[9thLevelSoftware]

Summary

• Add shadow-first outcome utility ranking with single-step and discounted explicit-provenance credit; extend store/outcome tools with informed_by and caller-reported verification.
• Add file/symbol bindings, applicability diagnostics and successful-outcome rebinding. Fresh bounded source views, root-scoped parsing caches and request-local reuse preserve freshness while avoiding duplicate work.
• Add intent-aware direct/federated evidence retention, scoped path/symbol matching, source-aware fact excerpts and exact public citation-marker parity. Explore/no-intent packing remains baseline.
• Add optional Python 3.11+ fastembed ColBERT/MaxSim reranking, with robust L2-equivalent normalization and no silent embedding fallback.
• Keep the full registered surface at 77 tools / 10 resources while listing 9 startup tools by default. Guided storage needs 1 call, strict explicit storage 3, destructive challenge flow 2.
• Preserve the frozen retrieval corpus/goldens/harness throughout the 20 experiments and review remediation; update contracts, release inventory and operator guidance.

Migration and rollout

• Schema 33 derives provenance/outcome signals from canonical events; legacy imports do not invent learning evidence. Replay/export/import remain verified.
• Missing derived learning parents are recovered only from complete validated authority replay before strict backfill, inside the same migration transaction. Invalid authority fails closed; source and active pointer remain unchanged on failure.
• Utility, validity and retention default to shadow. Apply is explicit opt-in; shadow utility still computes estimates and can add database work/latency. Use off to disable that computation.
• Late interaction requires its optional extra, explicit rerank settings and rerank=true; initial weights download can exceed provider timeout. Unavailable selected profiles report their unavailability rather than silently using another model.
• Parser/capture capability failures are retryable only after restoring access/capability or fixing invalid source, using fresh counsel and the same idempotency key—not an immediate retry loop.

Review remediation (cd7eb8b, b38753f)

• Sanitize malformed gateway metadata/data/error output as INTERNAL_ERROR; preserve genuine caller INVALID_ARGUMENT, single input validation and user-authored path text.
• Classify SQLite contention by BUSY/LOCKED codes with a narrow code-less fallback; unrelated errors mentioning busy/locked stay nonretryable capability failures.
• Restore canonical-derived missing learning parents before schema-33 backfill; reject malformed record payloads through the public upgrade-error boundary.
• Report RETENTION_NOT_APPLICABLE for explore without changing its evidence, rendered context or token usage.
• Bind entity-readiness inspection to the selected lexical generation: first publication after a real retrieval miss remains retryable; indexed same-generation genuine misses remain terminal.
• Answered and resolved all 11 inline threads with evidence; unsafe provenance skipping, conflict suppression, normalization rollback, silent reranker fallback and split migration transactions were not adopted.

Supporting fixes

• Hydrate procedure steps from authenticated canonical context and preserve source-evaluated utility/validity/retention through linked-workspace composition.
• Close locally owned Qdrant staging persistence before deletion on failed/cancelled/orphan builds; the narrowly scoped qdrant-client 1.19.1 workaround has real Windows cleanup coverage.
• Remove an incidental apply-versus-baseline superiority assertion once both retained all required facts; frozen quality assertions and fixtures are unchanged.

Verification

• Local optional-profile full suites: cd7eb8b passed 3,326 tests / 66 skips / 1,667 subtests. Final-head runs each had 3,326 passes / 66 skips / 1,667 subtests plus one failure: one unconfirmed Windows storage-rename WinError 5, and a separate instrumented-run dreaming startup session_brief DATABASE_IN_USE response. These local results are not claimed as a clean final full-suite run.
• Review-focused suite: 210 passed, 217 subtests passed; final readiness/process suite 44 passed / 20 subtests passed.
• Windows ownership diagnostics: real export/import case, all 34 path-policy tests, and the full-suite rename all succeeded with native file/directory sharing probes; no owned target handle, pending drain or worker was observed at those renames. The original lock owner is unavailable after process exit; no speculative fix, rename retry or suppression was added.
• Ruff 0.16.8 package/tests lint and format: passed (488 files).
• Mypy 2.3.1 v7 check with --platform linux: passed (48 source files).
• Release inventory --check: 77 tools, 10 resources, 586 atomic requirements.
• Real before/after gateway, schema upgrade and SQLite classification smokes; compatible legacy upgrade, replay/conflict detection and migration-lock/source-preservation smokes passed.
• Final-head b38753f GitHub Actions: all 12 jobs passed (9 OS/Python matrix legs plus lint, type-check and release inventory). GitGuardian and Kilo review also passed; the latest review reports no issues. Cancelled unassigned-runner jobs were rerun to actual completion.

