feat(observations)!: dated events never collapse across dates (D106) - #360

Independent review — Codex (gpt-5.6-sol, reasoning xhigh, review-only run against commit 02c9696)

Antigravity could not run: its CLI returned Individual quota reached … Resets in 98h (empty output). The second independent review is therefore missing for quota reasons, not skipped.

Scope: origin/main...HEAD; line numbers refer to committed HEAD. A prompt-only uncommitted edit appeared during review and was excluded.

1. major — decisions.md D106, lines 4899–4914; plan/designs/observations_design.md §3, lines 146–163; src/rememberstack/spine/observation_adjudication.py, lines 473–494. Disjoint event windows do not prove that two statements describe different event instances. Two sources can disagree about the date of one uniquely identified event—e.g. “Nate won the 2025 Valorant final on Friday” versus “…on Saturday”—or report a rescheduled named meeting. D106 states that disjoint events “never interact,” so the implementation skips evidence, supersession, and contradiction before inspecting event identity. That can double-count one event and suppress a required contradiction group. D43’s no-cap rule justifies refusing an unsafe overwrite; it does not justify declaring the claims unrelated. Suggested fix: revise D106 so disjointness forbids evidence-collapse by itself but does not rule out same-instance contradiction/correction. Without a deterministic event-instance identifier, semantically similar disjoint pairs must reach the date-aware adjudicator; alternatively add a reliable instance key before retaining the zero-call shortcut.

2. major — src/rememberstack/spine/observation_adjudication.py, lines 314–344. The exact-statement shortcut still collapses mixed-dating pairs, directly violating D106. Its only temporal condition is not _disjoint_dated_events(...); that function returns false when exactly one side is dated, so byte-identical dated/undated testimony immediately receives _evidence() without reaching the mixed-dating coercion at lines 495–517. For example, one anchored and one unanchored extraction of “Alice resigned yesterday” become one observation, although D106 requires the unanchored re-mention to coexist. The new mixed tests use different strings and therefore miss this. Suggested fix: make exact evidence conditional on temporal compatibility: both undated, or both dated with overlapping windows. Route mixed exact matches through the ladder/coercion path, or deterministically insert a duplicate if supersede/contradict is not meaningful.

3. major — src/rememberstack/spine/observation_adjudication.py, lines 1144–1168 and 1288–1300; D41 schema contract in plan/designs/postgres_schema_design.md §8, lines 1510–1530. Open-ended D41 event windows are collapsed to a point. _timing_from_row() and _candidate_timing() replace claim_valid_until IS NULL with event_from, while _BLOCK_ENTITY uses max(coalesce(claim_valid_until, claim_valid_from)). D41 explicitly defines precision open as a non-null start with a null, unbounded upper endpoint. Consequently [2026-01-01, ∞) is treated as [2026-01-01, 2026-01-01] and incorrectly considered disjoint from a February event. Suggested fix: retain None as positive infinity; make _windows_disjoint() compare an upper endpoint only when it is non-null; render it as “from … onward”; and aggregate event_until as null whenever any supporting current event claim is open, otherwise use max(claim_valid_until). Add single-claim and mixed bounded/open aggregate tests.

4. major — src/rememberstack/spine/observation_adjudication.py, lines 518–545, 698–703, 746–752, and 1096–1117; src/tests/spine/test_observation_adjudication.py, lines 771–1001. The front-loaded in-transaction candidate list does not remain temporally equivalent to the database block. Forward supersede and contradiction call _remember_candidate() without timing, making newly inserted dated observations appear undated to later assertions. Exact/model evidence-collapse also adds a supporting event claim without widening the candidate’s in-memory event_from/event_until. A reproducible chain is [Jan 1–10], an identical overlapping re-mention [Jan 10–20], then [Jan 20]: the persisted aggregate spans through Jan 20, but the stale candidate still ends Jan 10 and the third claim is incorrectly split. All seven D106 tests call _add()/add_observation() separately, reloading the database block each time, so none exercises this production batch behavior or the D90 re-split list. Suggested fix: centralize candidate insertion/update, always pass timing, and merge newly accepted evidence windows into the candidate. Add one-call add_observations() and flush_entity_global_staging() tests covering overlapping chains, supersede, contradiction, and dated D90 re-splitting.

5. major — src/rememberstack/workers/e3.py, lines 597–606 and 651–665; src/rememberstack/spine/work_ledger.py, lines 1391–1403, 447–464, and 1814–1828; decisions.md D106 Consequences, lines 4941–4949. The flush-version roll is unsafe when old entity-unit work remains pending. claim_one() selects any component generation; the handler accepts every entity-targeted observation job, but reports the new constant in EntityObsFlushBarrier. Completion marks the actually claimed old-version row succeeded and then counts succeeded rows at the new version, so the barrier never completes and downstream supersession/embed work can remain unopened. Fully completed old stores also report the new expected component as missing until rebuilt, while existing membership/state is keyed by normalizer version and prevents ordinary re-fan-out. The decision only says stores re-adjudicate “on rebuild” and omits this drain/readiness/staging contract. Suggested fix: define and test a stop-drain-rebuild rollout. The handler should fail closed before consuming staging when work.component_version != OBS_FLUSH_VERSION, and the rebuild procedure must explicitly reconstruct or clear staging, membership, version state, and readiness rows before enqueuing the new generation.

