fix(runtime,brain,kg): resolve feedback (visible-set) + by-ID (unfiltered) targets under Rev 6 (#391)

[ohdearquant]

Outage

brain.auto_feedback / brain.feedback has been erroring no record matches id prefix / target_id … not found in namespace … for every episodic memory
written since 2026-06-19. Root cause (live-reproduced on a 20-hour-old memory
fd61fef5): under ADR-007 Rev 6, EPISODIC memory notes are stamped with the
actor id namespace (e.g. lambda:leo), but feedback resolved the target
using the caller token namespace (local) only. The row was invisible to
feedback resolution, so the fleet-wide feedback-discipline loop has been down.
Pre-Rev-6 rows (ns=local) still resolved, which is why old memories worked
and new ones didn't.

Two distinct resolution policies land in this PR — kept deliberately separate

1. feedback (leg B = hex-prefix in resolve_auto_feedback_target, leg C =
   exact-UUID in handle_feedback) → visible-set-aware resolution. Feedback
   targets are recall outputs, and recall is already visible-set-aware
   ({local} ∪ {actor.id} ∪ {actor.visible_namespaces}, exposed as
   token.visible_namespaces()). Feedback now resolves over that same set
   instead of the primary token namespace only — one visibility principle, one
   code path as recall.
2. by-ID CRUD (get/update/delete/merge) prefix path →
   fully unfiltered. Empirical finding: the full-UUID by-ID path
   (resolve_by_id, get_note, update_note, merge_*) was already
   namespace-agnostic — ADR-007 Rev 6 states by-ID ops carry no visibility
   boundary; the Gate is the authz seam, not storage-layer filtering. Only the
   hex-prefix expansion step (resolve_uuid_async in
   khive-pack-kg/src/handlers/common.rs) was still primary-namespace-only,
   silently narrowing prefix lookups to a boundary the full-UUID path never
   had. This is a separate policy from feedback's — by-ID has no visibility
   boundary at all, feedback's boundary is the visible set.

Both share one implementation: resolve_prefix_inner now takes
namespaces: Option<&[String]> (operations.rs) — Some([primary]) for the
existing strict resolvers, Some(visible_set) for the new
resolve_prefix_visible, None for the new
resolve_prefix_unfiltered/resolve_prefix_unfiltered_including_deleted.
khive-pack-kg/src/handlers/common.rs gets matching
resolve_uuid_unfiltered/resolve_uuid_unfiltered_including_deleted wrappers,
wired only into get.rs, update.rs (update + soft/hard delete), and
merge.rs.

Deliberately untouched

• resolve_primary and strict resolve_prefix (via resolve_uuid_async) —
  used by gtd depends_on validation and link/edge endpoint validation. Their
  primary-namespace-only strictness is a tested contract for those callers,
  not a bug. Confirmed still enforced:
  resolve_primary_rejects_visible_only_{task,entity} (gtd dependencies.rs)
  stay green.
• resolve_uuid_async prefix resolution in link.rs, create.rs, list.rs,
  graph.rs — same root-cause family (primary-ns-only prefix resolution), but
  staying strict here is a deliberate, separate design question (can an edge
  endpoint or a list/graph filter root cross a namespace boundary?). Noted as
  adjacent, intentionally out of scope for this PR.
• merge_entity's namespace-ownership check (curation.rs) — a separate,
  pre-existing mutation-safety mechanism downstream of id resolution. With
  this fix, merge-by-prefix now resolves cross-namespace (proven by the
  changed error: resolution succeeds, then the ownership check legitimately
  rejects the cross-namespace merge — no longer a resolution-layer NotFound).
  The ownership check itself is out of scope.
• Leg A (profile-registry per-session staleness) — a different root cause and
  fix locus (reload-on-miss), tracked separately from this id-resolution fix.

Tests

• khive-pack-brain/src/tests.rs: 3 positive shapes (old local row, new
  actor-ns row by both prefix and full UUID, explicit namespace= override) +
  1 negative (third-party namespace not in the caller's visible set still
  NotFound) for both brain.auto_feedback and brain.feedback.
• khive-pack-brain/tests/dispatch_hook.rs: the stale
  brain_feedback_rejects_visible_only_target_id test (which asserted the
  bug's own behavior, added by PR feat(runtime): multi-namespace read visibility (visible-set tokens) #127) is renamed
  brain_feedback_accepts_visible_only_target_id and inverted to assert the
  corrected behavior.
• khive-pack-kg/tests/integration.rs: 8 new tests for by-ID CRUD's unfiltered
  policy — get/update/soft-delete/hard-delete by prefix cross-namespace now
  succeed; full-UUID cross-namespace guard retained; merge by prefix
  cross-namespace resolves and then correctly hits the separate ownership
  check (not a resolution error); merge by prefix same-namespace succeeds;
  a prefix matching nothing still raises NotFound.

All tests use an isolated in-process runtime over a temp/in-memory SQLite
database — never the production khive.db.

Gates (all green, run from crates/)

• cargo fmt --all -- --check — rc 0
• cargo clippy --workspace --all-targets -- -D warnings — rc 0
• cargo test --workspace --locked — rc 0 (0 failed across every test binary)
• RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --workspace — rc 0
• cargo test -p khive-pack-gtd --test dependencies --locked — rc 0 (no-regression anchor: resolve_primary_rejects_visible_only_* stay green)
• cargo test -p khive-runtime --test integration --locked — rc 0 (no-regression anchor: visible_set_reads_primary_and_extra_not_third, resolve_uses_visible_set_for_note_in_extra_namespace, hybrid_search_surfaces_all_visible_namespaces stay green)

Do NOT merge

This PR is gated by λ:khive: codex review → λ second-look on the two review
anchors above → Ocean HC-7 approval.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com

🤖 Generated with Claude Code