Frozen experiment evidence

Final coding-memory nDCG 0.850000000000, versus initial 0.821533827904 (~3.5% relative improvement). Reference-arm nDCG 0.721913456093 (initial 0.671913456093). Outcome reuse, provenance-chain quality, required-fact retention and stale-flag recall remain 1.0; false flags 0.0; mean rendered tokens 95.733333333333. The unchanged harness reproduced these metrics after review fixes. These are synthetic workload results, not broad latency or competitor claims.

Earlier synthetic evaluation evidence

24-topic lexical workload: outcome-reuse nDCG 0.650 → 1.000; provenance-chain nDCG 0.710 → 1.000 with trace credit; required procedure-fact retention 0% → 100%; stale-binding recall 100%, false flags 0%. Fully-enabled ColBERT overall nDCG was 0.840.

These are synthetic, not competitor comparisons. Eval utility weight is 0.2 (product default 0.1). Retention distractors preserve the prescribed text but use task tags and the same procedure category with empty steps, preventing category diversity from automatically rescuing the actionable procedure. All stress settings are exposed in report metadata.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

The incremental commit on top of cd7eb8b (b38753f) is a small, well-scoped follow-up to the entity-recall lexical-catchup path. It tracks the active lexical generation across the selection snapshot and the readiness check, so a generation that publishes between retrieval and readiness inspection now returns DATABASE_IN_USE (retryable) instead of a terminal CAPABILITY_DEGRADED. Same-generation indexed misses remain terminal, matching the previous review contract.

Correctness / Safety Findings

No correctness or safety findings.

The new validation in _entity_selection_sync (daem0nmcp/api/v7/discovery_operations.py:2035-2038) and _lexical_catchup_pending_sync (daem0nmcp/api/v7/discovery_operations.py:2088-2093) raises CAPABILITY_DEGRADED for non-int or < 1 generation values and for active generation regression below the selection snapshot. These are defensive guards for malformed/regressed state and do not change the happy path. The _lexical_catchup_pending_sync outer try/except already maps non-DATABASE_IN_USE errors to terminal False, so the new CAPABILITY_DEGRADED raise path does not leak.

The new test test_first_lexical_publication_after_real_retrieval_is_retryable (tests/api_v7/test_discovery_operations.py:1379) exercises the real Task8RecallService + LexicalProjectionBuilder.rebuild flow, asserts the first call returns DATABASE_IN_USE with retry_after_ms=250 and the retry succeeds, and uses addCleanup(recall.close) for proper resource cleanup. The _activate_graph/_activate_discovery content_prefix parameter is backward compatible (default "").

The CHANGELOG and docs/v7-operations.md entries are consistent with the implementation and existing entry style.

Ponytail Review

The diff is the minimum required to add the new retryable semantic. No new abstractions, no duplicated helpers, no speculative config, no tests of mocks/framework behavior. The duplicated isinstance / < 1 validation across the two call sites is two lines and not worth a helper.

Ponytail: Lean already. Ship.

Ponytail net: 0 lines.

Suggested Minimal Patch

No patch needed.

Final Merge Guidance

Can merge as-is. The lexical-catchup retryability change is correctly scoped, the validation guards are defensive-only, and the new test exercises the real recall + rebuild flow end-to-end.

Files Reviewed (4 files)

• CHANGELOG.md
• daem0nmcp/api/v7/discovery_operations.py
• docs/v7-operations.md
• tests/api_v7/test_discovery_operations.py

Fix these issues in Kilo Cloud

Previous Review Summaries (4 snapshots, latest commit cd7eb8b)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit cd7eb8b)

Status: No Issues Found | Recommendation: Merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	0

Verdict

Approve — the cd7eb8b remediation commit correctly addresses every previously flagged CRITICAL and WARNING finding with verified fixes and reasoned rebuttals, and introduces no new correctness, security, or data-loss regressions in the incremental diff.

