v1.1.5

Security

• Deferred-embed pending rows are now encrypted at rest. On an encrypted store, a record awaiting background embedding briefly held its text (literal_surface) and provenance in plaintext during the embed window. Pending rows are now encrypted on write and decrypted just before embedding, matching the rest of the at-rest encryption. Unencrypted stores are unaffected.

Fixed

• Sleep daemon WAKE/idle CPU storm — the consolidation cycle could spin the CPU and never settle; the daemon now serves recall on wake. Thanks to @Marsu6996 (#20).
• Consolidation & recall correctness — tombstoned records excluded from the runtime graph, crisis-mode topology built on the live graph, recall score clamp, reflection-embedding + crash recovery hardened — closing the root causes behind the crisis-mode loop. Thanks to @Marsu6996 (#22).