memory: snapshot — sec rebuilt on DFlash2 + newer vLLM; quant tokenizer defect fixed fleet-wide

Rewrites the in-flight section (140 lines to 18) now that the AI-seat work
has settled, promoting the durable calls into the dated decision log where
they will not decay: DFlash2 measured and promoted to sec's compose stack,
the calibration-truncation defect fixed at source in the quant pipeline,
sec retuned after a runtime OOM, the Max-Q spread disproved by telemetry,
ESH dual-stack with the Cityside static proven unprovisioned, and speaches
live with the weak-gate finding.

Carries forward the two things a fresh session must not get wrong: the sec
degeneration question is confounded because engine and drafter changed
together, and neither the 2k nor the 10k observation is evidence.

Auto-archived one entry (Recent decisions: 1) to archival-memory.md.
Eight further candidates were held back by the guards -- open deferred work
or referenced by in-flight state.

archival-memory.md

@@ -4,6 +4,9 @@ _Entries moved out of persistent-memory.md to keep the active file scannable. Re
 
 ## Recent decisions (archived)
 
+- `[2026-08-07]` **Personal-Worldtree kb-contamination incident (WT #394) diagnosed; attribution CLOSED UNRESOLVED.** A reconcile `WingStore._embed` full-tree walk (kb `fs_root=KB_PATH` root, sibling wings nested) swept 5,354 fiction+main rows into personal's `knowledge_base` (2 superseded generations served as current). Fixed by WT #394 (aca39a1, kb walks exclude sibling wings; ships b182). Trigger un-attributable — peer reconcile via the SHARED infra-ops identity + 0 dockerd exec-logging = fingerprint-less. Durable finding → auto-memory `infra_ops_shared_identity_attribution_gap`, PARKED (operator ruled A) into [[project_migrate_infra_access_to_claude_credentials]]. Evidence hold on the 5,354 rows until operator sequences cleanup (w/ Brokkr, on #394's agenda).
+  _Archived 2026-08-22._
+
 - `[2026-05-12]` corviduo-dev (Worldtree-team dev VM, 10.250.50.152,
   CT 106 on pfi-pve) added to `servers/` inventory. Treat like SF
   client hosts: PFI hosts + provides emergency-ops backstop;