RAG and ingestion audit follow-up (24 Oct): remaining fixes, plus two database migrations for the owner's own merge

data/outstanding-issues-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": "outstanding-issues-snapshot-v2",
   "ledger_revision": {
-    "committed_at": "2026-10-22"
+    "committed_at": "2026-10-23"
   },
   "counts": {
     "open": 94,

data/repo-awareness-snapshot.json

@@ -5326,6 +5326,11 @@
         "section": "decisions",
         "catalogued": true
       },
+      {
+        "path": "docs/decisions/2026-10-25-licence-withdrawal-leaves-answers.md",
+        "section": "decisions",
+        "catalogued": true
+      },
       {
         "path": "docs/source-acquisition-protocol.md",
         "section": "root",

docs/audit/tenancy-defense-in-depth-review.md

@@ -455,8 +455,8 @@ guard until it is reviewed. Entries live in `DERIVED_QUERY_INVENTORY` in
 | `src/app/api/eval-cases/route.ts`                 | `document_chunks`      | `ownedChunkReference`                                     | reviewed-indirect                    | Read-then-verify: selects only `id,document_id`, then calls `ownedDocumentId` on the returned `document_id` and returns null unless it belongs to the requester.                                                                                                                                                                                                                            |
 | `src/app/api/images/[id]/signed-url/route.ts`     | `document_images`      | `GET`                                                     | parent-document-verified             | Image row fetched by id, then its parent document resolved through `withOwnerReadScope`; 404 and nothing signed unless the parent is visible.                                                                                                                                                                                                                                               |
 | `src/app/api/images/signed-urls/route.ts`         | `document_images`      | `POST`                                                    | parent-document-verified             | Batch form of the same pattern (`/api/documents/images/batch` is a bare re-export of this module); only images whose parent survived `withOwnerReadScope` are signed.                                                                                                                                                                                                                       |
-| `src/app/api/ingestion/jobs/route.ts`             | `ingestion_jobs`       | `GET` (×2)                                                | documents-inner-join                 | Page query and active-count query both join `documents!inner` and filter `.eq("documents.owner_id", user.id)` on the chain itself.                                                                                                                                                                                                                                                          |
-| `src/app/api/ingestion/jobs/[id]/retry/route.ts`  | `ingestion_jobs`       | `POST` (×2)                                               | documents-inner-join                 | Pre-recovery state read and post-recovery re-read both join `documents!inner` and filter `.eq("documents.owner_id", user.id)` on the chain.                                                                                                                                                                                                                                                 |
+| `src/app/api/ingestion/jobs/route.ts`             | `ingestion_jobs`       | `GET` (×3)                                                | reviewed-indirect                    | Administrator-only. All three chains join `documents!inner` and allow the administrator's own documents or shared public-library documents (`owner_id.eq.<user>,owner_id.is.null`); widened 2026-10-25 (ING-S-N7).                                                                                                                                                                          |
+| `src/app/api/ingestion/jobs/[id]/retry/route.ts`  | `ingestion_jobs`       | `POST` (×2)                                               | reviewed-indirect                    | Administrator-only. Both reads join `documents!inner` and allow the administrator's own document or a shared public-library document; the handler re-checks the joined owner before recovery. Widened 2026-10-25 (ING-S-N7).                                                                                                                                                                |
 | `src/app/api/ingestion/quality/route.ts`          | `ingestion_jobs`       | `GET`                                                     | owner-scoped-id-list (`documentIds`) | `.in("document_id", documentIds)` from the handler's `.eq("owner_id", user.id)` documents query.                                                                                                                                                                                                                                                                                            |
 | `src/app/api/ingestion/quality/route.ts`          | `ingestion_job_stages` | `GET`                                                     | owner-scoped-id-list (`documentIds`) | Same owner-scoped id list.                                                                                                                                                                                                                                                                                                                                                                  |
 | `src/app/api/ingestion/quality/route.ts`          | `document_pages`       | `GET`                                                     | owner-scoped-id-list (`documentIds`) | Same owner-scoped id list. This one reads page `text`, so it is the highest-value derived read in the handler.                                                                                                                                                                                                                                                                              |

docs/branch-review-index.md

@@ -15,14 +15,14 @@ Retention and rotation: [`branch-review-archival-policy.md`](branch-review-archi
 
