Fully reconciles the retrieval_owner_matches schema/live drift and closes the related PUBLIC-execute drift on search_document_chunks. Two logically-grouped commits.

1. search_path reconciliation (commit f7e3d91)

schema.sql declared set search_path = public, pg_temp for retrieval_owner_matches, while live and both migrations (20260705210000, 20260708150000) use public, pg_catalog. schema.sql was the sole outlier → fresh-replay def_hash diverged from live. Verified read-only against live (sjrfecxgysukkwxsowpy) via schema_drift_snapshot(): body byte-identical, def_hash 1d88b539…. Behaviour-identical (pg_catalog is the safer choice for an immutable function).

• supabase/schema.sql — pg_temp → pg_catalog (this fn only).
• supabase/drift-manifest.json — def_hash → live value; schema_sha256 recomputed.

2. PUBLIC-execute hardening — applied to live (commit ba45ed2)

Both retrieval_owner_matches and search_document_chunks retained the default PUBLIC EXECUTE grant on live, drifting from schema.sql's declared blanket posture (revoke execute on all functions in schema public from public, anon, authenticated + grant to service_role).

Safety verified before applying — both are server-only, so revoking PUBLIC is behaviour-neutral:

• search_document_chunks is called via the service-role admin client (src/app/api/documents/[id]/search/route.ts), which keeps execute.
• retrieval_owner_matches is only invoked nested inside retrieval RPCs that run as service_role.
• RLS still applies to these security-invoker functions regardless.

Applied to live via Supabase MCP (recorded version 20260708150150); verified read-only that both ACLs are now {postgres,service_role} (PUBLIC removed), matching the manifest. Security advisor: no lints.

• New migration supabase/migrations/20260708150150_harden_retrieval_public_execute.sql — idempotent; no-op on schema.sql-provisioned/preview envs. Version matches live's recorded migration history (no version-stamp drift).
• supabase/drift-allowlist.json — removed both now-resolved entries.
• docs/database-drift-detection.md — recorded the reconciliation.

Scope note

Three other functions carry the same PUBLIC-execute drift (document_summary_text(uuid), detect_legacy_ivfflat_indexes(), set_document_embedding_field_content_hash() — the last a trigger fn whose ACL is cosmetic). Left out of this PR: they weren't in scope and their nested-call safety wasn't individually verified. Same one-line pattern applies if you want a follow-up.

Verification

• tests/supabase-schema.test.ts — 42/42 pass.
• prettier --check on all edited files — pass.
• Live cross-checks via schema_drift_snapshot() / pg_proc.proacl (read-only), security advisor clean.
• Not run: check:drift (needs live service-role key in env), drift:manifest (Docker OOM here) — both covered by the read-only live verification. Manifest was hand-edited (documented, same as fix(db): remove phantom ingestion_job_stages.job_id FK to match live (R24e) #389).

Clinical Governance Preflight

DB schema/grants only; no clinical-output behaviour change. Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy). The one live change is a privilege revoke (tightening), applied via MCP and verified; service-role access remains server-only. No patient-data workflow touched.

🤖 Generated with Claude Code