[islandbitcoin]

Ask Flash can currently verify only exact usernames. When speech or typing changes a name, it cannot discover similar people outside the caller's contacts/history. Add an authenticated searchUsernames(query: String!): [Username!]! read for that recovery flow; the mobile integration is in lnflash/flash-mobile#812.

The query returns at most five active public usernames with Chat identities and contact discovery enabled. It normalizes spaces/case and ranks bounded prefix and spelling candidates; it returns names only. It never consumes the caller's contact list, exposes private account fields, or selects a recipient. Clients must reverify each suggestion and require an explicit choice.

All three candidate reads use the existing case-insensitive partial username index, literal equality/range predicates, result caps, and a 250 ms database deadline. There is no new index or migration. Input is limited to literal username hints; wildcard/regex input is rejected. Searches require a signed-in account, are blocked for API keys, consume a Redis-backed budget of 30 requests per minute/account, and cannot be duplicated under aliases within the existing document complexity ceiling. Database and limiter failures remain errors.

Validation: 123 targeted unit tests pass across search, GraphQL errors, rate limits, API-key scope enforcement and the destructive test-database guard. Twelve checks pass against an isolated MongoDB 6.0.5 instance with the production Account schema, including actual query plans containing IXSCAN and no COLLSCAN for every search branch. Visibility regressions inspect candidates before ranking/capping, independently exclude disabled/missing-contact, missing/null-identity, locked/closed/missing-status accounts, and check status transitions. Temporarily removing each production visibility predicate causes its corresponding tests to fail (2 contact-enabled, 2 identity, 4 status failures); the production predicates are unchanged.

The test harness accepts only parsed loopback URIs naming username_search_test, verifies the driver's actual database selection before enabling setup/cleanup drops, and refuses deceptive query-string matches. A crafted URI that the original regex accepted was rejected with all 10,005 sentinel records preserved in an isolated local MongoDB. A dedicated CI service runs database checks unattended. Public SDL and the composed supergraph are regenerated; ESLint, spelling and diff checks pass.

Simon review-fix completed two rounds at 0d0acb633: final verdict ACCEPTABLE, no remaining blocking or should-fix findings. The independent reviewer reran 28 database-guard/search-domain tests. Fresh CI is running on the review-fix commit.

Local type checking reports the same two existing Express/Application incompatibilities in graphql-server.ts and graphql-admin-server.ts as an untouched origin/main worktree using the same installed dependencies; the output is identical. No search-related TypeScript errors were reported.

Rollout: deploy the public service and regenerated gateway supergraph to make directory discovery live. The mobile client supports older servers by retaining exact/local lookup only for the explicit missing-field validation error; it does not turn outages, auth failures or rate limits into empty results. This PR has not been deployed.

Limitations: bounded candidate search is intentionally incomplete for severe unrelated speech transcriptions and heavily crowded prefixes. Latin spelling probes cover one inserted/deleted/substituted character and adjacent transpositions; literal prefix search supports the existing Unicode username alphabet. This is username recovery, not an ASR quality claim.