fix(temporal): review findings — pure-read temporal recall + hardened valid-period writes (#363)

Finding 1 (#356-class value inversion): handle_recall applied the valid-time
filter AFTER db.recall(), whose fts5 path (and dense/hybrid with reinforce)
reinforces every matched row — so `recall {query, valid_at:T}` bumped
retrieval_count/decay/layer on entities the filter then hid, making invisible
entities immortal under repeated temporal queries. The inner recall is now
forced to a pure read whenever a valid-time filter is present, and the
deferred side-effects are applied to the SURVIVING hits only (fts5 always,
dense/hybrid only with reinforce:true), mirroring the expansion path.
Unfiltered calls keep the original behavior byte-for-byte.

Finding 2 (inverted/extended valid periods):
- mimir_correct now rejects valid_to <= valid_from (same error shape as
  remember) — an inverted period would shadow older versions in bitemporal_at
  while never matching itself, making the fact unanswerable.
- mimir_supersede validates an explicit valid_to against the old fact's
  stored period BEFORE any mutation: rejects valid_to <= valid_from and
  rejects extending an already-closed period (tighten-only).
- db.set_valid_to is now conservative by construction: errors on inversion,
  never extends an already-bounded valid_to (keeps the earlier close and
  reports it), allows tightening. The default supersede close is bumped
  strictly past valid_from so a same-millisecond supersede stays coherent.

Review nits: valid_op is validated against the closed enum (unknown strings
rejected instead of silently meaning overlaps); the misplaced entity_from_row
doc comment is restored (it had attached to TemporalVersion).

Tests: 203 -> 208 — hidden-entity non-reinforcement, unfiltered-recall
behavior identity (side-effects + result set), unknown valid_op rejection,
inverted-period rejection on correct, and the full supersede matrix
(invert-reject pre-mutation, extend-reject, default keeps earlier close,
tighten allowed). Temporal gate still 100% (20/20, identical signature).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: tcconnally

src/db.rs

@@ -3482,13 +3482,46 @@ impl Database {
     /// stopped being true in the world. Used by mimir_supersede — superseding
     /// a fact ends its validity (at transaction time unless the caller says
     /// when). Does not touch the transaction axis.
-    pub fn set_valid_to(&self, id: &str, valid_to: i64) -> Result<(), Box<dyn std::error::Error>> {
+    ///
+    /// Conservative by construction (#363 review):
+    ///   * Refuses `valid_to <= valid_from` — an inverted period would shadow
+    ///     older versions in `bitemporal_at` while never matching itself,
+    ///     making the fact unanswerable.
+    ///   * Never EXTENDS an already-bounded valid_to — a fact that already
+    ///     ended stays ended (a default-now supersede must not retroactively
+    ///     revive it). Tightening (an earlier close) is allowed; when the
+    ///     stored close is already at-or-before the requested one, it is kept.
+    ///
+    /// Returns the EFFECTIVE close instant (the requested one, or the earlier
+    /// stored close that was kept).
+    pub fn set_valid_to(&self, id: &str, valid_to: i64) -> Result<i64, Box<dyn std::error::Error>> {
         let conn = self.conn()?;
+        let (eff_from, cur_to): (i64, Option<i64>) = conn.query_row(
+            "SELECT COALESCE(valid_from_unix_ms, recorded_at_unix_ms, created_at_unix_ms), \
+                    valid_to_unix_ms \
+             FROM entities WHERE id = ?1",
+            params![id],
+            |r| Ok((r.get(0)?, r.get(1)?)),
+        )?;
+        if valid_to <= eff_from {
+            return Err(format!(
+                "valid_to ({valid_to}) must be greater than the fact's valid_from ({eff_from}) — \
+                 refusing to invert the valid period"
+            )
+            .into());
+        }
+        if let Some(cur) = cur_to {
+            if cur <= valid_to {
+                // Already closed at or before the requested instant: keep the
+                // earlier close (never extend validity).
+                return Ok(cur);
+            }
+        }
         conn.execute(
             "UPDATE entities SET valid_to_unix_ms = ?1 WHERE id = ?2",
             params![valid_to, id],
         )?;
-        Ok(())
+        Ok(valid_to)
     }
 
     /// Find entities with identical (category, key) and merge/archive duplicates, keeping the newest.
@@ -6827,7 +6860,6 @@ pub(crate) fn sanitize_prompt_field(s: &str) -> String {
     s.replace('<', "&lt;").replace('>', "&gt;")
 }
 
-/// Extract an Entity from a SQLite row, decrypting body_json if encryption is enabled.
 /// One version of a fact with its bi-temporal coordinates (#363): the entity
 /// content plus its application-time (valid_from/valid_to) and transaction-time
 /// (recorded_at/invalidated_at) periods. Returned by `valid_at`/`bitemporal_at`
@@ -6886,6 +6918,7 @@ pub fn valid_period_contains_instant(row_from: i64, row_to: Option<i64>, t: i64)
     row_from <= t && row_to.map_or(true, |rt| t < rt)
 }
 
+/// Extract an Entity from a SQLite row, decrypting body_json if encryption is enabled.
 fn entity_from_row(
     row: &rusqlite::Row,
     encryption: Option<&EncryptionManager>,

src/mcp.rs

@@ -3119,7 +3119,7 @@ fn list_tools(id: Option<Value>) -> JsonRpcResponse {
         },
         "valid_to_unix_ms": {
           "type": "integer",
-          "description": "When the OLD fact stopped being true in the world (#363, unix ms). Defaults to transaction time (now). Closes the old entity's application-time period so mimir_valid_at stops returning it from that instant on."
+          "description": "When the OLD fact stopped being true in the world (#363, unix ms). Defaults to transaction time (now). Closes the old entity's application-time period so mimir_valid_at stops returning it from that instant on. Must be after the fact's valid_from, and may only TIGHTEN an already-closed period (a fact that ended cannot be retroactively extended); violations are rejected before any mutation."
         }
       },
       "required": [