* eval(retrieval): add content_mrr@10 passage-rank metric

The golden retrieval eval measured document-level rank (mrr@10, over
expectedDocumentSubstrings) and content-level *recall* (contentRecall@5,
binary "is the answer passage in the top 5"), but nothing measured how HIGH
the answer-bearing passage ranks. That left rerank/chunking changes that lift
the right passage from #5 to #1 unprovable: content recall stays 1.0 across
that move and doc-level mrr is blind to passage order within a document.

Add contentReciprocalRankAt10 — the mean over a case's expected content terms
of the reciprocal rank of the earliest top-10 result carrying that term
(1.0 iff every term rides the rank-1 passage). Surface it in the summary as
content_mrr_at_10, averaged only over cases that declare content terms
(content_mrr_case_count) so structural zeros don't dilute the signal, plus a
per-case contentRR@10 column and the human summary line.

Purely additive: the summary type is inferred, so reindex-eval-gate and the
other summary consumers are unaffected. Guarded by a focused test proving the
metric drops to 0.5 when the answer passage is demoted below a distractor
while content recall stays 1.0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Fix retrieval content MRR scoring

* style: prettier-format eval-retrieval content_mrr scoring

The retrievalLimitForGoldenCase fix landed without a prettier pass, failing
the required verify check (format:check). Formatting-only; no logic change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* eval(retrieval): address Codex review on content_mrr@10 evidence text

Two remaining P2 review findings on the passage-rank metric:

- Quality-eval path truncation: runRetrievalQualityCases (eval-quality.ts) still
  fetched topK=testCase.topK, so content_mrr@10 silently degraded to content_mrr@topK
  for the many fixtures with topK<10. Now uses retrievalLimitForGoldenCase(=max(topK,10)),
  matching the standalone runner. hit@K semantics are unchanged (evaluateGoldenRetrievalCase
  still slices to the case's topK), so only positions 9-10 are exposed for the @10 metric.

- Missing first-class table/visual evidence: resultContentEvidenceText matched table_facts
  and a few image fields but not typed index-unit content or the accessible table markdown /
  table rows, so a hit carrying the answer only in a medication-chart row / risk-matrix cell
  / flowchart step was invisible to contentReciprocalRankAt10. Now includes index_unit
  title+content and image accessibleTableMarkdown + flattened tableRows.

The retrieval_synopsis stays in the evidence text: it is the stored first-class passage
representation used in ranking/display, and the metadata-distractor test already guards the
title/file/section vector that the earlier fix excluded.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

…te guard (#381)

* test: fix WebKit hide-on-scroll flake + guard retrieval owner_filter callsites

Two follow-ups from the 48h PR review.

- tests/ui-tools.spec.ts (#5): the "phone bottom search dock hides while scrolling" test failed on
  WebKit only (release-browser-matrix) because WebKit doesn't reliably emit a native scroll event for
  a programmatic scrollTo, so useHideOnScroll never ran and data-scroll-hidden stayed unset. Dispatch
  an explicit scroll event after each scrollTo; harmless on Chromium/Firefox (the rAF guard dedupes).

- tests/retrieval-owner-filter-guard.test.ts (#3): defense-in-depth tripwire. The SQL
  retrieval_owner_matches fails OPEN on a null owner_filter and RLS is service-role-only, so the app
  filter is the sole tenant boundary. Until the matcher is made fail-closed (gated on the Supabase
  Preview migration-drift fix so the SQL change is verifiable), this asserts every src .rpc()
  owner_filter argument comes from a sanctioned scope helper / the public sentinel, never a literal null.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* style: prettier-format owner_filter guard test

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(test): avoid Dirent.path typing in owner_filter guard (CI @types/node drift)

Use the string-returning readdirSync recursive overload instead of withFileTypes so the scan
doesn't depend on Dirent.parentPath/path, which differ across @types/node versions and failed
the CI typecheck (TS2339 Property 'path' does not exist on Dirent).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>