 ## Summary
 
-- Records: 744
-- Distinct ref cells: 472
-- Distinct reviewed heads: 724
+- Records: 745
+- Distinct ref cells: 473
+- Distinct reviewed heads: 725
 - Date range: `2026-08-12` to `2026-10-20`
 
 Records per date, newest first:
 
-- `2026-10-20` — 1 record
+- `2026-10-20` — 2 records
 - `2026-10-19` — 3 records
 - `2026-10-18` — 22 records
 - `2026-10-17` — 12 records
@@ -82,6 +82,7 @@ Scope and outcome are truncated; follow the record link for the full six-cell ro
 
 | Date | Ref | Scope | Outcome | Record |
 | --- | --- | --- | --- | --- |
+| 2026-10-20 | fix/worker-native-followup-20261020 | worker-native-followup-and-readonly-smoke-20261020 | One fresh blind six-file review at9cb07a099 found P2 shutdown proof de… | [59336213](archive/branch-review-records/59336213f8c15585d1bb9596b4389107079c13d026a9c3c320cfe94ffce54358.record.md) |
 | 2026-10-20 | fix/worker-native-security-20261020 | worker-native-security-runtime-and-NLTK-20261020 | Fresh blind eight-file security review: no actionable P0/P1/P2 defect;… | [f6299d27](archive/branch-review-records/f6299d27ad0b6e6b675601dfa15f869fe14a110e0be9db55e648383633e3666a.record.md) |
 | 2026-10-19 | fix/worker-security-remediation-20261019 | worker Perl security remediation current diff | No actionable findings in independent read-only candidate review; seve… | [95fe94b8](archive/branch-review-records/95fe94b84bcddf1ff28cb46b67666a8b1e8295bcb7927b73e70fa4d813b89937.record.md) |
 | 2026-10-19 | PR #3674 fix/audit-rag-complete-20261019 | working-tree OCR fallback correction fe6a983590b5 / 9d61e5fcde85 | Independent source review clear; transient fallback corrected with 10s… | [c53fa60f](archive/branch-review-records/c53fa60f9b3cd8979ef1e2da2e3f3830b5a6ef64c75aca71925a5b2218214fd6.record.md) |

docs/decisions/2026-10-25-licence-withdrawal-leaves-answers.md

@@ -0,0 +1,12 @@
+# Decision: A document whose licence stops permitting indexing leaves answers at once
+
+- **Status:** decided 2026-10-25
+- **Source:** `supabase/migrations/20261025171000_label_cache_revision_licence_withdrawal.sql`, find "it is now marked outdated in the same update"
+
+The owner approved every remaining recommendation of the 24 Oct 2026 search and ingestion
+re-audit, including audit E2E-10. When a document's licence changes to one that forbids indexing
+its text, the database marks the document outdated in the same update, so the existing answer
+filter stops using it. Nothing is deleted, and changing the licence back does not restore the old
+status by itself. The migration merges only after the owner's own yes to that database change.
+
+If this summary and the source ever differ, the source wins.

