chore: sync upstream/develop through da5a48c (post-v3.5.0, 213 commits)

.claude-plugin/hooks/hooks.json

@@ -34,6 +34,17 @@
         ]
       }
     ],
+    "SessionEnd": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/mempal-session-end-hook.sh\"",
+            "timeout": 10
+          }
+        ]
+      }
+    ],
     "PreCompact": [
       {
         "hooks": [

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.13"]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
@@ -45,7 +45,7 @@ jobs:
     if: github.event_name == 'workflow_dispatch'
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: "3.13"
@@ -63,7 +63,7 @@ jobs:
     if: github.event_name == 'workflow_dispatch'
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: "3.13"
@@ -73,7 +73,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: "3.11"

.github/workflows/deploy-docs.yml

@@ -23,7 +23,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/docker-publish.yml

@@ -22,14 +22,14 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Needed for the emulated linux/arm64 build on real pushes.
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       # Only authenticate + push for in-repo events. Fork PRs lack the
       # packages:write token, so they build (to validate the Dockerfile) but
@@ -79,10 +79,10 @@ jobs:
   build-gpu:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build GPU image (validation only — not published)
         uses: docker/build-push-action@v7

.github/workflows/publish.yml

@@ -73,7 +73,7 @@ jobs:
           echo "tag=$tag" >> "$GITHUB_OUTPUT"
           echo "Resolved tag: $tag"
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Fully-qualified refs/tags/ so an unqualified name can't resolve to a
           # same-named *branch* instead of the tag (checkout prefers branches).

.github/workflows/version-guard.yml

@@ -16,7 +16,7 @@ jobs:
   check-versions:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Extract versions from all sources
         id: versions

