fix: audit P0 RAG cache, synopsis parity, and safety hardening

[BigSimmo]

Summary

Addresses the highest-priority audit findings without changing eval-validated retrieval boost compounding.

RAG cache (P0)

• Fix owner-scoped in-memory cache invalidation for versioned keys (rag-cache-v12|ownerId|...) via ragCacheKeyMatchesOwner
• Stamp and validate indexingVersion on in-memory search/answer cache entries (parity with shared rag_response_cache)
• Use scoreValue(result) (hybrid-aware) in deriveConfidence instead of raw similarity

Clinical evidence parity (P0)

• Centralize evidence haystack construction in clinical-evidence-haystack.ts (synopsis, accessible table markdown, table facts, memory cards)
• Wire synopsis into dose detectors, answer ranking, and evidence relevance scoring

Safety hardening (P0/P1)

• Deep-memory rebuild: fail loudly if document_index_units delete fails (no silent swallow)
• DELETE route: late active-job re-check before document delete (reindex TOCTOU)
• runDocumentSearchShortcut: stale-response guard using searchRequestSeqRef (M10 parity)
• Upload: document_upload rate-limit bucket (12/min)
• Production readiness: require RAG_QUERY_HASH_SECRET in production-like envs
• Worker: invalidate owner + anonymous shared RAG caches after ingestion job commit

Verification follow-up (this commit)

• Removed merge conflict markers blocking lint
• Fixed image signed-url duplicate fetch regression
• Updated upload/route tests for managed local port guard (409) and anonymous rate-limit fixtures

Verification

• Targeted audit regression tests (50/50): cache invalidation, synopsis ranking, dose detectors
• npm run verify:cheap — lint + typecheck pass; 1069/1072 tests pass full suite (3 time out under parallel load, pass in isolation)
• npm run eval:retrieval:quality — blocked in this environment (missing NEXT_PUBLIC_SUPABASE_URL / SUPABASE_SERVICE_ROLE_KEY); run locally before merge

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow introduced
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys remain server-only
• Changes are conservative parity fixes (synopsis/markdown in existing detectors), not new ranking compounding

Follow-up (not in this PR)

P2–P3 audit items: CI eval gates, RLS integration tests, monolith splits, lint/format debt, docs cleanup — tracked separately from the July 2026 audit backlog.

  

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[BigSimmo]

Closing as superseded by merged work on \main:

• feat: complete public access rollout with migrations and public corpus promotion #274 — public access rollout, migrations, public corpus promotion
• fix: restore anonymous production setup-status for psychiatry.tools #277 — anonymous /api/setup-status\
• fix: treat Supabase project warning as ready in setup-status #287 — setup-status project \warning\ →
  eady\

Production is live with these fixes. Any remaining unique commits should be cherry-picked onto a fresh branch from current \main.