[jmc-wander]

Summary

Stacked on #91; merge #91 first, then retarget this PR to main. The combined commit preserves both APIs and all 78 MCP tools.

Add explicitly invoked practical-memory and evidence-reference APIs with matching CLI/MCP tools. Selected facts and summaries retain exact source bindings, scope, time, conditions and provenance. Optional lossless metadata packing and incoming navigation remain disabled by default; ordinary retrieval and hooks are unchanged.

Explicit correction and dream-index imports remain advisory, source-backed navigation. They do not establish truth, permission or task completion. No organizer model, automatic consolidation, scheduler or human beta is enabled.

Production repairs

• Open existing databases without recreating a missing file during write-open races; return typed safe failures.
• Bound incoming enumeration to 1,024 distinct raw rows per request; overflow fails closed. This does not bound SQLite sorting or inherited outgoing work.
• Bind native Kindex session selection separately from provider conversation IDs.
• Keep new MCP reads free of writable singleton/health initialization; reject coercion, unknown arguments and request-supplied scope authority.
• Preserve canonical wire formats while adding strict Pydantic boundary validation.

Validation

• Current-main baseline: 3,907 passed, 3 skipped, 9 subtests.
• Independent V7–V9 contracts plus production race, scope, decoder, CLI and actual MCP dispatcher tests are included in repository CI.
• Database deletion-race and incoming-overflow tests were observed failing against the frozen campaign candidate before repair.
• Removing client admission in an isolated mutant makes the public scope test fail.
• Independent review found three adapter/documentation defects; all repaired and changed bytes reviewed. No surviving concrete finding from that review.
• Standalone practical-memory full suite: 4,065 passed, 3 skipped, 267 subtests.
• Combined full suite on b382f9d220d5ea0f6b89915ac93253baeb49703f: 4,279 passed, 3 skipped, 267 subtests; includes same-session retention/persist/ack/restart/replay coexistence.
• Final-head CI pending; PR remains draft until complete.
• Combined interaction review found no remaining concrete defect. Human review by Jeremy McEntire remains required for the source/privacy and durable-record surfaces.

Limits and risk

Fresh practical evaluation retained the same 20/36 facts with and without packing; packing saved 3.58% bytes and increased local expansion time. No recall or organizer-effectiveness improvement is claimed.

Source/privacy boundaries and durable advisory records require careful review. Local host annotations are not authentication. Existing source text is never replaced; explicit mutations preserve receipts and bounded history. No live knowledge stores, private history or paid model calls were used. Validator, Coder and Tester used the same model family with procedural separation.

Not run

No human beta, live-store migration, paid model evaluation or hosted multi-tenant authorization qualification.

Rollback

Revert the additive code. Preserve any created registry/history records; these are not a complete source backup. No release tag or automatic activation is included.