fix(db): fully reconcile retrieval_owner_matches drift + harden PUBLIC-execute on retrieval helpers

docs/database-drift-detection.md

@@ -106,13 +106,18 @@ live project need explicit operator approval.
    `match_document_chunks_text` / `match_document_table_facts_text` (richer
    multi-strategy), `match_document_chunks_hybrid` (left-join quality_score),
    plus `match_documents_for_query`, `get_related_document_metadata`,
-   `retrieval_owner_matches`, `match_document_memory_cards_hybrid`,
-   `repair_strict_enrichment_gate_batch`. Applying the OLD `20260705210000`
-   bodies would regress live, so it is neutralized. Codify the **live** bodies
-   into schema.sql + a new migration (a generation script, not hand-editing —
-   the bodies are complex and actively churning) so the repo matches live and a
-   `db push` never regresses it. These are the currently-allowlisted retrieval
-   entries.
+   `match_document_memory_cards_hybrid`, `repair_strict_enrichment_gate_batch`.
+   Applying the OLD `20260705210000` bodies would regress live, so it is
+   neutralized. Codify the **live** bodies into schema.sql + a new migration (a
+   generation script, not hand-editing — the bodies are complex and actively
+   churning) so the repo matches live and a `db push` never regresses it. These
+   are the currently-allowlisted retrieval entries.
+   - **Partially reconciled 2026-07-08:** `retrieval_owner_matches` was in this
+     group by mistake — its **body is identical** to schema.sql; it only drifted
+     on `search_path` (live `pg_catalog` vs repo `pg_temp`) and ACL. The
+     search_path half is now codified into schema.sql + the manifest `def_hash`
+     (verified read-only against live via `schema_drift_snapshot`); only the
+     PUBLIC-execute ACL remains allowlisted, same as `search_document_chunks`.
 1. ✅ **DONE 2026-07-08** — applied `20260706010000`, `20260706130000`,
    `20260706200000`, `20260707000000` to live (verified). `check:drift` can now
    run against live once a service-role key is available in the environment.

supabase/drift-allowlist.json

@@ -110,7 +110,7 @@
       "category": "functions",
       "key": "public.retrieval_owner_matches(uuid,uuid)",
       "kind": "mismatch",
-      "reason": "LIVE IS AHEAD of the repo: live carries newer raw-SQL retrieval bodies (e.g. match_document_chunks has an hnsw.ef_search=100 wrapper; chunks_text/table_facts_text carry richer multi-strategy implementations). Migration 20260705210000 (which had OLDER bodies) was NEUTRALIZED 2026-07-08 so a db push can never regress live. DO NOT apply it. Resolution is forward-codification of the live bodies into schema.sql + a migration (drift backlog); until then these are allowlisted. Note: live retrieval RPCs are under active concurrent multi-session edits.",
+      "reason": "ACL-only drift: live retains a default PUBLIC execute grant (=X/postgres) that schema.sql (service-role-only) does not. Same posture as search_document_chunks — this is a security-invoker helper, RLS still applies; revoke on live via an approved hardening migration, then remove. The prior search_path half of this drift (live pg_catalog vs schema.sql pg_temp) was reconciled 2026-07-08: schema.sql + drift-manifest def_hash now match live's body (verified read-only via schema_drift_snapshot). This function is a stable boolean owner-scoping helper — NOT one of the raw-SQL retrieval RPCs (match_document_chunks et al.) whose bodies genuinely diverge; do not conflate.",
       "ref": "docs/database-drift-detection.md#reconciliation-backlog"
     },
     {

supabase/drift-manifest.json

@@ -2,7 +2,7 @@
   "generated_at": "2026-07-08T06:45:01.039Z",
   "generator": "scripts/generate-drift-manifest.ts",
   "postgres_image": "supabase/postgres:17.6.1.127",
-  "schema_sha256": "430046a9221f4060286c2208800ef794eef407af8997fd4582f414de95e88c44",
+  "schema_sha256": "f7ca50611471d4ced647bfc7731d72f87856bd03890f03eaca8e0ccb8affc6b0",
   "replay_seconds": 13,
   "snapshot": {
     "views": [
@@ -5930,7 +5930,7 @@
           "postgres=X/postgres",
           "service_role=X/postgres"
         ],
-        "def_hash": "2dff50fc9bc17ee3c6d71c9dcf9cee5e",
+        "def_hash": "1d88b539bded5aa40393125f672b8cab",
         "signature": "public.retrieval_owner_matches(uuid,uuid)"
       },
       {

supabase/schema.sql

@@ -2047,7 +2047,7 @@ returns boolean
 language sql
 immutable
 parallel safe
-set search_path = public, pg_temp
+set search_path = public, pg_catalog
 as $$
   select case
     when owner_filter is null then true