Guard untyped bbox jsonb with shared normalizeImageBbox helper

[BigSimmo]

Summary

• document_images.bbox is untyped jsonb, but bboxLooksLikeHeaderOrFooter (src/lib/image-filtering.ts) array-destructured it after only a truthiness check — an object-shaped bbox row threw a TypeError and crashed the whole enrichment run.
• Added exported normalizeImageBbox(value: unknown) to src/lib/image-filtering.ts: returns the [x0, y0, x1, y1] tuple only for a 4-element array whose entries all coerce to finite numbers, else null. bboxLooksLikeHeaderOrFooter now normalizes before destructuring, so malformed jsonb means "not a header/footer" instead of a crash.
• Replaced the unsafe as [number, number, number, number] | null casts at both jsonb read sites with the shared helper: scripts/enrich-documents.ts and src/lib/rag.ts (attachPageVisualEvidence).
• Added tests: object-shaped bbox through cheapImageSkipReason returns null instead of throwing, plus direct normalizeImageBbox coverage (valid tuple, numeric-string coercion, object, wrong-length array, non-numeric entry, NaN, string, null).

Note: the helper matches the semantics of the uncommitted chunkImageBbox fix on the claude/pr131-review-fixes worktree; if that branch lands later it will hit a trivial one-line conflict at the same rag.ts line, resolved by keeping the shared helper.

Verification

• npm run verify:cheap — passed (runtime check, lint, typecheck, 823 tests passed / 2 skipped across 99 files)
• npm run verify:ui — not run: no UI, routing, styling, or browser behavior changed
• npm run verify:release — not run: not a release/handoff claim
• npm run format:check — changed files clean; 2 pre-existing warnings in untouched files (src/components/document-viewer-lazy.tsx, src/lib/supabase/database.types.ts) also present on main
• npm run check:production-readiness — not run: no clinical workflow, privacy, env, Supabase config, source governance, or deployment behavior changed; this is a pure defensive type-safety fix at existing read sites
• npm run check:deployment-readiness — not run: no deployment behavior changed

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use — no change to answer/source verification logic
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy) — no env or project changes
• Service-role keys and private document access remain server-only — no access-path changes
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative — malformed bbox now degrades to null (image simply not treated as header/footer or positioned evidence) rather than crashing ingestion
• Deployment classification/TGA SaMD impact was checked — no clinical decision-support behavior changed

Notes

• Targeted verification also ran green: npm run typecheck and npx vitest run tests/image-filtering.test.ts (15/15).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:9ca7f8018e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".