Security:
- Filter tool arguments against input_schema before dispatch (prevents
  arbitrary kwargs injection via **tool_args unpacking)
- Add length validation to all string parameters (content, query, wing,
  room, agent_name, entity, subject, predicate, object)
- Clamp integer parameters (limit, last_n) to [1, 100]

Constants:
- MAX_CONTENT_LENGTH = 50,000 chars
- MAX_QUERY_LENGTH = 2,000 chars
- MAX_FIELD_LENGTH = 200 chars
- MAX_RESULTS_LIMIT = 100

Includes test infrastructure from PR MemPalace#131 (uv migration + expanded tests).
New validation tests: extra kwargs filtering, oversized input rejection, limit clamping.

96 tests pass.

… call

The MCP server previously created a new PersistentClient on every tool
call via _get_collection(). This incurs HNSW index loading overhead
on each request.

Cache the client and collection at module level. The cache resets
naturally on process restart (MCP runs as a subprocess).

Also adds a _reset_mcp_cache fixture to conftest.py for test isolation.

Includes test infrastructure from PR MemPalace#131.
92 tests pass.

- Enable WAL journal mode in _conn() for better concurrent read
  performance and reduced SQLITE_BUSY risk
- Add LIMIT 100 to entity-filtered timeline query (was unbounded,
  while global timeline already had LIMIT 100)

Findings: MemPalace#8 (HIGH — no WAL mode), MemPalace#22 (LOW — inconsistent limits)

Includes test infrastructure from PR MemPalace#131.
92 tests pass.

Prevents OOM when the palace grows large. The following unbounded
metadata fetches now have a safety cap:

- tool_status: col.get(include=['metadatas'], limit=10000)
- tool_list_wings: same
- tool_list_rooms: same (including wing-filtered variant)
- tool_get_taxonomy: same
- Layer1.generate: col.get(include=['documents','metadatas'], limit=10000)

Layer2 already had a limit parameter — no change needed.

Finding: MemPalace#3 (CRITICAL — unbounded data fetching causes OOM)

Includes test infrastructure from PR MemPalace#131.
92 tests pass.

- Remove palace_path from _no_palace() error response (prevents
  leaking filesystem paths to the LLM)
- Replace str(e) with generic 'Internal tool error' in MCP dispatch
  catch block (full error is still logged server-side via stderr)
- Replace sys.exit(1) with return in searcher.search() CLI function
  (prevents process termination if called from library context)
- Remove unused sys import from searcher.py

Findings: MemPalace#12 (HIGH), MemPalace#5 (MEDIUM), MemPalace#15 (LOW)

Includes test infrastructure from PR MemPalace#131.
92 tests pass.

MCP tool_add_drawer:
- Make drawer_id content-based: hash full content instead of
  content[:100] + timestamp. Same content → same ID, eliminating
  TOCTOU race conditions
- Switch from col.add() to col.upsert() so re-filing with updated
  content updates the existing drawer

miner.add_drawer:
- Switch from collection.add() to collection.upsert() so re-mining
  a modified file updates instead of silently failing
- Remove the try/except catching 'already exists' — upsert handles
  this naturally

Findings: MemPalace#11 (HIGH — add ignores updates), MemPalace#6 (MEDIUM — TOCTOU),
          MemPalace#13 (MEDIUM — non-deterministic IDs)

Includes test infrastructure from PR MemPalace#131.
92 tests pass.

The save hook uses SESSION_ID in file paths (state_dir/).
A crafted session_id value like '../../etc/cron.d/evil' could write
state files outside the intended directory.

Strip everything except [a-zA-Z0-9_-] from SESSION_ID, defaulting
to 'unknown' if empty after sanitization.

Finding: MemPalace#4 (HIGH — path traversal via SESSION_ID)

Includes test infrastructure from PR MemPalace#131.
92 tests pass.

- Tighten chromadb dependency from >=0.4.0,<1 to >=0.5.0,<0.7
  (the collection API changed significantly across majors; this
  pins to the tested range)
- Add optional 'spellcheck' extras for the undeclared autocorrect
  dependency used in spellcheck.py
- Add PEP 561 py.typed marker for type checker support

Findings: MemPalace#10 (HIGH — chromadb range too wide), MemPalace#30 (LOW — undeclared
          autocorrect), MemPalace#32 (LOW — missing py.typed)

Includes test infrastructure from PR MemPalace#131.
92 tests pass.

PR MemPalace#147 renamed compression_stats fields (ratio -> size_ratio,
compressed_chars -> summary_chars) and switched count_tokens to a
word-based heuristic, but the test_dialect tests from PR MemPalace#131 still
assert the old API and fail on main.

Bring TestCompressionStats.test_stats in line with the current dict
keys (size_ratio, summary_chars, summary_tokens_est) and update
test_count_tokens to match the word-based formula, with extra
coverage for the empty and single-word edge cases around max(1, ...).

This unblocks CI on main, which currently fails on these two tests.

… call

The MCP server previously created a new PersistentClient on every tool
call via _get_collection(). This incurs HNSW index loading overhead
on each request.

Cache the client and collection at module level. The cache resets
naturally on process restart (MCP runs as a subprocess).

Also adds a _reset_mcp_cache fixture to conftest.py for test isolation.

Includes test infrastructure from PR MemPalace#131.
92 tests pass.

Prevents OOM when the palace grows large. The following unbounded
metadata fetches now have a safety cap:

- tool_status: col.get(include=['metadatas'], limit=10000)
- tool_list_wings: same
- tool_list_rooms: same (including wing-filtered variant)
- tool_get_taxonomy: same
- Layer1.generate: col.get(include=['documents','metadatas'], limit=10000)

Layer2 already had a limit parameter — no change needed.