Previously Flagged Findings — Verification on HEAD cd7eb8b

CRITICAL (resolved)

• daem0nmcp/event_store.py:940 — record.get("worked") now uses the validated record handle from event_store.py:867 (typed dict check raises ValueError for non-dict payloads), so the legacy memory.created KeyError is gone.
• daem0nmcp/event_store.py:867 — _project_provenance raises a clear ValueError for non-dict record; migration 33 now pre-runs _restore_missing_learning_parents using canonical authority replay, so malformed events are surfaced before the backfill.
• daem0nmcp/migrations/schema.py:2655 — orphan parents are restored before the v33 backfill via the new run_migrations(..., before_memory_learning_backfill=...) hook plus _restore_missing_learning_parents, validated by full memory/governance/federation authority replay; FK violation on memory_outcome_signals.record_id no longer aborts the backfill.
• daem0nmcp/verification_v7.py:53 — _append (event_store.py:518) returns early on (workspace_id, stream_id, stream_version) dedup before _project, so canonical replays never re-insert into memory_provenance_edges / memory_outcome_signals. Verified via existing import/export/replay smoke (4 imported / 4 existing / verified projections / EVENT_STREAM_CONFLICT).

WARNING (resolved)

• daem0nmcp/api/v7/federated_retrieval.py:507-509 — explore intent now routes through retained composer and reports RETENTION_NOT_APPLICABLE; matches the matching change in retrieval/service.py:388-391. Misleading diagnostic is fixed.
• daem0nmcp/retrieval/late_interaction.py:106 — verified: max-abs pre-scale is a positive scalar that cancels under L2 normalization, so x / max(|x|) / norm(x / max(|x|)) == x / norm(x) for nonzero vectors; no ranking change. Overflow/underflow guard is preserved for extreme finite vectors.
• daem0nmcp/retrieval/runtime.py:487 — unchanged; explicit RERANKER_UNAVAILABLE reporting is the documented contract.
• daem0nmcp/retrieval/composer.py:163-175 / 548-560 — query_identifiers preserves full path tokens (handles ./, backslashes, PurePosixPath normalization); _priority matches full path equality or //.-qualified suffix instead of the previous basename-only split. Path-binding match is restored.
• daem0nmcp/config.py:120 — unchanged; shadow is the documented product rollout default and is now explicitly called out in README/CHANGELOG with off for latency-sensitive operators.
• daem0nmcp/migrations/schema.py:3383-3386 — unchanged; the DDL + backfill still run inside one BEGIN, but the migration operates on a copied candidate under lifetime exclusive storage admission, so splitting commits would not release the reader lock.
• daem0nmcp/api/v7/gateway_operations.py:152-194 — post-adapter meta/data/error validation is now inside the try/except Exception boundary; malformed responses map to INTERNAL_ERROR with sanitized envelope, preserving single-call input validation and the genuine caller INVALID_ARGUMENT boundary.

Correctness / Safety Findings

No correctness or safety findings.

Ponytail Review

The incremental commit is well-scoped remediation and supporting plumbing for outcome learning and code-binding capture. No speculative abstractions, no duplicate helpers, no one-implementation registries. The new _replay_authority is a genuine reuse extraction (called from both verification and the new restore step). The shared _SymbolSpan / _ReadBatch cache only exists where it has >1 caller within the same scope.

Ponytail: Lean already. Ship.

Ponytail net: 0 lines.

Suggested Minimal Patch

No patch needed.

Final Merge Guidance

Can merge as-is. All CRITICAL findings from the previous review are resolved with verified fixes; WARNING-level items are addressed or rebutted with mathematically/architecturally valid counter-evidence. The new code_bindings / discovery / federated / models changes are well-tested (143 new test cases covering contention classification, malformed gateway envelopes, citation-marker parity, scope-aware path binding, content-match ordering, batched fingerprint budgeting, and schema-33 missing-parent restore).