CHANGELOG.md

@@ -80,68 +80,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ---
 
-## [Unreleased] — 2026-05-17 — *AGE-integration 6-phase plan: KnowledgeGraphAGE + write-through + palace structure + backfill + walk_palace MCP*
-
-Multi-project AGE-integration plan landed on this fork's `feat/age-kg-parity` branch ([PR #101](https://github.com/techempower-org/mempalace/pull/101)). Companion fork-PR on palace-daemon adds the read-side fusion endpoint ([techempower-org/palace-daemon#25](https://github.com/techempower-org/palace-daemon/pull/25)). The metaphor of *the AI walking into a palace and finding wings, rooms, and drawers* now corresponds to real Cypher traversal over a unified `Wing → Room → Drawer → MENTIONS → Entity` graph.
-
-### Added
-
-- **`KnowledgeGraphAGE` API parity with the SQLite `KnowledgeGraph`** ([`ff7187d`](https://github.com/techempower-org/mempalace/commit/ff7187d)). Adds 6 missing methods (`add_entity`, `invalidate`, `query_entity`, `query_relationship`, `timeline`, `seed_from_entity_facts`) on top of the existing `add_triple` / `query_triples` / `stats` / `clear`. AGE 1.6.0 Cypher dialect gaps documented + worked around: no `ON CREATE SET`, no multi-column `RETURN` inside `cypher()`, no list literals, no `SET` on edge properties inline.
-- **Write-through KG middleware on `PostgresCollection`** ([`3321d83`](https://github.com/techempower-org/mempalace/commit/3321d83)). New `set_kg_writethrough(hook)` API; hook fires after every successful drawer write with `(drawer_id, document, metadata)`. New module `mempalace/kg_writethrough.py` provides `make_age_writethrough(kg, extractor)` factory + env-var-driven `make_writethrough_from_env()` + a builtin regex extractor fallback. Default behavior unchanged when no hook is registered.
-- **Palace structure as native AGE nodes** ([`ff583c0`](https://github.com/techempower-org/mempalace/commit/ff583c0)). New module `mempalace/palace_graph_age.py` mirrors the SQL-aggregation pattern from `mempalace.palace_graph` into AGE: `populate_from_postgres(kg, dsn, table_name)` builds `Wing -[CONTAINS]-> Room -[CONTAINS]-> Drawer` + `Wing -[SHARED_VIA {via_room}]- Wing` tunnels. Idempotent via MERGE.
-- **`backfill_age` — restartable AGE population from drawer table** ([`b3f0206`](https://github.com/techempower-org/mempalace/commit/b3f0206)). New module + CLI `mempalace-backfill-age` for one-shot postgres-drawers → postgres-AGE migration. Checkpoint table `mempalace_kg_backfill_state` makes re-runs safe. Smoke-tested on 5344-drawer test palace (58948 entities in 26 min); ~22h projected for production 274K palace.
-- **`add_mention(drawer_id, entity_name)` on `KnowledgeGraphAGE`** (same `b3f0206`). Connects palace-structure to entity layer via `(Drawer)-[:MENTIONS]->(Entity)` edges. CREATE-ALWAYS semantics matches SQLite KG triples-table behavior; idempotency tracked externally via backfill checkpoint table.
-- **`mempalace_walk_palace` MCP tool** ([`8022ecb`](https://github.com/techempower-org/mempalace/commit/8022ecb)). Agent-facing walk primitive: `start_wing="..."` walks down, `start_room="..."` enumerates across wings, `start_entity="..."` is inverse walk. Requires `MEMPALACE_BACKEND=postgres` + AGE populated.
-- **`.gemini/config.yaml`** ([`c35c74e`](https://github.com/techempower-org/mempalace/commit/c35c74e)). Gemini Code Assist tuning — MEDIUM severity threshold, ignore patterns for benchmark JSONs and generated `FORK_CHANGELOG.md`.
-
-### Spike result that motivated the plan
-
-[AGE write-through bench on n=200 git-derived probes](https://github.com/techempower-org/multipass-structural-memory-eval/blob/feat/rlm-adapter/docs/benchmarks/2026-05-17-age-write-through-spike.md):
-
-| Mode | R@5 | Δ vs vector |
-|---|---:|---:|
-| vector_only (pgvector + MiniLM base) | 0.1850 | — |
-| graph_only (AGE entity-overlap) | 0.2350 | **+5.0pp** |
-| fusion (RRF combine) | 0.2750 | **+9.0pp** |
-
-### Cross-fork verification
-
-Independent same-day audit by [@nakata-app](https://github.com/nakata-app) on his AdaptMem fork found the same operational conclusion via a different angle (code-level audit found `KnowledgeGraphAGE` skeleton-only; state-level audit on the production palace-daemon found 2 placeholder vertices + 1 placeholder edge total). Cross-fork verification framing discussed at [MemPalace/mempalace/discussions/1384#discussioncomment-16951344](https://github.com/MemPalace/mempalace/discussions/1384#discussioncomment-16951344).
-
-### Fixed
-
-- **upstream/develop sync** ([`6058489`](https://github.com/techempower-org/mempalace/commit/6058489)). Merged 60 develop commits into fork main (last sync 2026-05-13 via PR #1487). 12 conflict files resolved across `cli.py`, `convo_miner.py`, `hooks_cli.py`, `mcp_server.py`, `miner.py`, `palace.py`, `palace_graph.py`, `searcher.py`, and three test files. Notable upstream changes brought in: Igor's #1519 `convo_miner` `min_chunk_size` validation, KG cache path canonicalization via `_canonicalize_kg_path` + `realpath` + `normcase` (4 commits), cold-start embedder diagnostics + opt-in warmup (#1495), tunnel hyphenated wing slug preservation (#1504), stratified palace state messages (#1498), bash 3.2 compat for hooks (#1440), entity-registry tmp cleanup on failure (#1408), and none-metadata MCP handler fix (#1445). Follow-up commit [`342a59f`](https://github.com/techempower-org/mempalace/commit/342a59f) drops shadow `chunk_*` properties on `MempalaceConfig`, scales hook timeout bounds in `tests/test_claude_plugin_hook_config.py` to milliseconds, and updates fork-side test assertions to match upstream's new `wing_<project>` API shape (#1410).
