Security
- Deferred-embed pending rows are now encrypted at rest. On an encrypted store, a record awaiting background embedding briefly held its text (
literal_surface) and provenance in plaintext during the embed window. Pending rows are now encrypted on write and decrypted just before embedding, matching the rest of the at-rest encryption. Unencrypted stores are unaffected.
Fixed
- Sleep daemon WAKE/idle CPU storm — the consolidation cycle could spin the CPU and never settle; the daemon now serves recall on wake. Thanks to @Marsu6996 (#20).
- Consolidation & recall correctness — tombstoned records excluded from the runtime graph, crisis-mode topology built on the live graph, recall score clamp, reflection-embedding + crash recovery hardened — closing the root causes behind the crisis-mode loop. Thanks to @Marsu6996 (#22).