fix: audit P2/P3 hardening (M13 guard, upload rate limit, P0 carry-over)

[BigSimmo]

Summary

Continues the repo audit remediation after P0/P1 work, on top of latest main.

P0 carry-over (commit 1): RAG cache owner/indexing-version guards, synopsis parity in ranking/detectors, DELETE TOCTOU re-check, worker cache invalidation on job completion, and RAG_QUERY_HASH_SECRET required in production-like readiness checks.

P2 (commit 2):

• M13: search_schema_health() now reports commit_document_index_generation.preserve_legacy_artifacts_migration when the live DB is still running the pre-20260702 commit body. New migration 20260706010000_search_schema_health_m13_guard.sql and npm run check:m13-migration helper.
• Upload hardening: /api/upload consumes the document_upload rate-limit bucket (12/min owner, 3/min anonymous).

P3 disposition (documented in docs/process-hardening.md):

• L9 searchable-only image_count comment in worker/main.ts
• L11 triple readFile already documented at ingestion site
• L18 duplicate audit_logs policy — do not edit applied migrations
• L19 CSP unsafe-inline — accepted risk, deferred

Verification

• Targeted tests: tests/rag-cache-utils.test.ts, tests/supabase-schema.test.ts (60/60 in targeted run; schema M13 guard assertions included)
• Full npm run verify:cheap — blocked in the audit worktree by a slow/incomplete npm ci (next/server resolution); CI should run the full gate on the PR
• npm run eval:retrieval:quality — required before merge because P0 touches RAG cache/selection paths; needs live Supabase + OpenAI keys
• npm run check:m13-migration — run after applying 20260702000000_commit_generation_preserve_legacy_artifacts.sql and 20260706010000_search_schema_health_m13_guard.sql to live Supabase

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• No clinical decision-support scoring/ranking semantics changed in the P2 commit (P0 cache/synopsis parity only)

Live migration follow-up

Apply via normal Supabase migration workflow (if not already live):

1. 20260702000000_commit_generation_preserve_legacy_artifacts.sql
2. 20260706010000_search_schema_health_m13_guard.sql

Then: npm run check:m13-migration, npm run reindex:health, npm run check:indexing

  

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy due to reaching the limit of concurrent preview branches.
Go to Project Integrations Settings ↗︎ if you wish to update this limit.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 4 potential issues.

Bugbot Autofix prepared fixes for all 4 issues found in the latest run.

• ✅ Fixed: Inflight answers repopulate stale cache
  • setCachedAnswer now skips writes when the indexing version captured at retrieval start no longer matches, preventing stale inflight answers from repopulating the cache after invalidation.
• ✅ Fixed: Synopsis omitted from numeric exemption
  • hasNumericOrTableEvidence now uses clinicalResultEvidenceHaystack so synopsis-only numeric dosing qualifies for numericEvidenceExempt penalties.
• ✅ Fixed: Late delete abort wipes cache
  • The late active-job TOCTOU check now runs before deleteDocumentIndexTraceRows so a 409 abort no longer leaves the owner-wide shared cache cleared while the document remains.
• ✅ Fixed: Index unit delete partial wipe
  • document_index_units are deleted first so a failed delete throws before memory cards and sections are removed, avoiding inconsistent partial state.

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 1864748. Configure here.}