[p3t3r67x0]

Research questions now learn immediately from successful executions and explicitly rendered/selected suggestions, with PostgreSQL-only retrieval. A query needs three successful uses plus a conservative privacy gate before it can appear. Typing does not train or call an LLM, encoder or Qdrant; no static catalogue or user profiles are introduced.

The question-only execution body remains unchanged. A validated, ten-minute selection receipt travels in an explicitly allowlisted header; only successful execution of the matching query earns conversion credit, once per request/suggestion pair. Failed/unsupported/clarification responses do not learn. Sensitive rejected text is not stored; only a redacted successful observation remains. Learning writes are transactional and best effort with a one-second budget.

• Add 0018 and admin tables research_query_history, research_query_suggestion, research_query_suggestion_event with indexes and event/conversion uniqueness.
• Add authenticated Research suggestion GET, impression POST and selection POST endpoints, Zod/client/proxy contracts and generated OpenAPI.
• Rank full/token-prefix matches using frequency, selections, conversions, recency and bounded smoothed CTR. Weights: 100 / 3 / 1 / 5 / 4 / 2; recency decay 30 days.
• Add 200 ms debounce, stale cancellation, keyboard/pointer interaction, ARIA combobox/listbox semantics and rendered-only impressions.
• Preserve source read-only access and existing Research authorization/Origin/CSRF. No source schema changes, backfill, dependencies or worker changes.

Validation: backend targeted suite 283 passed, 27 database-dependent skips; focused final suggestions 42 passed, with six PostgreSQL tests excluded locally; offline migration checks 3 passed; release-manifest packaging unit 1 passed. Frontend full unit suite 995 passed, final affected subset 79 passed. Ruff check/format and configured mypy pass; frontend lint/typecheck pass (four existing lint warnings); git diff --check passes. Local .env loading was disabled for backend tests; API tests ran outside the sandbox after sandbox event-loop stalls. No local Docker/container/database tests were run. PostgreSQL migration/counter/concurrency/privilege and production browser coverage are left to GitHub CI. CI will not be awaited or polled to completion.

Deployment impact for a future authorized release: migrate as the explicit migrator, then provision SELECT/INSERT on history/events and SELECT/INSERT/UPDATE on suggestions. Readiness and the release manifest require the new head/grants. Upgrade contracts cover the supported earlier heads, including verified 0017 inventory. Downgrade removes only the new learning tables/data. Deploy compatible backend/frontend together. This PR does not deploy or merge.

Follow-ups: compact operator diagnostics/moderation, retention tooling and verified language metadata (und for now). The privacy gate is conservative heuristic filtering, not a guarantee that every sensitive phrase is detected. Semantic suggestion retrieval is out of scope.

Base: freshly fetched main at 2f0f6349a94d90e613dd1728371fedcec3ac4fb7.