Fix these issues in Kilo Cloud

Previous review (commit 4462fd6)

Status: 11 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	4
WARNING	7
SUGGESTION	0

Verdict

Request changes — incremental commit 4462fd6 adds SQLite DATABASE_IN_USE retry translation and benchmark ergonomics metrics but does not touch the previously flagged migration-33 backfill / replay-UNIQUE defects. Every prior critical finding is still present on HEAD.

Issue Details (click to expand)

CRITICAL (still present on HEAD 4462fd6)

File	Line	Issue
daem0nmcp/event_store.py	937	payload["record"].get("worked") KeyError on every legacy memory.created row in migration 33 backfill.
daem0nmcp/event_store.py	862	_project_provenance raises ValueError("memory provenance is invalid") on any non-conforming legacy event; aborts the entire backfill.
daem0nmcp/migrations/schema.py	2655	FK on memory_outcome_signals.record_id aborts backfill on orphan stream_id.
daem0nmcp/verification_v7.py	53	import_event_bundle re-inserts provenance edges/signals, hitting UNIQUE constraint and breaking verify-v7.

WARNING (still present on HEAD 4462fd6)

File	Line	Issue
daem0nmcp/api/v7/federated_retrieval.py	470	explore intent skips retention even when retention_mode=apply; RETENTION_APPLIED is misleading.
daem0nmcp/retrieval/late_interaction.py	106	Non-standard ColBERT normalization (max-abs + L2); breaks MaxSim ranking vs reference.
daem0nmcp/retrieval/runtime.py	487	Missing fallback to embedding reranker when late-interaction profile is not ready; silent rerank loss.
daem0nmcp/retrieval/composer.py	170	query_identifiers produces py instead of foo.py; code-binding match broken for path queries.
daem0nmcp/config.py	120	retrieval_utility_mode default shadow adds query overhead by default; mismatch with dataclass default.
daem0nmcp/migrations/schema.py	3264	DDL + backfill run inside one BEGIN; long write lock stalls readers.
daem0nmcp/api/v7/gateway_operations.py	158	Three model_validate/dict accesses on the post-adapter result sit OUTSIDE the try/except blocks.

Files Reviewed (incremental, 7 files)

• daem0nmcp/api/v7/discovery_operations.py (+27 / −9) — _translate_error busy/locked mapping, _lexical_catchup_pending_sync and _generation_is_current_sync now return DATABASE_IN_USE for retryable contention. Verified previous CRITICAL/WARNING findings in other modules still apply.
• benchmarks/autoresearch_benchmark.py (+152) — _ergonomics_metrics boots a per-mode temp dir + v7 server, asserts the listed-tool / write-call / destructive-challenge call counts are stable. Hardcoded contract values are intentional.
• tests/api_v7/test_discovery_operations.py (+432 / −145) — six new retryable/non-retryable SQLite contention tests, refactored _entity_retrieval_result helper. Logic matches _translate_error mapping.
• tests/api_v7/test_gateway_operations.py (+146 / −56) — destructive-challenge retry test extended to core and full tool surfaces, plus a new ValueError adapter-exception case. Matches bind_gateway_handlers sanitisation path.
• docs/v7-operations.md, CHANGELOG.md, README.md — doc refinements describing the same behaviours reviewed above.

No new correctness or safety issues were identified in the incremental diff. The 11 previously raised findings are unchanged on HEAD.

Ponytail Review

The incremental commit is mostly additive wiring (retry-translation + tests). No new abstractions or one-implementation interfaces introduced. One minor robustness note (already covered by existing test coverage, not raised as a new finding):

• daem0nmcp/api/v7/discovery_operations.py:713-716 shrink (optional): the busy/locked substring check any(word in str(error).casefold() for word in ("busy", "locked")) is fragile — sqlite3 OperationalError messages unrelated to lock contention that happen to contain those substrings would be misclassified. Standardise on the actual prefix (str(error).startswith(("database is locked", "database is busy"))) or check the sqlite3 sqlite3_errstr codes 5/6.
• benchmarks/autoresearch_benchmark.py:54-71 shrink (optional): the strict-mode probe discards the first server and rebuilds it; the rebuild has no test-visible side effect beyond the probe Client exiting. Inline the probe call into the post-rebuild flow so a single server instance is used.

