chore(deps): bump node from 24-bookworm-slim to 26-bookworm-slim in the docker-images group

.claude/hooks/session-start.sh

@@ -1,8 +1,8 @@
 #!/bin/bash
 # SessionStart hook for Claude Code on the web.
-# The app is engine-strict on Node >=24.15 <25 / npm 11.x, but web containers
+# The app is engine-strict on Node >=26.0.0 <27 / npm 11.x, but web containers
 # ship an older Node on PATH, so nothing installs or runs until a Node meeting
-# that floor is present. Installs one into $HOME/.node24 (cached with the
+# that floor is present. Installs one into $HOME/.node26 (cached with the
 # container), exposes it via $CLAUDE_ENV_FILE, and installs npm dependencies.
 set -euo pipefail
 
@@ -12,17 +12,16 @@ fi
 
 payload="$(cat 2>/dev/null || true)"
 
-NODE_VERSION="24.19.0"
+NODE_VERSION="26.8.1"
 # Keep in step with the floor in package.json engines.node. A matching major is
-# not enough: dev dependencies (jsdom) carry a minor-level floor, so a 24.13 on
-# PATH satisfied the old major-only check and then failed `npm ci` with
-# EBADENGINE. That blocked PRs #1611, #1697, #1705 and #1740.
-NODE_MINIMUM="24.15.0"
-# Exclusive major ceiling, matching the "<25" half of engines.node. Checking only
-# the floor would let a container shipping Node 25+ skip provisioning and then
+# not enough: keep the complete range check so a future minor-level floor cannot
+# let an older Node 26 runtime reach `npm ci` and fail with an opaque EBADENGINE.
+NODE_MINIMUM="26.0.0"
+# Exclusive major ceiling, matching the "<27" half of engines.node. Checking only
+# the floor would let a container shipping Node 27+ skip provisioning and then
 # fail `npm ci`, which is the same blind-spot as the major-only check above.
-NODE_MAJOR_CEILING="25"
-NODE_HOME="$HOME/.node24"
+NODE_MAJOR_CEILING="27"
+NODE_HOME="$HOME/.node26"
 NODE_BIN="$NODE_HOME/node-v${NODE_VERSION}-linux-x64/bin"
 
 supported_runtime() {

.claude/skills/issues/SKILL.md

@@ -36,7 +36,7 @@ the report; record that fetch separately because the report itself performs no p
 
 If a filter is given, filter the open items before rendering steps 2–3, then show only matching
 queued tasks and matching non-queued items: `/issues P1` (by priority), `/issues issues` /
-`/issues recs` / `/issues tasks` (by type), `/issues <keyword>` (summary/detail substring match).
+`/issues recs` / `/issues tasks` (by type), `/issues ward` (Ward Flow tasks only via `npm run issues:report -- --ward --json`), `/issues core` (repository/platform tasks excluding Ward Flow via `npm run issues:report -- --core --json`), `/issues <keyword>` (summary/detail substring match via `npm run issues:report -- --filter <keyword> --json`).
 
 `/issues wins` or `/issues agent-safe` runs
 `npm run issues:report -- --agent-safe-wins --json`. The classifier includes only queued work

.claude/skills/run-pr/SKILL.md

@@ -44,7 +44,7 @@ Never, even during a sweep:
 2. `mcp__github__get_me` to confirm identity and access, then `git fetch origin --prune`.
 3. Record the current branch/ref so it can be restored at sweep end. Require a clean
    `git status`; if the worktree is dirty, do not stash or discard — either restrict the sweep to
-   PRs whose fixes do not need this checkout, or create a separate `git worktree add` (Node 24,
+   PRs whose fixes do not need this checkout, or create a separate `git worktree add` (Node 26,
    `npm ci`) and report which was chosen.
 4. `mcp__github__list_pull_requests` with `state=open`, paginated in small batches. Build the work
    queue in ascending PR number.

.github/workflows/claude.yml

@@ -64,7 +64,7 @@ jobs:
           fetch-depth: 1
       - name: Run Claude Code
         if: ${{ env.CLAUDE_CODE_OAUTH_TOKEN != '' }}
-        uses: anthropics/claude-code-action@dcb57747bfceeaa1fa72638cae52295d1d853d4a # v1.0.199
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10 # v1.0.210
         with:
           # The action's default trigger phrase is "@claude"; it reads the
           # triggering comment/review and acts on the current PR head.