docs/ingestion-state-machine.md

@@ -48,12 +48,15 @@ it is the July 2026 analysis, kept as history._
    [reindex-runbook.md](reindex-runbook.md#recovery-transaction-merged-18-october-2026).
 9. **Admin Retry, rollback and last attempts (added 24 Oct 2026).**
    - The admin Retry button (`src/app/api/ingestion/jobs/[id]/retry/route.ts`) also goes through
-     `recover_ingestion_job`. It lists and retries only the administrator's own documents' jobs, so
-     jobs for owner-less public-library documents do not appear there yet (audit ING-S-N7; widening it
-     needs a tenancy-review entry, see docs/audit/tenancy-defense-in-depth-review.md §6).
+     `recover_ingestion_job`. It lists and retries the administrator's own documents' jobs and the
+     jobs of owner-less shared-library documents (audit ING-S-N7, reviewed in
+     docs/audit/tenancy-defense-in-depth-review.md §6).
    - `scripts/reindex-rollback.ts` moves a document back to its previous generation and stamps
-     `index_generation_rolled_back_from` and `index_generation_rolled_back_at` in its metadata. The next
-     commit does not yet clear those markers; a database fix is drafted separately. See
+     `index_generation_rolled_back_from` and `index_generation_rolled_back_at` in its metadata.
+     Migration `20261025170000` (drafted 25 Oct 2026, merges only after the owner's own yes) makes
+     the next commit clear those markers, lets a rollback return to a generation committed before
+     13 Oct 2026 (unstamped pages), restores the summary and generated labels it kept, and refuses
+     while the background enrichment queue has work for the document. See
      [reindex-runbook.md](reindex-runbook.md#rolling-back-a-reindex).
    - A job that fails on its last attempt (`attempt_count` has reached `max_attempts`) is not retried
      (`ingestionFailureDecision` in `worker/behavior.ts`). The job ends `failed`; during a re-index the

docs/organisation/systems/clinical-content.json

@@ -107,6 +107,7 @@
     "scripts/seed-differential-records.ts",
     "scripts/seed-medication-records.ts",
     "scripts/seed-registry-records.ts",
+    "scripts/source-provenance-gaps.ts",
     "scripts/sql/operator-export-site-content-population.sql",
     "scripts/sync-site-content-corpus.ts",
     "scripts/watch-source-changes.ts",
@@ -210,6 +211,7 @@
     "src/lib/site-content/**",
     "src/lib/source-governance.ts",
     "src/lib/source-metadata.ts",
+    "src/lib/source-provenance-gaps.ts",
     "src/lib/source-review.ts",
     "src/lib/sources/**",
     "src/lib/specifier-builder-diagnoses.ts",
@@ -295,6 +297,7 @@
     "tests/source-*",
     "tests/source-metadata-browser-safety.test.ts",
     "tests/source-metadata.test.ts",
+    "tests/source-provenance-gaps.test.ts",
     "tests/specifier-*",
     "tests/specifiers-*",
     "tests/specifiers.test.ts",

docs/organisation/systems/source-intake.json

@@ -94,6 +94,7 @@
     "src/lib/embedding-dimensions.ts",
     "src/lib/embedding-input-budget.ts",
     "src/lib/enrichment-repair.ts",
+    "src/lib/extraction-quality-watch.ts",
     "src/lib/extractors/**",
     "src/lib/image-filtering.ts",
     "src/lib/index-quality.ts",
@@ -155,6 +156,7 @@
     "tests/enrich-documents-guards.test.ts",
     "tests/enrichment-repair.test.ts",
     "tests/extracted-document-validation.test.ts",
+    "tests/extraction-quality-watch.test.ts",
     "tests/fixtures/ingestion/active-corpus-inventory.json",
     "tests/formatting-fixture-audit.test.ts",
     "tests/image-filtering.test.ts",

docs/rag-behaviour/cache-freshness.md

@@ -39,6 +39,13 @@ statuses, so decommissioning, loss of access and membership changes cannot disap
 behind an unrelated latest indexed document. Full metadata inclusion conservatively
 invalidates caches after unrelated document updates.
 
+Each document's hash also carries its evidence counter (`document_evidence_revisions`), which
+table-fact and image edits bump. Migration `20261025171000_label_cache_revision_licence_withdrawal.sql`
+(drafted 25 Oct 2026, merges only after the owner's own yes) adds label inserts, real updates
+and deletes to that counter (audit E2E-11), so a label edit reaches every app copy, not only the
+one that handled it. The `backfill:text-normalization` script bumps the counter for every document
+whose chunk text it rewrites and clears the shared answer and search cache.
+
 The candidate snapshot namespaces and public-write proofs remain required. Anonymous
 answer caching, `skipCache`, original-section loaders, active pilot budgets, trusted
 reviewed-policy loaders/states and conflicts retain their existing exclusions. The