Ponytail: already lean in the productive directions. The two notes above are optional cleanups, not blockers.

Ponytail net: 0 lines.

Suggested Minimal Patch

No new patches required from the incremental commit. The four CRITICAL and seven WARNING patches already documented in the previous summary remain the smallest safe change set before merge:

1. event_store.py — guard payload["record"].get("worked") with a typed lookup; loosen _project_provenance to skip non-conforming legacy payloads with a logged warning; switch the two new INSERTs to INSERT OR IGNORE.
2. migrations/schema.py:2655 — drop the memory_outcome_signals.record_id FK or backfill in dependency order.
3. verification_v7.py:53 / import_event_bundle — make provenance projections idempotent or skip them when the edges already exist.
4. migrations/schema.py:3264 — split DDL and backfill into separate transactions and stream the backfill with LIMIT.
5. gateway_operations.py:158 — move the post-adapter dict accesses and model_validate calls inside the existing try.
6. federated_retrieval.py:470 — route the explore intent through _compose_retained.
7. late_interaction.py:106 — drop max-abs pre-normalization; runtime.py:487 — add the embedding-reranker fallback; composer.py:170 — add the basename form to query_identifiers; config.py:120 — align retrieval_utility_mode default.

Final Merge Guidance

Do not merge until the 4 CRITICAL findings (migration 33 backfill + replay UNIQUE conflicts) are fixed. The 7 WARNING-level items are correctness regressions and should also be addressed before merge.

Fix these issues in Kilo Cloud

Previous review (commit d0464b0)

Status: 11 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	4
WARNING	7
SUGGESTION	0

Verdict

Request changes — incremental commit d0464b0 adds CovenantCeremony and daem0n_tool_call gateway but inherits every critical migration-33 backfill defect and one new gateway hardening gap. The previous critical findings are still present on HEAD.

Issue Details (click to expand)

CRITICAL (carried from prior review; still present on HEAD d0464b0)

File	Line	Issue
daem0nmcp/event_store.py	937	payload["record"].get("worked") KeyError on every legacy memory.created row in migration 33 backfill.
daem0nmcp/event_store.py	862	_project_provenance raises ValueError on non-conforming legacy events; aborts migration 33 backfill.
daem0nmcp/migrations/schema.py	2655	FK on memory_outcome_signals.record_id aborts backfill on orphan stream_id.
daem0nmcp/verification_v7.py	53	import_event_bundle re-inserts provenance edges/signals, hitting UNIQUE constraint and breaking verify-v7.

WARNING (carried from prior review; still present on HEAD d0464b0)

File	Line	Issue
daem0nmcp/api/v7/federated_retrieval.py	470	explore intent skips retention even when retention_mode=apply; RETENTION_APPLIED is misleading.
daem0nmcp/retrieval/late_interaction.py	106	Non-standard ColBERT normalization (max-abs + L2); breaks MaxSim ranking vs reference.
daem0nmcp/retrieval/runtime.py	487	Missing fallback to embedding reranker when late-interaction profile is not ready; silent rerank loss.
daem0nmcp/retrieval/composer.py	170	query_identifiers produces py instead of foo.py; code-binding match broken for path queries.
daem0nmcp/config.py	120	retrieval_utility_mode default shadow adds query overhead by default; mismatch with dataclass default.
daem0nmcp/migrations/schema.py	3264	DDL + backfill run inside one BEGIN; long write lock stalls readers.

WARNING (new finding introduced by commit d0461310b...)

File	Line	Issue
daem0nmcp/api/v7/gateway_operations.py	158	ResponseMeta.model_validate(result["meta"]), ToolCallData(... data=result["data"]), and ApiError.model_validate(result["error"]) run OUTSIDE the try/except (ValidationError, TypeError) / except Exception blocks. Malformed adapter results bypass the sanitized gateway error envelope.