.github/workflows/codex-run-pr-operator.yml

@@ -426,7 +426,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.15.0
+          node-version: 26.8.1
           cache: npm
 
       - name: Install locked dependencies without repository lifecycle scripts

.github/workflows/live-web-vitals.yml

@@ -86,7 +86,7 @@ jobs:
       - name: Use the repository Node runtime
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "24"
+          node-version: "26"
 
       - name: Normalize the configured origin
         run: |

.node-version

@@ -1 +1 @@
-24
+26

.nvmrc

@@ -1 +1 @@
-24
+26

Dockerfile

@@ -1,8 +1,8 @@
 # syntax=docker/dockerfile:1
 # PsychSift app tier (Next.js). See docs/deployment-architecture.md.
 #
-# The repo is engine-strict (Node 24.x / npm 11.x via .npmrc + preinstall
-# guard), so every stage pins the same Node 24 base image. The build stage
+# The repo is engine-strict (Node 26.x / npm 11.x via .npmrc + preinstall
+# guard), so every stage pins the same Node 26 base image. The build stage
 # runs the repo's own `npm run build` (guard-next-build + next build) so the
 # image build fails exactly where a local build would.
 #
@@ -18,7 +18,7 @@
 # NEVER baked into the image — inject them at run time from the host's
 # secret store.
 
-FROM node:24-bookworm-slim@sha256:235600a8101ab264e117b1768e925532262668dc9b581ef1dd7d96ced463b8e7 AS node-base
+FROM node:26-bookworm-slim@sha256:367679cf9792759492a486e4aa4b421764d71a9546a6dae8aab81a99eb797b3e AS node-base
 
 FROM node-base AS deps
 WORKDIR /app

Dockerfile.worker

@@ -4,7 +4,7 @@
 # container instead of completing the edge-agent migration.
 #
 # Runtime contents (2026-07-13 audit, finding 12 — slimmed):
-#   - Node 24 + PRODUCTION-ONLY node_modules: the worker runs as a
+#   - Node 26 + PRODUCTION-ONLY node_modules: the worker runs as a
 #     prebuilt esbuild bundle (dist/worker/index.mjs), so tsx and the rest
 #     of the dev toolchain never reach the image.
 #   - Tesseract OCR (Debian package, bundles English language data).
@@ -27,7 +27,7 @@
 # `server-only` marker to the standalone stub at build time (the job
 # run-tsx.mjs previously did at runtime) and keeps npm packages external,
 # so the bundle resolves them from the runner's production node_modules.
-FROM node:24-bookworm-slim@sha256:235600a8101ab264e117b1768e925532262668dc9b581ef1dd7d96ced463b8e7 AS node-base
+FROM node:26-bookworm-slim@sha256:367679cf9792759492a486e4aa4b421764d71a9546a6dae8aab81a99eb797b3e AS node-base
 
 FROM node-base AS build
 WORKDIR /app

README.md

@@ -7,7 +7,7 @@ questions with source citations that link back to the original PDF/document.
 
 ## Setup
 
-1. Use Node.js 24.x with npm 11.x. CI runs on Node 24, and `.nvmrc` /
+1. Use Node.js 26.x with npm 11.x. CI runs on Node 26, and `.nvmrc` /
    `.node-version` pin the same runtime for local version managers. CI also runs
    `npm run check:edge:functions`, which requires Deno v2.x.
 2. Install dependencies:

bundle-budget.json

@@ -9,6 +9,12 @@
     "gzipBytes": 627814,
     "tolerancePct": 25
   },
+  "serverPages": {
+    "/mockups/development/review-state": {
+      "rawBytesCeiling": 2500000,
+      "gzipBytesCeiling": 350000
+    }
+  },
   "routes": {
     "/": {
       "gzipBytes": 285184,