Finding: MemPalace#3 (CRITICAL — unbounded data fetching causes OOM)

Includes test infrastructure from PR MemPalace#131.
92 tests pass.

- Remove palace_path from _no_palace() error response (prevents
  leaking filesystem paths to the LLM)
- Replace str(e) with generic 'Internal tool error' in MCP dispatch
  catch block (full error is still logged server-side via stderr)
- Replace sys.exit(1) with return in searcher.search() CLI function
  (prevents process termination if called from library context)
- Remove unused sys import from searcher.py

Findings: MemPalace#12 (HIGH), MemPalace#5 (MEDIUM), MemPalace#15 (LOW)

Includes test infrastructure from PR MemPalace#131.
92 tests pass.

MCP tool_add_drawer:
- Make drawer_id content-based: hash full content instead of
  content[:100] + timestamp. Same content → same ID, eliminating
  TOCTOU race conditions
- Switch from col.add() to col.upsert() so re-filing with updated
  content updates the existing drawer

miner.add_drawer:
- Switch from collection.add() to collection.upsert() so re-mining
  a modified file updates instead of silently failing
- Remove the try/except catching 'already exists' — upsert handles
  this naturally

Findings: MemPalace#11 (HIGH — add ignores updates), MemPalace#6 (MEDIUM — TOCTOU),
          MemPalace#13 (MEDIUM — non-deterministic IDs)

Includes test infrastructure from PR MemPalace#131.
92 tests pass.

- Enable WAL journal mode in _conn() for better concurrent read
  performance and reduced SQLITE_BUSY risk
- Add LIMIT 100 to entity-filtered timeline query (was unbounded,
  while global timeline already had LIMIT 100)

Findings: MemPalace#8 (HIGH — no WAL mode), MemPalace#22 (LOW — inconsistent limits)

Includes test infrastructure from PR MemPalace#131.
92 tests pass.

- Tighten chromadb dependency from >=0.4.0,<1 to >=0.5.0,<0.7
  (the collection API changed significantly across majors; this
  pins to the tested range)
- Add optional 'spellcheck' extras for the undeclared autocorrect
  dependency used in spellcheck.py
- Add PEP 561 py.typed marker for type checker support

Findings: MemPalace#10 (HIGH — chromadb range too wide), MemPalace#30 (LOW — undeclared
          autocorrect), MemPalace#32 (LOW — missing py.typed)

Includes test infrastructure from PR MemPalace#131.
92 tests pass.

The save hook uses SESSION_ID in file paths (state_dir/).
A crafted session_id value like '../../etc/cron.d/evil' could write
state files outside the intended directory.

Strip everything except [a-zA-Z0-9_-] from SESSION_ID, defaulting
to 'unknown' if empty after sanitization.

Finding: MemPalace#4 (HIGH — path traversal via SESSION_ID)

Includes test infrastructure from PR MemPalace#131.
92 tests pass.

… call

The MCP server previously created a new PersistentClient on every tool
call via _get_collection(). This incurs HNSW index loading overhead
on each request.

Cache the client and collection at module level. The cache resets
naturally on process restart (MCP runs as a subprocess).

Also adds a _reset_mcp_cache fixture to conftest.py for test isolation.

Includes test infrastructure from PR MemPalace#131.
92 tests pass.

MCP tool_add_drawer:
- Make drawer_id content-based: hash full content instead of
  content[:100] + timestamp. Same content → same ID, eliminating
  TOCTOU race conditions
- Switch from col.add() to col.upsert() so re-filing with updated
  content updates the existing drawer

miner.add_drawer:
- Switch from collection.add() to collection.upsert() so re-mining
  a modified file updates instead of silently failing
- Remove the try/except catching 'already exists' — upsert handles
  this naturally

Findings: MemPalace#11 (HIGH — add ignores updates), MemPalace#6 (MEDIUM — TOCTOU),
          MemPalace#13 (MEDIUM — non-deterministic IDs)

Includes test infrastructure from PR MemPalace#131.
92 tests pass.

… call

The MCP server previously created a new PersistentClient on every tool
call via _get_collection(). This incurs HNSW index loading overhead
on each request.

Cache the client and collection at module level. The cache resets
naturally on process restart (MCP runs as a subprocess).

Also adds a _reset_mcp_cache fixture to conftest.py for test isolation.

Includes test infrastructure from PR MemPalace#131.
92 tests pass.

MCP tool_add_drawer:
- Make drawer_id content-based: hash full content instead of
  content[:100] + timestamp. Same content → same ID, eliminating
  TOCTOU race conditions
- Switch from col.add() to col.upsert() so re-filing with updated
  content updates the existing drawer

miner.add_drawer:
- Switch from collection.add() to collection.upsert() so re-mining
  a modified file updates instead of silently failing
- Remove the try/except catching 'already exists' — upsert handles
  this naturally

Findings: MemPalace#11 (HIGH — add ignores updates), MemPalace#6 (MEDIUM — TOCTOU),
          MemPalace#13 (MEDIUM — non-deterministic IDs)

Includes test infrastructure from PR MemPalace#131.
92 tests pass.

MCP tool_add_drawer:
- Make drawer_id content-based: hash full content instead of
  content[:100] + timestamp. Same content → same ID, eliminating
  TOCTOU race conditions
- Switch from col.add() to col.upsert() so re-filing with updated
  content updates the existing drawer

miner.add_drawer:
- Switch from collection.add() to collection.upsert() so re-mining
  a modified file updates instead of silently failing
- Remove the try/except catching 'already exists' — upsert handles
  this naturally

Findings: MemPalace#11 (HIGH — add ignores updates), MemPalace#6 (MEDIUM — TOCTOU),
          MemPalace#13 (MEDIUM — non-deterministic IDs)

Includes test infrastructure from PR MemPalace#131.
92 tests pass.