Files Reviewed (incremental, 49 files)

• daem0nmcp/api/v7/ceremony.py (new, 287 lines) — CovenantCeremony.admit; minor bare-except concerns only.
• daem0nmcp/api/v7/gateway_operations.py (new, 203 lines) — bind_gateway_handlers; 1 WARNING (post-adapter validation outside try).
• daem0nmcp/api/v7/{application,composition,fastmcp,middleware,models,pinned,policy,production,resource_repository,resources,responses,rule_trigger_operations,runtime_services,tools}.py — ceremony wiring, gateway binding, listed-tools middleware, type moves; no new high-severity findings.
• daem0nmcp/claude_hooks/{pre_edit,session_start,stop}.py — gateway reminder paths; reviewed.
• daem0nmcp/config.py — tool_surface/covenant_mode defaults.
• tests/api_v7/{test_ceremony,test_gateway_operations,test_models,test_responses,test_foreground_configuration}.py (new) — match thin contracts; no findings.

Ponytail Review

The incremental commit is mostly additive wiring; little redundant code. One shrink opportunity exists in the ceremony module:

• daem0nmcp/api/v7/ceremony.py:212-213,247-248 shrink: the two bare except Exception: return CeremonyOutcome(violation, notice, None) blocks hide every guidance/brief failure with no log. Either add a structured log line (logger.warning("ceremony guidance failed", exc_info=True)) or tighten to (RuntimeServiceError, ValidationError, OSError, TypeError, ValueError). -3 lines net.
• daem0nmcp/api/v7/fastmcp.py:583-658 shrink: manifest.tools is iterated five times to compute a subset check, an adapter map, and gateway registrations. Cache tool_names = frozenset(s.name for spec in manifest.tools) once after construction. -2 lines net.
• daem0nmcp/api/v7/policy.py:147 delete: _PREFLIGHT_PLACEHOLDER removal is safe but undocumented. Either delete the _EXCLUDED comment-only block above it, or leave as-is.

Optional:

• daem0nmcp/api/v7/middleware.py:143-146 shrink: ListedToolsMiddleware.on_list_tools should defensively handle non-iterable call_next returns. Optional, future-proofing only.
• daem0nmcp/api/v7/production.py:506-507,579-580 shrink: _active_database only raises ProductionConfigurationError; drop the broad except Exception fallback in both _compact_brief_reader and _briefing_reader. Optional.

Ponytail net: ~-7 lines.

Suggested Minimal Patch

1. Migration backfill (CRITICAL): in daem0nmcp/event_store.py:_project_provenance, replace unconditional payload["record"].get("worked") with a typed lookup; loosen _project_provenance to skip non-conforming legacy payloads with a logged warning rather than raising. Switch the two new INSERTs to INSERT OR IGNORE so re-runs are idempotent.
2. FK orphan (CRITICAL): in daem0nmcp/migrations/schema.py:2655, drop memory_outcome_signals.record_id FK or backfill in dependency order so stream_id always exists in memory_records.
3. Replay UNIQUE (CRITICAL): in daem0nmcp/verification_v7.py:53, mark memory_provenance_edges / memory_outcome_signals as out of the canonical-replay digest, or skip _project_provenance for replayed events that already produced the edges.
4. Backfill transaction (WARNING): in daem0nmcp/migrations/schema.py:3264, split DDL and backfill into separate transactions and batch the backfill with LIMIT.
5. Gateway hardening (new WARNING): move result["meta"]/result["data"]/result["error"] accesses and the three model_validate calls inside the existing try so adapter malformations produce the sanitized gateway envelope.
6. Retention/intent (WARNING): route explore intent through _compose_retained in daem0nmcp/api/v7/federated_retrieval.py:470.
7. Late interaction (WARNING): drop the max-abs pre-normalization in daem0nmcp/retrieval/late_interaction.py:106; add the embedding reranker fallback in daem0nmcp/retrieval/runtime.py:487; fix query_identifiers in daem0nmcp/retrieval/composer.py:170; align retrieval_utility_mode default in daem0nmcp/config.py:120.

Final Merge Guidance

Do not merge until the 4 CRITICAL findings (migration 33 backfill + replay UNIQUE conflicts) are fixed. The 7 WARNING-level items are correctness regressions and should also be addressed before merge; the new gateway_operations.py:158 finding is the smallest safe addition.

Fix these issues in Kilo Cloud

Previous review (commit cb74022)

Status: 10 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	4
WARNING	6
SUGGESTION	0

Verdict

Request changes — migration 33 backfill will crash on the very first legacy row, breaking the upgrade path. Plus a replay-breaking UNIQUE conflict.

