Summary

• Harden RAG answer routing for clozapine blood-count/withhold threshold queries: require blood-count and withhold/stop language in the same sentence before treating retrieval as explicit action evidence, and block table_threshold extractive shortcuts when retrieval gaps/conflicts are actionable.
• Extract answer-quality helpers into src/lib/rag-extractive-answer.ts and restore default OpenAI SDK retry budget for answer generation (remove maxRetries: 0).
• Add registry corpus embedding tooling (scripts/embed-registry-records.ts, src/lib/registry-corpus.ts) and document hybrid-RAG/registry findings in docs/rag-hybrid-findings-and-todo.md.
• Add scheduled/manual live-drift.yml workflow with service-role key scoped only to drift-check steps (not npm ci).
• Add JSDoc coverage across PR-touched RAG/registry modules to satisfy governance docstring threshold.

Verification

• npm run verify:cheap — lint, typecheck, and 1412 unit tests passed locally (2026-07-09)
• npm run verify:ui when UI, routing, styling, browser behavior, reduced-motion, or forced-colors behavior changed
• npm run verify:release before release or handoff confidence claims
• npm run format:check — passed after Prettier on touched source files
• npm run eval:retrieval:quality (must stay 36/36) when retrieval, ranking, selection, chunking, or scoring behavior changed — ran locally as npm run eval:retrieval:quality -- --force-embedding: passed with document_recall_at_5=1, content_recall_at_5=1, top_k_hit_rate=1, force_embedding_failure_count=0, failed_cases=[] (documented in docs/rag-hybrid-findings-and-todo.md)
• npm run eval:rag -- --limit 15 + npm run eval:quality -- --rag-only when answer generation, the synthesis prompt, or answer post-processing changed (grounded-supported must not drop; citation-failure 0)
• npm run check:production-readiness when clinical workflow, privacy, environment, Supabase, source governance, or deployment behavior changed
• npm run check:deployment-readiness when deployment startup, hosting, or rollout behavior changed

Clinical Governance Preflight

Complete this section when the change touches ingestion, answer generation, search/ranking, source rendering, document access, privacy, production env, or clinical output.

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

• Post-registry embed retrieval eval command recorded explicitly: npm run eval:retrieval:quality -- --force-embedding (36/36, recall metrics 1.0).
• Registry corpus write path still uses separate documents + document_chunks upserts with client-side rollback on chunk failure; atomic Postgres RPC remains a follow-up (CodeRabbit data-integrity comment deferred to avoid scope creep in this docs/routing PR).
• Remaining product blockers from registry embed workstream: citation failure rate 0.0227 and RAG latency thresholds — not introduced by this routing/docs pass.