compareToBudget", () => {
@@ -173,6 +242,21 @@ describe("compareToBudget", () => {
     const v = compareToBudget({ totalGzipBytes: 1100 }, { enforce: true, tolerancePct: 10, totalGzipBytes: 1000 });
     expect(v.status).toBe("ok");
   });
+
+  it("treats an unchanged zero baseline as within tolerance", () => {
+    // `--update` can record mockups.gzipBytes: 0; (0-0)/0 must not become NaN fail.
+    const v = compareToBudget({ totalGzipBytes: 0 }, { enforce: true, tolerancePct: 25, totalGzipBytes: 0 });
+    expect(v.status).toBe("ok");
+    expect(v.overPct).toBe(0);
+    expect(v.reason).toBe("within tolerance");
+  });
+
+  it("treats any growth from a zero baseline as over tolerance", () => {
+    const v = compareToBudget({ totalGzipBytes: 40 }, { enforce: true, tolerancePct: 25, totalGzipBytes: 0 });
+    expect(v.status).toBe("fail");
+    expect(v.overPct).toBe(Number.POSITIVE_INFINITY);
+    expect(v.reason).toContain("+∞%");
+  });
 });
 
 describe("initial dashboard fixture boundary", () => {
@@ -222,3 +306,125 @@ describe("initial dashboard fixture boundary", () => {
     ).toEqual([]);
   });
 });
+
+describe("production vs mockup chunk attribution", () => {
+  const manifest = (route: string, chunks: string[]) =>
+    `globalThis.__RSC_MANIFEST[${JSON.stringify(route)}]=${JSON.stringify({
+      clientModules: Object.fromEntries(chunks.map((c, i) => [`mod${i}`, { chunks: [`static/chunks/${c}`] }])),
+    })};`;
+
+  /** Build an injectable fake of `.next/server/app` from a path -> contents map. */
+  function fakeTree(files: Record<string, string>) {
+    const readDir = (dir: string) => {
+      const prefix = dir.endsWith("/") ? dir : `${dir}/`;
+      const names = new Set<string>();
+      const out: { name: string; isDirectory: () => boolean; isFile: () => boolean }[] = [];
+      for (const full of Object.keys(files)) {
+        if (!full.startsWith(prefix)) continue;
+        const rest = full.slice(prefix.length);
+        const slash = rest.indexOf("/");
+        const name = slash < 0 ? rest : rest.slice(0, slash);
+        if (names.has(name)) continue;
+        names.add(name);
+        out.push({ name, isDirectory: () => slash >= 0, isFile: () => slash < 0 });
+      }
+      return out;
+    };
+    return { readDir, readFile: (p: string) => files[p] };
+  }
+
+  it("parses chunk names out of a route client-reference manifest", () => {
+    const names = clientChunkNamesFromManifestSource(manifest("/page", ["a.js", "b.js"]));
+    expect(names).toBeInstanceOf(Set);
+    expect([...(names ?? [])]).toEqual(["a.js", "b.js"]);
+  });
+
+  it("returns null rather than an empty set on an unparseable manifest", () => {
+    // Empty set means "decoded, no client chunks"; null is the fail-closed signal.
+    expect(clientChunkNamesFromManifestSource("module.exports = {}")).toBeNull();
+    expect(clientChunkNamesFromManifestSource('globalThis.__RSC_MANIFEST["/x"]={oops;')).toBeNull();
+  });
+
+  it("charges a chunk shared with a production route to production, not to scratch", () => {
+    // `shared.js` is reached by both, so it would be built with or without the
+    // mockup — only `scratch.js` is design-scratch weight.
+    const { readDir, readFile } = fakeTree({
+      "app/page_client-reference-manifest.js": manifest("/page", ["shared.js"]),
+      [`app/${MOCKUP_ROUTE_SEGMENT}/demo/page_client-reference-manifest.js`]: manifest("/mockups/demo", [
+        "shared.js",
+        "scratch.js",
+      ]),
+    });
+    const result = partitionRouteClientChunks("app", { readDir, readFile });
+    expect([...result.mockupExclusive]).toEqual(["scratch.js"]);
+    expect(result.routeCount).toBe(2);
+    expect(result.mockupRouteCount).toBe(1);
+    expect(result.unparseable).toEqual([]);
+  });
+
+  it("treats nested mockup routes as scratch and API route manifests as production", () => {
+    const { readDir, readFile } = fakeTree({
+      "app/api/answer/route_client-reference-manifest.js": manifest("/api/answer", ["api.js"]),
+      [`app/${MOCKUP_ROUTE_SEGMENT}/a/b/page_client-reference-manifest.js`]: manifest("/mockups/a/b", ["deep.js"]),
+    });
+    const result = partitionRouteClientChunks("app", { readDir, readFile });
+    expect([...result.mockupExclusive]).toEqual(["deep.js"]);
+    expect(result.mockupRouteCount).toBe(1);
+    expect(result.unparseable).toEqual([]);
+  });
+
+  it("leaves chunks no route claims on the production side", () => {
+    // Framework/polyfill/runtime chunks appear in no manifest. They must not
+    // drift into the scratch bucket, which would understate production weight.
