…LOW + 2 CodeRabbit minor)

Adversarial R1 + CodeRabbit:

- HIGH (adv): where_document={'$contains': 'foo'} crashed _translate_where
  (top-level $op rejected) making the keyword-boost path unreachable.
  Fix: _normalize_where_document rewrites top-level {$contains: s} to
  {content: {$contains: s}} before translation; _extract_keyword_text
  still reads the original dict first so keyword_text is preserved.

- MED (adv): dikw_stage silently dropped on INSERT — listed in
  _COLUMN_META_KEYS but missing from the INSERT column list. Fix: added
  dikw_stage between source_id and entity in both base INSERT and
  ON CONFLICT DO UPDATE SET.

- MED (adv): _connect leaked a Postgres connection when register_vector
  raised (e.g. vector extension missing). Fix: try/except closes conn
  on any BaseException before re-raising.

- LOW (adv + CodeRabbit MemPalace#173): $and + $or at the same node level, or a
  logical op mixed with field keys, silently dropped one branch. Fix:
  _translate_where.emit rejects both ambiguous shapes up front with
  UnsupportedFilterError.

- LOW (adv): n_results unvalidated. Fix: positive-int guard at top of
  query() raising ValueError.

- MINOR (CodeRabbit MemPalace#54): RECENCY_HALF_LIFE_SECONDS was a misnomer —
  EXP(-Δt/T) is a 1/e time constant, not a half-life. Fix: renamed
  constant to RECENCY_DECAY_SECONDS and updated the one SQL reference;
  comment clarifies the formula shape. Behaviour unchanged.

- MINOR (CodeRabbit MemPalace#124): $contains ILIKE pattern f'%{arg}%' leaked %
  and _ wildcards from user input (e.g. 'foo_bar' or '50%' acted as
  wildcards). Fix: _escape_like helper escapes |, %, _ with | as the
  escape char, paired with ESCAPE '|' in the SQL. Substring-only
  semantics restored.

Simplify R1 2 LOW cosmetic findings remain accepted-non-blocking per
R1 justification (see code_review round_results).

File now 686 LOC (624 → 686, +62 for the 7 fixes). Under 750 cap.

Refs: specs/IMPL-AO-S301-T03-BACKENDS-NEXUS-001.yaml v0.2.0,
SPEC-KIRA-MEMPALACE-ADOPTION-001, SPEC-AGENT-BOOT-WAKE-UP-001.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>