docs(adr): ADR-081 recall retune driver

[ohdearquant]

Summary

Spec-first ADR for the recall retune driver: governed ingestion of implicit feedback from the out-of-band session scorer into brain posteriors.

• Weight ownership: amends the brain-owned weight table (FeedbackEventKind::update_weight(), khive-brain-core) — implicit drops 0.5 → 0.1 before the first high-volume implicit emitter goes live; explicit comparator C = 1.5.
• Governing invariant (exact scope): decayed implicit mass per accounting key (profile_id, namespace, target_id) never exceeds C. Enforced structurally at fold time (mass check + fold in one transaction on the serialized write lane), so no emission-surface property can breach it. Idempotent replay via scorer_run_id dedup.
• Signal mapping: scorer used → implicit_positive, ignored → implicit_negative, contradicted emits nothing automatically (wrong/correction stay caller-judged per ADR-014).
• Cross-session serve ledger: brain-owned, full attribution schema (profile, namespace, consumer_kind, resolve audit fields, scorer_run_id); query class defined deterministically (normalized-token SHA-256 prefix); suppression keyed (target, query_class) as a decaying score penalty, never a hard filter.
• Serve-time attribution: served_by_profile_id on recall responses completes ADR-032's declared event surface; ships as a separate impl PR gated on latency measurement (perf: embedding-bearing verbs cost ~2s per op inside the warm daemon (recall/search); non-embedding verbs are at the 20-50ms floor #394).
• Emission: existing brain.auto_feedback DSL batches (correctness lives at the fold, not the surface); brain.feedback_batch carried as an option behind an adoption rule.
• perf: embedding-bearing verbs cost ~2s per op inside the warm daemon (recall/search); non-embedding verbs are at the 20-50ms floor #394 instrumentation rider: arrival-overlap logging, per-recall wall-clock, daemon queue depth at query start.

Evidence

Hook scorer v0 dry run (2026-07-02): 14 serves across 7 sessions returned the same two junk-tier memories on the same static query, all graded ignored — the exact signal shape this ADR trains away. Co-designed with lambda:leo.

Review history

Codex round 1: REQUEST CHANGES, 6 Major — invariant math unproven across windows, weight constant assigned to the wrong owner, ADR-035 misidentified as stale (it correctly governs the three-tier feedback resolution; the round-1 claim was the error), query class undefined, ledger schema missing attribution, emission surface non-atomicity. All six resolved in round 2 (cb6f4089).

Codex round 2: REQUEST CHANGES, 4 Major — the adopted brain.auto_feedback surface could not carry scorer provenance (deny_unknown_fields), the dedup key was coarser than the serve rows it protects, the fold accounting key had no defined ledger profile column, and the race-free claim rested on the still-Proposed ADR-067 write lane. All four resolved in round 3 (33e6e7c9): explicit additive parameter-surface amendment (scorer_run_id + serve_ledger_id, together-or-rejected), dedup by (scorer_run_id, serve_ledger_id), normative accounting_profile_id coalesce rule with a zero-weight fail-safe, and a BEGIN IMMEDIATE transaction relying only on SQLite single-writer semantics.

Codex round 3: APPROVE, zero findings.

Test plan

• Docs-only change; deno fmt clean; pre-commit hooks passed
• CI green (Docs job)

🤖 Generated with Claude Code