fix(#030): distinct-document expected-file coverage + stale PR body template cleanup

[BigSimmo]

Summary

Follow-up self-review of the #30/#75 fixes that landed in #1177, run against current main. Two real defects survived that merge, and both are fixed here.

• Potential fix for code scanning alert no. 1: Workflow does not contain permissions #30 re-entry through duplicate citations. The merged fix assigned each expectation to a distinct source position. Positions are not documents: answer.citations carries one entry per cited chunk, so one combo-titled document arrives several times and still filled both comparison slots. Coverage now dedupes the window by document text.
• Order-dependent coverage. First-come assignment let a document matching two expectations consume the only source a narrower expectation needed, so identical inputs produced different allHit results depending on expectedFiles order. Coverage now assigns sources by maximum bipartite matching.

Also linear (was quadratic) label accumulation in resolveSearchScope, since paging past the 1,000-row cap (#75) means that loop now sees the full label set, plus ledger hygiene: the stale #030/#075 recommended-queue row is dropped now that both are archived, the #1177 review row's zero-padded placeholder SHA is corrected by an appended record, and #80 opens the question of re-testing the removed admission-to-discharge widening under approved eval evidence.

The third defect found in review — the stale PR_POLICY_BODY.md on main, which made sync-pr-policy-body overwrite each new PR's description with the audit-remediation body (that is how #1177 lost its own) — was fixed here and then landed independently in #1201, so it no longer appears in this diff. This PR's own description surviving intact is the evidence that path is closed.

RAG impact: no retrieval behaviour change — eval matching and label bookkeeping only; imputation formulas, comparator key order, alias tiers, clamps, and release ranking are untouched.

Verification

• npm run verify:pr-local — pass (lint, typecheck, full unit suite, production build, client-bundle secret scan, offline RAG fixtures 36 golden cases / 21 suites)
• npm run verify:cheap — pass on the current merged head (3403 passed, 5 skipped)
• Focused Vitest 39/39: tests/eval-document-matching.test.ts, tests/eval-utils.test.ts, tests/eval-search.test.ts, tests/search-scope.test.ts, tests/rag-imputation-contract.test.ts
• Fail-closed proof: both new contracts fail against origin/main's matcher (expected true to be false, expected false to be true) and pass with the fix
• npm run check:branch-review-ledger, npm run check:pr-policy — pass
• UI verification not run: no UI, routing, or styling change
• eval:retrieval:quality not run: no retrieval, ranking, selection, chunking, or scoring behaviour changed — this is eval scoring bookkeeping over already-retrieved sources
• Live evals / provider-backed gates not run: offline-only change, and they require explicit approval

Risk and rollout

• Risk: expectedFileCoverage is stricter for repeated documents and more permissive where an optimal assignment exists, so multi-slot eval cases can change verdict — in the correct direction in both cases. Single-expectation cases (the majority) are unchanged, since anyHit semantics are identical.
• Rollback: revert the fix(#030) commit; the docs commits are independent.
• Provider or production effects: None.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

• Harden document-mode smoke switching follow-up #80 is deliberately left open rather than acted on: restoring the user-approved 2026-07-21 admission widening is now safe from a false-pass standpoint, but it is an eval ground-truth change and needs a measured canary pair, not offline reasoning.

  

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Warning

Review limit reached

@cursor[bot], you've reached your PR review limit, so we couldn't start this review.

Next review available in: 42 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 419aa917-60f9-467f-875d-dde1c7f60b94

📥 Commits

Reviewing files that changed from the base of the PR and between 1aa64e9 and c0db5f5.

📒 Files selected for processing (5)

• docs/branch-review-ledger.md
• docs/outstanding-issues.md
• src/lib/eval-document-matching.ts
• src/lib/search-scope.ts
• tests/eval-document-matching.test.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/eval-matching-distinct-identity-6273

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}