+    const { readDir, readFile } = fakeTree({
+      [`app/${MOCKUP_ROUTE_SEGMENT}/demo/page_client-reference-manifest.js`]: manifest("/mockups/demo", ["scratch.js"]),
+    });
+    const { mockupExclusive } = partitionRouteClientChunks("app", { readDir, readFile });
+    const measured = [
+      { name: "framework.js", gzipBytes: 100 },
+      { name: "scratch.js", gzipBytes: 40 },
+    ];
+    expect(gzipBytesOf(measured, mockupExclusive)).toBe(40);
+    const total = measured.reduce((sum, f) => sum + f.gzipBytes, 0);
+    expect(total - gzipBytesOf(measured, mockupExclusive)).toBe(100);
+  });
+
+  it("reports no routes when the manifest tree is empty, so the caller can fail closed", () => {
+    const { readDir, readFile } = fakeTree({});
+    expect(partitionRouteClientChunks("app", { readDir, readFile }).routeCount).toBe(0);
+  });
+
+  it("surfaces a malformed mockup manifest instead of counting it as resolved", () => {
+    // Counting before parse let one valid root + one truncated mockup exit 0
+    // while the mockup budget silently measured nothing.
+    const { readDir, readFile } = fakeTree({
+      "app/page_client-reference-manifest.js": manifest("/page", ["main.js"]),
+      [`app/${MOCKUP_ROUTE_SEGMENT}/demo/page_client-reference-manifest.js`]:
+        'globalThis.__RSC_MANIFEST["/mockups/demo"]={truncated',
+    });
+    const result = partitionRouteClientChunks("app", { readDir, readFile });
+    expect(result.unparseable).toEqual([`app/${MOCKUP_ROUTE_SEGMENT}/demo/page_client-reference-manifest.js`]);
+    expect(result.routeCount).toBe(1);
+    expect(result.mockupRouteCount).toBe(0);
+    expect([...result.mockupExclusive]).toEqual([]);
+  });
+
+  it("surfaces a malformed production manifest so shared chunks cannot drift to scratch", () => {
+    // Asymmetric case: production fails to parse, mockup still parses. Without
+    // fail-closed attribution, `shared.js` would only appear in mockupChunks and
+    // be subtracted from the production budget.
+    const { readDir, readFile } = fakeTree({
+      "app/page_client-reference-manifest.js": 'globalThis.__RSC_MANIFEST["/page"]={truncated',
+      [`app/${MOCKUP_ROUTE_SEGMENT}/demo/page_client-reference-manifest.js`]: manifest("/mockups/demo", [
+        "shared.js",
+        "scratch.js",
+      ]),
+    });
+    const result = partitionRouteClientChunks("app", { readDir, readFile });
+    expect(result.unparseable).toEqual(["app/page_client-reference-manifest.js"]);
+    expect(result.routeCount).toBe(1);
+    expect(result.mockupRouteCount).toBe(1);
+    // Caller must fail before trusting mockupExclusive; do not compute budgets from this.
+    expect(result.unparseable.length).toBeGreaterThan(0);
+  });
+});
diff --git a/tests/factsheet-detail-header.dom.test.tsx b/tests/factsheet-detail-header.dom.test.tsx
index aa40115f9d..fd7724cf75 100644
--- a/tests/factsheet-detail-header.dom.test.tsx
+++ b/tests/factsheet-detail-header.dom.test.tsx
@@ -15,8 +15,8 @@ describe("factsheet detail header", () => {
   it("keeps the record title as the on-screen page's only h1", () => {
     // The header title is a `<span>`; the hero owns the heading. Two `<h1>`s
     // with the same text is the failure this guards. Scoped to the shell: the
-    // print sheet is portaled to <body> and carries its own `<h1>`, but it is
-    // `display: none` on screen and predates this header.
+    // print sheet is portaled to <body> and carries its own `<h1>`, which the
+    // next test pins as deliberate rather than accidental.
     const { factsheet } = renderFactsheet("sertraline");
     const page = screen.getByTestId("factsheet-detail-page");
     const headings = within(page).getAllByRole("heading", { level: 1 });
@@ -24,6 +24,36 @@ describe("factsheet detail header", () => {
     expect(headings[0]).toHaveTextContent(factsheet.title);
   });
 
+  it("accounts for every h1 in the document: the hero and the print sheet, never both visible", () => {
+    // The document carries exactly two `<h1>`s and they are mutually exclusive
+    // by construction, so neither state ever exposes two to the accessibility
+    // tree (`#295`):
+    //   - on screen, `.factsheet-print-sheet { display: none }` removes the
+    //     print sheet's subtree entirely;
+    //   - in print, `html.factsheets-printing body > *:not(.factsheet-print-portal)`
+    //     is `display: none !important`, removing the shell that owns the hero.
+    // The print sheet is a separate printed document with its own outline (its
+    // section headings are `<h2>`), so demoting its `<h1>` would leave the
+    // exported PDF with no top-level heading. jsdom applies no stylesheet, so
+    // the guard is this census rather than a visibility assertion: the previous
+    // testid-scoped check alone would not have caught a third `<h1>` appearing
+    // anywhere outside the page shell.
+    const { factsheet } = renderFactsheet("sertraline");
+    const page = screen.getByTestId("factsheet-detail-page");
+    const printPortal = document.querySelector(".factsheet-print-portal");
+    expect(printPortal).not.toBeNull();
+
+    const allHeadings = screen.getAllByRole("heading", { level: 1 });
+    expect(allHeadings).toHaveLength(2);
+    for (const heading of allHeadings) expect(heading).toHaveTextContent(factsheet.title);
+
+    expect(allHeadings.filter((heading) => page.contains(heading))).toHaveLength(1);
+    expect(allHeadings.filter((heading) => printPortal!.contains(heading))).toHaveLength(1);
+    // The printed document starts at h1 and descends; nothing in it may outrank
+    // its title.
+    expect(within(printPortal as HTMLElement).getAllByRole("heading", { level: 2 }).length).toBeGreaterThan(0);
+  });
+
   it("names the way back without spending the row on its label", () => {
     renderFactsheet("sertraline");
     const back = screen.getByRole("link", { name: "Back to all factsheets" });