Track: deploy + backfill + drift-watch for KG risk-layer fix (follow-up to #231)

[Number531]

Follow-up tracking for the KG risk-layer fix merged in #232 (commit 1c70dcc6, closes #231). The code fix is on main; these items ensure it actually takes effect and that the defect class is guarded going forward.

1. Deploy (required for future sessions to benefit)

• Deploy main (incl. fix(kg): restore risk node layer — persist risk-summary.json + parse exposure_by_category (#231) #232) to staging + prod. The fix is not retroactive — until deployed, new sessions still drop the risk layer. The changed live path is src/utils/hookDBBridge.js (PostToolUse persist gate).
• Live canary (not yet run): one current-format session to completion → assert risk-summary.json is persisted as a report (report_key=risk-summary) and the post-session KG has >0 risk nodes.

2. Remediate already-affected past sessions (0 risk nodes)

These ran before the fix and do not self-heal; re-ingest + rebuild + re-embed:

• 2026-06-08-1780888014
• 2026-05-27-1779903178 (has the report but 0 risk nodes — parser-half only)
• sweep for any others: SELECT session_key FROM sessions s WHERE status='completed' AND NOT EXISTS (SELECT 1 FROM kg_nodes WHERE session_id=s.id AND node_type='risk')
• Procedure: scripts/restore-unpersisted-session.mjs (or backfill) → scripts/rebuild-kg-local.mjs → session-scoped embedding reapply. (Reference: the 2026-06-16 Fox/Roku remediation in KG drops entire risk layer for current-format sessions: risk-summary.json not persisted + Phase 7 parser schema drift #231.)

3. Anti-recurrence (producer↔consumer schema-drift class)

The root cause was the risk-aggregator's output schema drifting from the KG consumer. Guards:

• Contract test test/sdk/kg-phase7-risk-parser.test.js fails loudly on the next risk-aggregator schema change (legacy + current schema pinned).
• Confirm CI runs it. The KG tests are node --test style, but npm run test:sdk invokes jest — verify these files actually execute in CI (or port to jest), else the contract anchor is inert in CI.
• Generalize: any other structured JSON deliverable the KG/synthesis consumes should be added to JSON_REPORT_FILENAMES (src/config/hookDBBridgeConfig.js) rather than left .md-only.

4. Housekeeping

• Remove the local recovery worktree once unneeded: git worktree remove /Users/ej/Super-Legal-231 (+ delete branch fix/231-kg-risk-wt, ref wip/231-kg-risk-recovery).