Search follow-ups: privacy-safe alias capture, telemetry persistence, loud demo fallback, owner-auth e2e, live chip counts

[BigSimmo]

Summary

The smallest logical fix for each issue left open after #325 (tracked as items 17–25 in docs/rag-hybrid-findings-and-todo.md):

• Item 17 — alias promotion unblocked (partially): weak-search misses now store RET-H4-safe candidate_aliases via new queryVocabularyAliasesForStorage — only canonical terms from the curated clinical vocabulary that the query matched are persisted, so the stored text always comes from the fixed vocabulary table and never from the raw query (a patient name cannot leak). Raw query tokens still require RAG_PERSIST_RAW_QUERY_TEXT=true, unchanged.
• Item 19 — demo fallback made loud: nonProductionSupabaseDemoFallbackReason (the shared choke point for /api/search, /api/answer, /api/answer/stream) now emits a prominent console.warn naming the env vars to check whenever the non-prod demo fallback fires. Behaviour and the X-Clinical-KB-Fallback header are unchanged.
• Item 20 — governance-weighting guard: verified the keys-free structural test already exists (tests/retrieval-selection.test.ts, "keeps relevance ordering and does not let source-governance metadata reorder selection") — marked done in the findings doc, no code needed.
• Item 21 — recalibration data now flowing: synthetic_similarity_count and text_or_relaxation_used were computed by retrieval but dropped by the telemetry whitelist in /api/search; they now persist into rag_retrieval_logs.metadata, giving the future gate recalibration real data.
• Owner-auth e2e: new tests/universal-search-owner-live.test.ts signs in with the E2E_USER_* password user via supabase-js and exercises the real /api/search/universal handler with a genuine bearer token, asserting the owner rung of the access ladder (not demo, not public fixtures). Skips cleanly when live env is absent. Browser-login Playwright coverage is deliberately not attempted — the header sign-in UI is magic-link/OAuth only.
• Cross-mode chips show live counts ("Forms (2)") from the universal typeahead response, only when fresh results exist for the exact current query, so a stale count is never rendered. Includes a React Compiler memoization fix (destructured deps).
• Items 18 / 22 / 23 / 24 / 25 (index-unit HNSW measurement, registry-to-corpus embedding, finding Improve Clinical KB dashboard and RAG hardening #11 Phase 2, OCR dropped-letter repair, retrieval latency): each needs live keys or major scope, so the honest smallest step was upgrading their doc entries from vague notes to concrete, stepped specs with measurement plans.
• Preserves the post-merge branch commit fix: invalidate universal search typeahead when auth changes (rebased onto the new base).

Verification

• npm run verify:cheap — green (1,143 vitest passed; the new owner-live spec skips without keys)
• npm run verify:ui equivalent — ui-universal-search.spec.ts 3/3 on Chromium against a live demo-mode dev server (npm run ensure now works in sandboxed containers thanks to the earlier EAFNOSUPPORT fix)
• npm run verify:release — not run (release gate)
• npm run format:check
• npm run eval:retrieval:quality — no retrieval, ranking, selection, chunking, or scoring behaviour changed in this PR (telemetry persistence, logging, UI, and tests only), so the golden eval is not triggered by this diff; the outstanding run for Universal search: fix core RAG search defects and federate medications/services/forms/differentials/tools into one cross-entity search #325's retrieval changes still applies.
• npm run eval:rag / eval:quality — answer generation untouched
• npm run check:production-readiness behaviour unchanged (the fallback warning is log-only)
• npm run check:deployment-readiness — no deployment behaviour changed

Clinical Governance Preflight

• Source-backed claims still require linked source verification (answer pipeline untouched)
• No patient-identifiable workflow introduced or expanded — the new candidate-alias capture is strictly more conservative than raw retention: stored strings come only from the fixed curated vocabulary table, verified by new tests in tests/privacy.test.ts (a query containing a patient name emits only vocabulary canonicals)
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated — the fallback change only makes the existing demo swap louder
• Source metadata / governance behaviour unchanged; item 20 confirms the structural guard that governance metadata never weights selection ordering
• No clinical decision-support output changed

Notes

• The chip counts and auth-invalidation are the only user-visible changes; everything else is observability, tests, and docs.
• Follow-up specs now concrete enough to execute directly: items 18 (recall measurement plan), 22 (five-step registry-embedding spec with fabrication controls), 23 (finding Improve Clinical KB dashboard and RAG hardening #11 Phase 2), 24 (ingestion-time dictionary repair for OCR), 25 (two measured latency steps).

🤖 Generated with Claude Code

https://claude.ai/code/session_011QiyE8jMm7VnrtknHF6jnJ

---

Generated by Claude Code

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[BigSimmo]

CI status note: all three checks (verify, ui-smoke, Gitleaks) are failing at startup with no logs and empty output — both on the original run and on a re-run. Jobs complete in ~2 seconds without a runner ever executing a step. That signature points to a GitHub Actions account/repo-level block (typically exhausted Actions minutes or a spending-limit/billing hold on a private repo), not to anything in this diff — the same workflows ran green on this repo earlier today (this was run #1415 of the day).

To confirm/resolve: check Settings → Billing → Actions (minutes/spending limit) or the run page banner at https://github.com/BigSimmo/Database/actions/runs/28812592369, then re-run the failed jobs.

For confidence in the meantime, the local equivalents of these gates all passed on this exact head commit: npm run verify:cheap green (1,143 vitest, lint, typecheck, runtime + sitemap checks), ui-universal-search.spec.ts 3/3 on Chromium against a live demo-mode dev server, and format:check clean.

---

Generated by Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.