fix(deploy): KI-119 — disable persistent /data/vectors symlink

ROOT CAUSE of HF Space empty-retrieval bug found.

Pre-fix entrypoint.sh:
rm -rf /app/rag/vectors # delete fresh snapshot
ln -sf /data/vectors /app/rag/vectors # symlink to persistent disk

The Dockerfile snapshot_downloads a fresh Chroma from the HF Dataset
at build time. The entrypoint then DELETED that fresh copy and pointed
to /data/vectors, which on second+ builds held STALE Chroma from a
prior run — including the corrupted profile_anonymous row that broke
every collection.query() call. Our dataset upload couldn't help because
the symlink overrode it. /api/coverage reported 7356 chunks (from the
stale persistent copy) but collection.query() returned 0 on every QA
turn — KI-111's wrap caught the exception and degraded to empty.

Post-fix:
- /data/vectors symlink REMOVED. Vectors stay at /app/rag/vectors,
sourced fresh from the dataset on every build.
- Stale /app/rag/vectors symlink unlinked at boot if found, so the
fresh snapshot_download directory underneath becomes visible.
- DuckDB persistence kept (no corruption surface, benefits from
cross-rebuild metadata cache).

To purge the stale /data on the Space: Settings → Factory Reset.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

entrypoint.sh

@@ -14,20 +14,39 @@
 
 set -e
 
-# Use HF Spaces persistent disk if mounted at /data, else fall back to /app
+# KI-119 (2026-05-15) — DISABLE persistent-disk symlink for vectors.
+#
+# Pre-fix, this block unconditionally rm -rf'd the /app/rag/vectors
+# directory (freshly snapshot_downloaded from the HF dataset at build
+# time) and replaced it with a symlink to /data/vectors. On second+
+# builds, /data/vectors held STALE Chroma from a prior run — including
+# the corrupted profile_anonymous row from the KI-102 deploy that broke
+# every collection.query() call. The dataset upload couldn't help because
+# the entrypoint's symlink overrode it.
+#
+# We don't need persistent vectors. The whole point of pushing rag/vectors
+# to the companion HF Dataset is that EVERY Space rebuild pulls a fresh
+# copy. /data persistence is now disabled for vectors; the app reads
+# directly from /app/rag/vectors which contains the just-downloaded fresh
+# snapshot. DuckDB persistence kept (it's only used for cached metadata
+# and benefits from cross-rebuild persistence with no corruption surface).
+#
+# If you NEED to test with a clean /data, manually `rm -rf /data/vectors`
+# on the Space's persistent disk via Settings → Reset.
 if [ -d "/data" ] && [ -w "/data" ]; then
-    export VECTOR_DIR="/data/vectors"
     export DUCKDB_PATH="/data/policies.duckdb"
-    # Symlink so the app code (which reads from rag/vectors and
-    # rag/policies.duckdb) finds them on the persistent disk
-    mkdir -p /data/vectors
-    rm -rf /app/rag/vectors
-    ln -sf /data/vectors /app/rag/vectors
     if [ ! -f /data/policies.duckdb ] && [ -f /app/rag/policies.duckdb ]; then
         cp /app/rag/policies.duckdb /data/policies.duckdb
     fi
     rm -f /app/rag/policies.duckdb
     ln -sf /data/policies.duckdb /app/rag/policies.duckdb
+    # Vectors stay at /app/rag/vectors — read from the fresh dataset
+    # snapshot. The previous /data/vectors symlink is intentionally removed.
+    if [ -L "/app/rag/vectors" ]; then
+        # Pre-existing symlink from older deploys — unlink it so /app reads
+        # the fresh snapshot_download'd directory underneath.
+        rm /app/rag/vectors 2>/dev/null || true
+    fi
 fi
 
 # Validate Chroma is readable + populated; rebuild if not.