Issue Details (click to expand)

CRITICAL

File	Line	Issue
daem0nmcp/event_store.py	937	payload["record"].get("worked") KeyError on every legacy memory.created row in migration 33 backfill.
daem0nmcp/event_store.py	862	_project_provenance raises ValueError on non-conforming legacy events; aborts migration 33 backfill.
daem0nmcp/migrations/schema.py	2655	FK on memory_outcome_signals.record_id aborts backfill on orphan stream_id.
daem0nmcp/verification_v7.py	53	import_event_bundle re-inserts provenance edges/signals, hitting UNIQUE constraint and breaking verify-v7.

WARNING

File	Line	Issue
daem0nmcp/api/v7/federated_retrieval.py	470	explore intent skips retention even when retention_mode=apply; RETENTION_APPLIED is misleading.
daem0nmcp/retrieval/late_interaction.py	106	Non-standard ColBERT normalization (max-abs + L2); breaks MaxSim ranking vs reference.
daem0nmcp/retrieval/runtime.py	487	Missing fallback to embedding reranker when late-interaction profile is not ready; silent rerank loss.
daem0nmcp/retrieval/composer.py	170	query_identifiers produces py instead of foo.py; code-binding match broken for path queries.
daem0nmcp/config.py	118	retrieval_utility_mode default shadow adds query overhead by default; mismatch with dataclass default.
daem0nmcp/migrations/schema.py	3264	DDL + backfill run inside one BEGIN; long write lock stalls readers.

Files Reviewed (53 files)

• daem0nmcp/event_store.py - 2 critical
• daem0nmcp/migrations/schema.py - 1 critical, 1 warning
• daem0nmcp/verification_v7.py - 1 critical
• daem0nmcp/api/v7/federated_retrieval.py - 1 warning
• daem0nmcp/retrieval/late_interaction.py - 1 warning
• daem0nmcp/retrieval/runtime.py - 1 warning
• daem0nmcp/retrieval/composer.py - 1 warning
• daem0nmcp/config.py - 1 warning
• benchmarks/coding_memory_eval.py, daem0nmcp/api/v7/{discovery_operations,models,pinned,resource_repository,runtime_services,tools}.py, daem0nmcp/{capabilities,code_bindings,database,migrations/v7,models,retrieval/{dense_projection,repository,service,types,utility},schema_version,storage_activation}.py, docs/release/v7/{inventory.md,requirements.json}, pyproject.toml, uv.lock, .gitignore, CHANGELOG.md, README.md, all listed tests/*.py — reviewed; no new high-severity findings.

Ponytail Review

Ponytail findings (selected; full list omitted for brevity):

• daem0nmcp/event_store.py:806 shrink: collapse 55-line _is_source_provenance into two short helpers.
• daem0nmcp/code_bindings.py:78 reuse: replace hand-rolled _bindings_from_context validation with a single Pydantic model.
• daem0nmcp/code_bindings.py:113 yagni: drop binding_refs_from_context wrapper; only two callers.
• daem0nmcp/migrations/schema.py:3264 shrink: drop manual EventCommand(...) reconstruction in _backfill_memory_learning_evidence; expose a _project_provenance_from_row.
• benchmarks/coding_memory_eval.py:419 stdlib: replace hand-rolled _percentile with statistics.quantiles.
• benchmarks/coding_memory_eval.py:597 shrink: drop redundant if topics < 1 check.
• daem0nmcp/retrieval/service.py:697 stdlib: use delta.total_seconds() * 1_000_000 instead of hand-rolled microseconds math.
• daem0nmcp/retrieval/composer.py:162 shrink: simplify query_identifiers with a single regex.
• daem0nmcp/retrieval/late_interaction.py:79 yagni: drop list(...) materialization of single-result model calls.
• daem0nmcp/api/v7/runtime_services.py:524 reuse: inline _validate_informed_by; producer already runs the same len(set(...)) check.

Ponytail net: ~-90 lines.