6. minor — src/rememberstack/spine/observation_adjudication.py, lines 483–517 and 755–769. The required temporal-coercion audit is conditional and sometimes mislabeled. temporal_skips is persisted only when no candidate interacts; if a mixed pair’s evidence is coerced and a later candidate supersedes, contradicts, or absorbs the claim, the coercion disappears from the adjudication transcript. When every candidate is deterministically skipped with zero verdict calls, the inserted row is nevertheless recorded with method="small_model". Suggested fix: attach accumulated temporal decisions to every terminal record and use a truthful temporal_gate method when no model ran. Add a multi-candidate test where coercion precedes a later interaction.

7. minor — src/rememberstack/spine/observation_adjudication.py, prompt lines 75–82; decisions.md lines 4912–4914. The prompt says events with “DIFFERENT resolved event dates” are always new and that only the “same resolved date” can be evidence. The binding rule is narrower: only disjoint windows are deterministic; overlapping windows—including a coarse year/month claim and a more precise day claim—must be adjudicated as before. This wording biases the model toward duplicates on compatible overlapping windows. Suggested fix: say “disjoint/non-overlapping resolved event windows” and explicitly allow differently precise overlapping windows to be evidence when the statements identify the same occurrence.

8. minor — src/tests/spine/test_observation_adjudication.py, lines 771–1001. Important contract branches remain uncovered: mixed dating with identical text, open-ended windows, overlapping multi-day windows, a mixed pair returning supersede or contradict, dated evidence through D90 re-splitting, and two same-day statements that must remain distinct or contradict. The current same-event test exercises only the exact shortcut. Suggested fix: add focused tests for those cases, using batch APIs where applicable and asserting caps, contradiction groups, evidence placement, audit features, and model-call counts.

9. nit — decisions.md lines 2913–2915; plan/designs/locomo_benchmark_design.md line 67; src/tests/benchmarks/test_locomo_protocol.py line 242. A few v20 references still present v20 as current: D78’s banner says “The current protocol is … v20,” the design says accepting it does not authorize a paid “v20” run, and the v21 test remains named test_protocol_is_v20.... Suggested fix: add the D106 current amendment above D78’s historical D105 note, change the execution warning to v21 or protocol-neutral wording, and rename the test.

Verified

• Bounded claim windows use correct inclusive closed-interval disjointness: touching endpoints overlap, and PostgreSQL supplies comparable timestamptz values.
• _BLOCK_ENTITY derives bounded spans only from supporting, current-testimony event_time claims; undated support is ignored, withdrawn testimony is excluded, and observations with no current dated support become undated.
• Null claim_valid_kind, missing claim rows, and unresolved event windows degrade safely to undated rather than raising.
• D43’s existing cap safeguards remain intact: supersede requires a non-empty rationale and confidence at or above the margin, and every actual cap receives an adjudication reason row.
• The exact disjoint-date shortcut override is exercised. The fake embeddings for the seven-win corpus all exceed the novelty floor (minimum pair similarity approximately 0.69), so the zero-verdict assertion is due to the temporal rung rather than clear-novelty bypass.
• The active LoCoMo protocol, adapter key/types, benchmark runner, self-host readiness component, OBS_FLUSH_VERSION, README, sharding defaults, and protocol assertions consistently pin Full-v21/new flush generation.
• git diff --check origin/main...HEAD passes. Integration tests were not executed because their fixture downgrades/upgrades and truncates the configured PostgreSQL store, which is outside a mutation-free review.

Merge verdict: request changes; this is not mergeable yet. First resolve the over-broad design assumption that disjoint dates always establish distinct event identity, then fix the mixed exact shortcut, open-ended interval semantics, and in-batch candidate maintenance. The flush-generation rollout must also be made safe and documented before shipping; audit/test/doc corrections should follow those behavioral decisions.

Review triage — dispositions applied in the follow-up commit

Every Codex finding was re-verified against the code before acting. The review changed the design materially (not just wording): the first revision treated disjoint dated events as never interacting; the shipped rule now bounds what a verdict may do and keeps the date-aware model in the loop.

Also folded in since the review ran: the verdict prompt now labels each side's two clocks explicitly (said on: — the source's own date; is about: — the resolved world-time of any D41 kind, not only events) and defines both, per the operator's reading of the earlier EXISTING TIME: lines.

Codex's verdict was "request changes"; all five majors are addressed by behavior changes with tests, not wording. Full suite, ruff, and pyright are green on the follow-up commit.

Validation state at merge

• CI on 7697011f: all twelve checks pass (Unit, Quality, Contract smoke, Integration adapters/surfaces/workers, build, CLA, PR gate); merge state CLEAN.
• The Integration (adapters) failure on the previous commit was the operational-scale battery matching literal SQL prefixes that D106 changed (the block and claim-timing statements still run exactly once per batch); fingerprints updated in 7697011f.
• Local full database suite on the CI PostgreSQL image: 2,185 passed. test_client_sdk::test_sdk_pushes_lineage_metadata_to_e0 fails identically on unmodified main in this environment (MIME detection). Six test_query_space_batch_a proofs failed once in a full local run but pass alone and in sequence with the adjudication module on this branch; two attempts at a full reproduction with captured tracebacks were cut short by the local environment. Residual: if nightly CI reproduces them on main, treat it as a D106 test-ordering interaction and follow up on this decision.