data/calculators/evidence.json

@@ -0,0 +1,135 @@
+{
+  "sources": [
+    {
+      "id": "source:governance",
+      "issuer": "PsychSift",
+      "title": "Calculator clinical-safety governance record",
+      "type": "internal_governance_record",
+      "version": "2026-09-01",
+      "url": "https://github.com/BigSimmo/Database/blob/main/docs/superpowers/specs/2026-09-01-calculators-clinical-safety.md",
+      "jurisdiction": "Australia",
+      "status": "reviewed",
+      "claimsSupported": [
+        "claim:phq9:interpretation",
+        "claim:phq9:safety-flag",
+        "claim:gad7:interpretation",
+        "claim:k10:interpretation",
+        "claim:cage:interpretation",
+        "claim:auditc:interpretation",
+        "claim:mdq:interpretation",
+        "claim:sadpersons:interpretation",
+        "claim:ybocs:interpretation"
+      ],
+      "limitations": ["Records the release decision and does not replace an instrument source."]
+    },
+    {
+      "id": "source:phq9",
+      "issuer": "Kroenke, Spitzer & Williams",
+      "title": "The PHQ-9: Validity of a Brief Depression Severity Measure",
+      "type": "journal_article",
+      "version": "2001 validation study",
+      "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC1495268/",
+      "jurisdiction": "International",
+      "status": "reviewed",
+      "claimsSupported": ["claim:phq9:interpretation"],
+      "limitations": [
+        "A completed score supports assessment and monitoring; it is not a diagnosis or management decision."
+      ]
+    },
+    {
+      "id": "source:gad7",
+      "issuer": "Spitzer et al.",
+      "title": "A Brief Measure for Assessing Generalized Anxiety Disorder",
+      "type": "journal_article",
+      "version": "2006 validation study",
+      "url": "https://pubmed.ncbi.nlm.nih.gov/16717171/",
+      "jurisdiction": "International",
+      "status": "reviewed",
+      "claimsSupported": ["claim:gad7:interpretation"],
+      "limitations": ["A completed score supports anxiety assessment and does not establish a diagnosis."]
+    },
+    {
+      "id": "source:k10",
+      "issuer": "Australian Bureau of Statistics",
+      "title": "Kessler Psychological Distress Scale (K10)",
+      "type": "government_information_paper",
+      "version": "2003 information paper",
+      "url": "https://www.abs.gov.au/ausstats/abs%40.nsf/papersbyReleaseDate/4D5BD324FE8B415FCA2579D500161D57",
+      "jurisdiction": "Australia",
+      "status": "reviewed",
+      "claimsSupported": ["claim:k10:interpretation"],
+      "limitations": ["The K10 measures psychological distress and is not a diagnostic category."]
+    },
+    {
+      "id": "source:cage",
+      "issuer": "Ewing",
+      "title": "Detecting alcoholism: The CAGE questionnaire",
+      "type": "journal_article",
+      "version": "1984 original article",
+      "url": "https://pubmed.ncbi.nlm.nih.gov/6471323/",
+      "jurisdiction": "International",
+      "status": "reviewed",
+      "claimsSupported": ["claim:cage:interpretation"],
+      "limitations": ["CAGE is a lifetime problem-drinking screen and does not assess current use or withdrawal."]
+    },
+    {
+      "id": "source:auditc",
+      "issuer": "Australian Government Department of Health",
+      "title": "Australian standard drinks guide",
+      "type": "government_web_guidance",
+      "version": "Current web guidance",
+      "url": "https://www.health.gov.au/topics/alcohol/about-alcohol/standard-drinks-guide",
+      "jurisdiction": "Australia",
+      "status": "reviewed",
+      "claimsSupported": ["claim:auditc:interpretation"],
+      "limitations": ["The standard-drink reference does not establish a diagnosis or management decision."]
+    },
+    {
+      "id": "source:mdq",
+      "issuer": "Hirschfeld et al.",
+      "title": "Development and validation of a screening instrument for bipolar spectrum disorder",
+      "type": "journal_article",
+      "version": "2000 validation study",
+      "url": "https://pubmed.ncbi.nlm.nih.gov/11058490/",
+      "jurisdiction": "International",
+      "status": "permission_review_required",
+      "claimsSupported": ["claim:mdq:interpretation"],
+      "limitations": ["Quarantined pending approval of digital-use rights and completion semantics."]
+    },
+    {
+      "id": "source:sadpersons",
+      "issuer": "Patterson et al.",
+      "title": "Evaluation of suicidal patients: the SAD PERSONS scale",
+      "type": "journal_article",
+      "version": "1983 original article",
+      "url": "https://pubmed.ncbi.nlm.nih.gov/6867245/",
+      "jurisdiction": "International",
+      "status": "not_for_active_use",
+      "claimsSupported": ["claim:sadpersons:interpretation"],
+      "limitations": ["Not released for active score-based clinical decision support."]
+    },
+    {
+      "id": "source:ybocs",
+      "issuer": "Goodman et al.",
+      "title": "The Yale-Brown Obsessive Compulsive Scale. I. Development, Use, and Reliability",
+      "type": "journal_article",
+      "version": "1989 original article",
+      "url": "https://pubmed.ncbi.nlm.nih.gov/2684084/",
+      "jurisdiction": "International",
+      "status": "permission_review_required",
+      "claimsSupported": ["claim:ybocs:interpretation"],
+      "limitations": ["Quarantined because the current generic anchors are not a verified Y-BOCS implementation."]
+    }
+  ],
+  "claims": [
+    { "id": "claim:phq9:interpretation", "sourceIds": ["source:phq9", "source:governance"] },
+    { "id": "claim:phq9:safety-flag", "sourceIds": ["source:phq9", "source:governance"] },
+    { "id": "claim:gad7:interpretation", "sourceIds": ["source:gad7", "source:governance"] },
+    { "id": "claim:k10:interpretation", "sourceIds": ["source:k10", "source:governance"] },
+    { "id": "claim:cage:interpretation", "sourceIds": ["source:cage", "source:governance"] },
+    { "id": "claim:auditc:interpretation", "sourceIds": ["source:auditc", "source:governance"] },
+    { "id": "claim:mdq:interpretation", "sourceIds": ["source:mdq", "source:governance"] },
+    { "id": "claim:sadpersons:interpretation", "sourceIds": ["source:sadpersons", "source:governance"] },
+    { "id": "claim:ybocs:interpretation", "sourceIds": ["source:ybocs", "source:governance"] }
+  ]
+}