Suggested Minimal Patch

1. In event_store.py, change payload["record"].get("worked") to record = payload.get("record") or {} + worked = record.get("worked") if isinstance(record, Mapping) else None.
2. In migrations/schema.py:_backfill_memory_learning_evidence, wrap store._project_provenance(...) in try/except ValueError (log + skip) and split DDL/backfill into separate transactions with batched LIMIT.
3. In event_store.py:_project_provenance, switch the two new INSERTs to INSERT OR IGNORE.
4. In verification_v7.py / import_event_bundle, skip _project_provenance when the provenance edges/signals already exist for the (workspace_id, event_id).
5. Fix _normalized_tokens (drop max-abs

[Snapshot truncated.]

Additional previous summary content was truncated to keep this comment within platform limits.

---

_{Reviewed by minimax-m3 · Input: 65.2K · Output: 16.3K · Cached: 2.1M}

_{Review guidance: REVIEW.md from base branch working_branch}

[9thLevelSoftware]

Addressed the current optional SQLite-classification finding in cd7eb8b: discovery reuses numeric SQLite BUSY/LOCKED classification, with only a narrow canonical-diagnostic fallback for code-less exceptions. A real missing-table error mentioning busy_records or locked_cache now remains nonretryable CAPABILITY_DEGRADED; real lock contention still yields retryable DATABASE_IN_USE. Consumer regressions passed.

The benchmark-only server-rebuild suggestion is not adopted: the strict rejection probe and measured scenario intentionally use separate fresh server/session state, and the frozen harness remains unchanged. Re-running that exact harness after remediation preserved coding-memory nDCG 0.850000000000, required-fact retention/stale recall 1.0, false flags 0.0 and the 9 listed / 1 guided / 3 strict / 2 destructive-call measurements.

All 11 inline review threads now have individual evidence-backed responses. Valid boundary/recovery/diagnostic findings are fixed; unsupported provenance skipping, conflict suppression, normalization rollback, silent reranker fallback and transaction splitting were not applied. Targeted checks passed (210 tests and 217 subtests), plus full Ruff/type/inventory gates. The final full suite and pushed-head Actions checks are still running; their final results will be added to the PR description.

[9thLevelSoftware]

Follow-up CI correction pushed as b38753f. The Ubuntu/Python 3.10 failure occurred in initial entity-recall catchup, not the BEGIN EXCLUSIVE lock scenario. A controlled real Task8RecallService/lexical-builder smoke reproduced generation publication between an empty retrieval and readiness inspection: the old check returned terminal CAPABILITY_DEGRADED although an identical retry succeeded. The check now retains retryable DATABASE_IN_USE when publication advances the selected generation, while same-generation indexed genuine misses remain terminal. Original SQLite classification is unchanged.

The real before/after smoke, discovery/process suite (44 tests, 20 subtests), full Ruff/format/mypy/inventory gates and unchanged frozen benchmark (nDCG 0.85) pass. Final-head full local suite and Actions matrix are running; no green-CI claim is made yet.

[9thLevelSoftware]

Review remediation complete at b38753f (with cd7eb8b). All 11 inline threads are answered and resolved; the latest Kilo review reports no issues. All 12 Actions jobs now passed at this exact head, including every Ubuntu/Windows/macOS Python 3.10–3.12 test leg; GitGuardian and Kilo checks also passed. Runner-unassigned cancellations were rerun until the actual missing leg executed successfully.

The valid gateway, malformed-history, derived-parent recovery, SQLite-classification and explore-diagnostic findings are fixed, and the CI-discovered lexical publication race is reproduced/fixed with a real consumer regression. Frozen benchmark remains coding-memory nDCG 0.85 with unchanged fact/stale/false-flag and call-count metrics. Explore composition remains baseline: only its diagnostic changed, not a routing through retained packing.

Verification transparency: the optional-extras local final full runs each had 3,326 passes/66 skips/1,667 subtests and one failure (WinError 5 storage rename once; dreaming startup returned advertised retryable DATABASE_IN_USE in the instrumented run). Native sharing/SQLite/Qdrant/drain instrumentation across the real case, all 34 path-policy tests and the full-suite rename observed successful rename with no owned target handle. The original WinError owner is unknown after process exit; no speculative fix or retry/suppression was applied. These caveats are retained in the PR description rather than represented as clean local full-suite results.