feat(search): add native Smart catalogue matching

[BigSimmo]

Summary

• Adds deterministic, provider-free natural-language catalogue matching for Prescribing, Tools, Calculators, Factsheets, and Dictionary.
• Preserves literal lookup, exact identity, compact-code, route, count, guest-access, and one-composer behaviour.
• Suppresses Documents, Answer, Favourites, Clinical Ask, and universal-search escape paths only while one of the five local Smart states is active.
• Keeps Medication matching retrieval-only: Smart terms rank records but never imply suitability, dose, or treatment.

Verification

• npm run verify:pr-local — ran on the merged feature tree. Runtime, installed-lock parity, formatting, sitemap, repository snapshot, documentation checks, ledger guards, lint, and typecheck passed. The full suite reported 11,756 passes and six failures only because Windows resolved bash to the WSL launcher (exit 127); with Git Bash first on PATH, the untouched claude-cloud-profile.test.ts passed 24/24. Build and the three not-reached static checks were then run directly and passed. GitHub checks are authoritative for the final pushed head.
• Focused Smart catalogue unit/DOM coverage passed during implementation, including the final Tools 34/34, Medication 57/57, Calculator 17/17, and action-filter 37/37 suites.
• Focused provider-free browser coverage passed 3/3, including natural-language routing and zero forbidden cross-mode or Clinical Ask requests.
• npm run build — production compilation, TypeScript, 1,998 static pages, and client-bundle secret scan passed.
• npm run check:rag:fixtures — 36 golden cases across 26 suites passed.
• npm run check:medication-interactions — 531-row index current.
• npm run check:medication-lexicon-report — 37 catalogue terms current.
• npm run docs:check-links — 4,727 repository path references resolved.
• Final independent exact-head review before current-main integration found no P0-P3 issues and marked the branch ready for PR handoff.
• npm run verify:ui — not repeated as an equivalent broad UI gate; focused browser coverage targets the changed behaviour and GitHub will run final-head UI lanes.
• npm run verify:release — not run; this is a dormant/provider-free catalogue search PR, not a release or deployment action.

Risk and rollout

• Risk: Moderate, limited to deterministic catalogue interpretation and result ordering in the five named modes.
• Rollback: Revert this PR. Literal catalogue search remains the fallback behaviour and no hosted state requires rollback.
• Provider or production effects: None. No provider calls, hosted configuration, Supabase operations, migration application, deployment, or production activation occurred.
• RAG impact: none — this changes provider-free catalogue matching only; governed RAG retrieval, Answer, and Clinical Ask are unchanged.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

• Smart coverage added here is limited to Prescribing, Tools, Calculators, Factsheets, and Dictionary.
• Documents, Answer, and Favourites remain outside this local Smart catalogue implementation.
• Tools intentionally uses its standalone visible search owner and does not render the shared Smart cue.
• Auto-merge remains off. This PR is ready for human review and is not a deployment or activation request.

---

> [!NOTE]
> Medium Risk
> Changes deterministic catalogue ranking and composer routing in clinically sensitive Medication search and suppresses federated escape paths during Smart NL; behaviour is bounded by tests and retrieval-only medication semantics, but ordering and suppressed shortcuts affect how clinicians discover content.
>
> Overview
> Extends provider-free Smart natural-language search to Medication (prescribing), Tools, Calculators, Factsheets, and Dictionary by growing the shared smart-search-intent allowlist, adding mode-scoped expansion rules, and threading those terms into each mode’s existing deterministic matchers while keeping the raw q in the URL and composer.
>
> For these five local-only Smart states, natural-language queries stop universal-search / also-matches and hide Documents, Answer, and Favourites shortcuts in the command surface (literal lookups keep prior cross-mode behaviour). Tools uses rankToolRecords on launcher and results pages and filters Ask/Documents/Favourites during Smart NL; Medication applies expansions for ranking only—Smart terms never surface in query analysis, and expansion-only API hits are labeled Related match rather than implying clinical suitability.
>
> Governance and search-chrome docs plus design/plan artefacts document the boundary; repo-awareness-snapshot and broad unit/DOM/e2e tests cover intent, counts, guest Favourites gates, and zero Clinical Ask/universal requests.
>
> ^{Reviewed by Cursor Bugbot for commit c65f5b5. Configure here.}

---

Note

Medium Risk
Changes deterministic ranking and composer routing in Medication and five catalogue modes, including suppressed federated escape paths during Smart NL; behaviour is test-bounded and medication remains retrieval-only, but result order and discoverability affect clinicians.

Overview
Adds provider-free Smart natural-language search to Medication, Tools, Calculators, Factsheets, and Dictionary by extending smart-search-intent (new mode rules, smartLocalOnlyModeIds, tighter compact-code handling) and threading bounded expansions into each mode’s existing deterministic matchers while keeping the raw query in the URL and composer.

For those five modes in natural-language Smart state, the PR turns off universal typeahead and also-matches and hides Documents, Answer, and Favourites shortcuts in the command surface and Tools launcher; literal lookups keep prior cross-mode behaviour. Medication uses expansions for ranking only (not analysis chips) and the API labels expansion-only hits Related match so Smart retrieval is not read as clinical suitability.

Ranking fixes prioritise embedded catalogue identities (factsheet titles/brands, dictionary terms/abbreviations, calculator codes) ahead of expansion-only matches. Tools hub/results share one ranked query path via rankToolRecords.

Governance and search-chrome docs, design/plan artefacts, repo snapshot, and focused unit/DOM/e2e tests document and lock the boundary (zero Clinical Ask/universal requests in the five-mode matrix).

^{Reviewed by Cursor Bugbot for commit a4d6007. Configure here.}

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 8a6e874a-91c0-4c72-9b1c-1a400915476f

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T13:51:15.929409Z	c65f5b5	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_34901acd-c7c8-49db-97b7-eb748859f31d)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c65f5b5c83

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 3 failed job(s):

• Static PR checks — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
• Production UI (3) — not baselined: this job did NOT run on the main comparison below (path-scoped skip), so that run says nothing about it either way. Treat the comparison as absent, not green, and inspect the failing step.
• PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #14717 (success). That run's conclusion is an aggregate and did not exercise Production UI (3).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_e4394dc1-40b6-4f58-ac87-7675e4ba6754)

[BigSimmo]

Final PR sweep

• Head verified before merge: ed5e2bf; base: ea7c5c3. GitHub reported mergeable true / clean.
• Fixed literal Tools Compare ranking so Differentials wins over a generic keyword match; added a focused regression test. Applied the CI-required Prettier correction in src/lib/dictionary.ts.
• Resolved the one genuine base conflict by merging current main and regenerating the repository-awareness snapshot.
• Review threads: 0 actionable unresolved.
• Verification: focused Vitest 10/10; format; generated snapshot, sitemap, and codebase-index freshness checks. The local full suite was stopped before a provider-backed Supabase path, per task constraint.
• Exact-head required CI: green — PR required, Static PR checks, Build, Unit coverage, Safety/config, all production UI shards (including the formerly failing UI (3)), and Lighthouse. Secret Scan and SAST are also green.
• Advisory: no failures; scope-inapplicable advisory jobs were skipped.

After that verification, GitHub automatically squash-merged the PR at 2026-09-01T15:59:42Z as 410f596. Auto-merge had been enabled by BigSimmo; I did not enable, disable, modify, merge, or close the PR.