Q4: conditional bm25 ranking behind a flag with non-authoritative order labeling

[joefeser]

Context

Audit finding F3: search ordering is record_id only (zero relevance signal), degrading findability at vault scale. The independent second opinion ruled bm25 ranking permitted but conditional: order is corpus-dependent (an order flip was demonstrated from one unrelated added record), so it must never be presented as authoritative.

Change

Add bm25 lexical ranking with a record_id tiebreak behind a flag, off by default. When enabled, the receipt must label result_order as non-authoritative and disclose corpus dependence (a result's rank can change when unrelated records are added to or removed from the vault).

Acceptance

• Synthetic fixture demonstrating ranking with deterministic record_id tiebreak for equal scores.
• Receipt labeling fixture: corpus-dependence disclosure and non-authoritative order label verified end-to-end through the CLI.
• Default ordering and receipts byte-identical when the flag is absent.

Security and compatibility

• Security: no authority is claimed over order; ranking is a findability aid only.
• Compatibility: default output unchanged. Still-unverified per the epic record: bm25 flip reachability at scale and bm25 cost — both must be measured before the flag is documented as stable.

Sequencing: step Q4, last, of the corrected epic (M0, Q1, Q2+docs, Q3, Q4), after #105.

[joefeser]

Completed by the merged ranking implementation and reconciled evidence in PR #120 at merge commit 4c0723f. Ranking remains opt-in, deterministic on ties, explicitly non-authoritative, and corpus-dependent; bounded cost and corpus-only flip evidence are recorded.