HZR 0.3.4

HZR 0.3.4 — Better evidence, safe memory lifecycle, truthful observability

HZR 0.3.4 hardens the information given to coding agents and closes the memory-lifecycle gap
left in 0.3.3. Context plans now preserve retrieval signal instead of favoring short artifacts,
managed agents receive repository instructions and locatable evidence, and memory maintenance is
available without weakening project isolation or making pruning destructive by default.

The observatory also stops presenting synthetic search probes as user activity. Provider usage,
local estimates, index health, and recorded operations remain separate evidence classes.

No benchmark percentage changes are claimed in this release. The new deterministic gates prove
the implementation contracts; provider-backed task quality and economics remain a separate
release-evidence requirement.

Context plans rank evidence instead of file size

The previous fusion score was effectively reciprocal rank with a large constant. Over HZR's short
candidate lists, strong and weak results collapsed into a narrow band. The selection utility then
divided by the square root of token count, so a tiny manifest or opaque artifact could outrank a
longer file containing the answer.

• Scores are normalized within each retrieval source before weighted fusion, preserving the
  magnitude that source actually observed.
• Candidate length is enforced as a budget constraint, not treated as evidence of relevance.
• Weak candidates are rejected with relevance_floor; unlocatable code artifacts are demoted.
• Durable memory receives a minority share of the input budget, so stale prose cannot displace the
  code it describes.
• The configured output reserve and safety margin are subtracted before context selection.
• Symbol-shaped intents add a bounded exact search alongside ranked retrieval.
• Long memory bodies are bounded while preserving both the initial context and latest tail.
• coverage now reports addressable evidence, while confidence reports separation between the
  leading candidate and the remaining field.

Managed agents receive instructions and locatable evidence

The Caveman bridge previously disabled duplicate SDK subsystems correctly, but also suppressed the
repository instructions the model needed to work safely. It then appended the planner's complete
JSON response to the prompt.

• Bounded root AGENTS.md and CLAUDE.md files are loaded as repository-control instructions.
• Agents are told to discover more-specific nested AGENTS.md files before editing below them.
• Prefetched context is rendered as a bounded, explicitly untrusted evidence brief with paths,
  symbols, line spans, relevance, token counts, and selected content.
• Raw planner JSON is no longer injected into the model prompt.
• Native Caveman tools, hooks, memory, repo maps, and prompt templates remain disabled; HZR stays
  the only control plane.
• Managed prompts are bounded at 64 KiB, project instructions at 24 KiB, and prefetched evidence at
  16,000 characters.
• High and irreversible codec requests force exact fidelity in the daemon path.

Memory maintenance is scoped and safe by default

hzr memory update, hzr memory forget, and hzr memory prune are now available through the CLI,
daemon API, native MCP server, and managed-agent bridge.

• Every mutation first enumerates typed ICM records and applies the same positive project/global
  namespace filter used by recall.
• A project request cannot mutate another repository or the global namespace.
• Pruning is a preview unless the CLI receives --apply or an API/MCP caller explicitly disables
  dry_run.
• High and critical memories are never selected by threshold pruning, regardless of weight.
• Partial prune failures report how many records were deleted and require inspection before retry.
• Mutation transport failures remain explicitly ambiguous; HZR never falls back to a second store.

The public loopback dashboard now redacts memory summaries, raw excerpts, keywords, and source
data. Full bounded details moved to the bearer-authenticated
GET /v1/memory/topics/{opaque_topic_id} endpoint. Repository filtering and opaque topic IDs are
unchanged.

MCP cancellation and usage accounting survive failures

• Native MCP tool calls run concurrently instead of serializing every request behind one slow
  operation.
• notifications/cancelled aborts an in-flight tool call and suppresses any late response.
• Duplicate in-flight request IDs are rejected, and stdin EOF aborts remaining work.
• Failed managed-provider usage receipts are written to private 0600 outbox entries under a
  0700 directory and replayed after the daemon recovers.
• Entries are removed only after the usage endpoint confirms recording. Ledger trace_id
  idempotency prevents replay from creating duplicate provider records.

The observatory reports recorded activity

The grepai panel no longer runs a hard-coded semantic canary and labels it as live user traffic.
Index readiness comes from the managed watcher and artifact evidence. Routed-search activity is
shown only when a real optimized HZR search exists in the selected project's ledger, including its
exact command, working directory, latency, and observed attribution. When no such request exists,
the UI says so.

Installation reports progress and the resulting layout

The self-contained bundle is large enough that a silent transfer can look stalled. The installer
now reports five numbered steps, shows curl or wget transfer progress on an interactive terminal,
and finishes with the version root, active-version pointer, command entry points, data directory,
dashboard URL, health check, and concrete next-use commands. PATH guidance is printed only when the
configured bin directory is absent from the current PATH.

The atomic active-version swap also cleans up its pending .current-<pid> symlink if installation
exits before the replacement completes.

Upgrade impact

The upgrade does not rewrite existing memory rows or project configuration. The new usage outbox is
created only when a managed provider receipt cannot reach the daemon. Public dashboard clients that
previously displayed memory content now receive redacted fields and must use the authenticated API
when content inspection is required.

Upgrade and verify the installed ownership model with:

hzr update
hzr mcp status
hzr doctor

Restart already-open Codex or Claude Desktop sessions after upgrading so they reload the expanded
MCP tool catalog and managed instructions.

Verification

The release gate includes:

cargo fmt --all -- --check
cargo clippy --workspace --all-targets --all-features -- -D warnings
cargo test --workspace --all-targets --all-features
rustup run 1.85.0 cargo check --locked --workspace --all-targets --all-features
scripts/verify-fork-core.sh --test
cd integrations/caveman-code && npm ci --ignore-scripts && node --test bridge.test.mjs
cd visualizer && bun install --frozen-lockfile && bun test && bun run typecheck && bun run build

The bundle gate additionally verifies the manifest, clean installation, same-version
re-attestation, public hzr and compatibility rtk entrypoints, all four pinned engines, and the
installed 0.3.4 behavior before publication.

Provider-paired quality/economic trials, Windows native artifacts, and release SBOM/license evidence
remain explicit gates for a future state-of-the-art or Windows-support claim; this release does not
represent those external checks as complete.