v1.32.0
Hardening pass: five follow-ups from the v1.31.0 tombstone episode.
Fixed
- Cross-tenant consolidation landing: merge clustering is now partitioned by tenant (a cluster can never mix tenants' content into one row), and merge, trace, extract, and DAG L2 producers stamp rows with their source tenant instead of always 'default'. Trace idempotency fixed for non-default tenants. Single-tenant stores byte-identical.
- MCP audit attribution: every MCP tool path records the auth-resolved caller identity (HTTP-MCP) or 'mcp' (stdio) on every audit row, including recall side effects. One caller, one principal.
- memory-value-wiring test flake: root-caused (double clock read in createMemory, ~0.1 percent non-unity stored strength) and fixed by single-sourcing the clock basis. No tolerance widening.
Added
- Tombstone-refused DAG rebuilds are counted separately from successful rebuilds (
summariesRebuildRefused/DagRebuildResult.refused, surfaced as "N refused" in sleep details).
Changed
- The consolidation rejection-guard db handle opens lazily on first use.
Known issue (pre-existing, filed)
- The dedupe pass is tenant-blind: byte-identical content in two tenants can be deduplicated across the tenant boundary (multi-tenant data loss). Exposed by the landing fix; tracked as the top backlog candidate.
Gates: plan-eng 90, code-review 92, independent review 94 (zero behavioral findings), codex converged clean in 3 rounds. Suite 2977/0 at head plus a two-tenant E2E drive on the compiled CLI. PR #143.