-
----
-
-## [Unreleased] — 2026-05-14 / 2026-05-15 — *postgres cutover, hybrid retrieval, encoder-axis evidence*
-
-Fork-side work that landed after the v3.3.5 release. Nothing upstreamed yet; some of it is operator-flavored and lives only on the fork.
-
-### Added
-
-- **Postgres + pgvector + Apache AGE backend is now the production default** on this fork. Cutover from chromadb-on-disk happened over 2026-05-13 / 14; `main` now serves live traffic against a 273K-drawer palace on `disks:5433` (PG16 + pgvector 0.8.2 + AGE 1.6.0). Composes upstream [#665](https://github.com/MemPalace/mempalace/pull/665) (skuznetsov's `PostgresBackend` on the RFC 001 contract) plus the pgvector lazy-index race fix below. The chromadb backend still works behind `MEMPALACE_BACKEND=chroma`. Operator narrative: [`docs/operators/pgvector-cutover-runbook.md`](docs/operators/pgvector-cutover-runbook.md).
-- **Hybrid retrieval** as `candidate_strategy="hybrid"` — vector candidates ∪ BM25 candidates (postgres `tsvector` + `pg_trgm` GIN for ILIKE identifier fallback) ∪ AGE graph-expanded candidates, hybrid-reranked. Exposed via [palace-daemon](https://github.com/techempower-org/palace-daemon)'s new `/search/keyword` and `/search/hybrid` HTTP endpoints. Search@5000 p50 125ms; recall@5 0.60 synthetic; filtered recall=1.00 on wing-scoped queries.
-- **`symbol_header_prefix` keyword-only kwarg on `mempalace.miner.chunk_text`** for representation-axis experiments (AST-lite, encoder-domain adaptation with explicit symbol disambiguation). Backward-compatible — default `None` preserves existing behavior. Companion to discussion [#1384](https://github.com/MemPalace/mempalace/discussions/1384).
-- **`scripts/derive_probes_from_git.py`** — deterministically derives n=200 retrieval probes from this repo's git log, filtering noise-prefix commits and picking a primary changed file per commit. Replaces the hand-curated n=20 set in [`scripts/chunk_strategy_ablation.py`](scripts/chunk_strategy_ablation.py) whose paired-bootstrap 95% CIs all overlapped zero. JSON snapshot at [`scripts/probes_v2_git_derived.json`](scripts/probes_v2_git_derived.json). `--probes <json>` flag added to the ablation harness so the larger set is wired in.
-- **`scripts/verify_rrf_ftcode5k.py` + `scripts/verify_rrf_3way.py`** — local RRF reproduction against [adaptmem](https://github.com/nakata-app/adaptmem) FT-Code SentenceTransformer checkpoints (300 / 1000 / 5000). 3-way RRF on the n=200 probe set: default ONNX 0.4260 / FT-Code-1000 0.4229 / FT-Code-5000 0.3972 / **3-way fused 0.5101** (+0.0841 MRR vs best solo). Reproduces nakata-app's #1384 §4 inversion at 10× sample size — the encoder with worst solo MRR contributes the largest 2-way fusion lift.
-- **`docs/benchmarks/2026-05-15-remaining-benches.json`** — captures 5 of 9 mempalace `tests/benchmarks/` suites that hadn't been re-run after the postgres cutover (`test_ingest_bench`, `test_knowledge_graph_bench`, `test_layers_bench`, `test_mcp_bench`, `test_memory_profile`). 64/64 passed in 1h 24m at `--bench-scale=small` against the production postgres palace. Companion to [`docs/benchmarks/2026-05-14-search-bench-hybrid-cutover.json`](docs/benchmarks/2026-05-14-search-bench-hybrid-cutover.json).
-
-### Fixed
-
-- **pgvector lazy-index race wedges the database** under concurrent writes. `PostgresBackend._maybe_create_vector_index` had a SELECT-then-`CREATE INDEX` race with a name-coupled existence check — three concurrent writers crossing the threshold held `ACCESS EXCLUSIVE` for 30+ minutes. Fixed at commit `4566f8a` with `pg_advisory_xact_lock(hashtext('vec_idx:<table>'))` + `CREATE INDEX IF NOT EXISTS`. Operator follow-up at upstream [#665](https://github.com/MemPalace/mempalace/pull/665) plus recovery procedure documented in the runbook.
-- **`docs/embedding.py`** doc comment warning custom-EF authors about the chromadb 1.5+ `EmbeddingFunction.embed_query` requirement. A bare class with `__call__` + `name()` passes `Collection.upsert` but raises `AttributeError` on `Collection.query(query_texts=...)` — mempalace's searcher catches that and silently falls back to BM25, making encoder swaps invisible. Subclassing `chromadb.api.types.EmbeddingFunction` inherits a default `embed_query` that delegates to `__call__`. We hit this debugging the RRF verifier; the comment is for downstream users implementing alternative encoders.
-
-### Cherry-picks from upstream PRs (in-flight, used early)
-
-- **[#1490](https://github.com/MemPalace/mempalace/pull/1490)** (open, @nakata-app) — `fix(benchmarks): honor --granularity across hybrid_v2/v3/v4; reject in palace/diary`. Three commits (`7ba6522`, `a8303ec`, `7766343`) cherry-picked. `build_palace_and_retrieve_hybrid_v{2,3,4}` accepted a `granularity` parameter but never branched on it, so `--granularity turn` and `--granularity session` produced bitwise-identical metrics. Per our fork-first convention; will deduplicate at upstream-merge time.
-
-### Documentation
-
-- Discussion [#1384](https://github.com/MemPalace/mempalace/discussions/1384) — chunking-strategy ablation × encoder thread with @nakata-app. Posted operator reproduction of their #1384 §4 RRF result on our n=200 probe set + flagged the EF.embed_query protocol gotcha.
-- PR [#665](https://github.com/MemPalace/mempalace/pull/665) — third operator follow-up with cutover state, bench results, and the EF protocol note for anyone implementing alternative `BaseBackend` encoders.
-## [Unreleased] — 2026-05-22 — *Upstream tunnels fixes (cherry-picked from MemPalace/develop)*
-
 ## [3.3.6] — 2026-05-24
 
 ### Features

FORK_CHANGELOG.md

@@ -18,6 +18,38 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ---
 
 
+## [2026-07-02]
+
+
+### Changed
+
+
+- **Sync upstream/develop through da5a48c (post-v3.5.0): remote MCP server w/ TLS + read-only, graph auto-population, Qdrant facets, list_drawers date filters, 213 commits** ([`TBD`](https://github.com/techempower-org/mempalace/commit/TBD))
+  Merged 213 upstream commits (post-v3.5.0 ``da5a48c``). Notable
+  upstream additions: the turnkey secure remote MCP server with TLS and
+  a read-only server mode (#1877 / #1900), associative-graph
+  auto-population from mined sessions + ``cmd_hallways`` (#1895),
+  Qdrant server-side metadata facets (#1868), ``since``/``before``
+  date filters on ``list_drawers`` (#1128 / #1891), authored-timestamp
+  preservation from transcripts (#1890), ``mine_palace_lock``
+  re-entrancy for the HTTP transport (#1859), a pgvector metadata-only
+  fetch fix (#1892), SQLite magic-header ``detect()`` (#1893 / #1896),
+  FTS5 auto-heal (#1878), a host-root-logger fix (#1860 / #1885),
+  LaTeX extensions, and dependency bumps (ruff 0.15.20).
+
+  ~50 conflicted files resolved by composing rather than choosing
+  sides: ``tool_list_drawers`` carries BOTH the upstream date filters
+  and the fork tag filters; ``tool_status`` keeps the fork's postgres
+  fast path (#267) and gains the upstream facets sweep; the HTTP
+  transport keeps host pinning and gains TLS + read-only; the merged
+  plugin hook config stays the fork's five-event ms-timeout shape. The
+  merged MCP tool surface stays at 39 tools (upstream's 34 plus fork
+  tools); all doc and manifest tool-count claims reconciled against the
+  live ``mcp_server.TOOLS`` count.
+
+  *Files:* `mempalace/mcp_server.py`, `mempalace/searcher.py`, `mempalace/cli.py`, `mempalace/convo_miner.py`, `mempalace/embedding.py`, `mempalace/backends/base.py`, `mempalace/backends/pgvector.py`, `tests/conftest.py`, `tests/test_mcp_server.py`, `tests/test_backends.py`
+
+
 ## [2026-07-01]