6 real bugs fixed + fake-green test corrected + stale claim removed (production hardening round 4)

[SuperInstance]

First-pass hardening (goose), independently re-verified by me on a fresh clone (fresh install, 54/54 tests pass; reverted the reflex_check fix locally and confirmed the new test genuinely fails on pre-fix code — mean of 29.0 instead of the real 20.125 baseline, exactly as claimed).

Note on prior research: an earlier deep-dive on this repo (2026-07-03) found a fabricated 'S3-compatible storage' claim and a test suite that had never actually run due to CI masking. Both were independently re-verified as already fixed before this dispatch — this repo had a 'Tier 2 → Tier 1: fix CI, license, packaging' commit since that research (ba8414e). Goose correctly identified this rather than wastefully re-fixing already-solved problems, and instead documented the residual truth honestly (see below) and moved on to find 6 new, real issues.

docs — false S3 claim, honest status table: the README/AGENT.md tagline still claimed 'S3-compatible memory' with zero backing code anywhere in the repo (confirmed via grep — no boto/minio/amazonaws references exist). Corrected, and added an honest per-component status table.

fix(config) — retention days parsed as string, not float: CortexConfig.load() used .rstrip("d") on the raw TOML value, silently storing "30" (str) instead of 30.0 (float) despite the field's type annotation. Added _parse_duration_days() handling numeric and unit-suffixed values correctly.

fix(compute) — reflex anomaly reported the wrong mean: reflex_check() updated its running mean/variance with the anomalous reading before reporting the mean the z-score was actually computed against — so an anomaly report showed a contaminated mean (~29.0) instead of the real baseline (~20.1). Confirmed via independent revert-test: 8.875 off from the real baseline on old code.

fix(memory) — duplicate samples from get_random_memories: every hot-tier entry is also mirrored in warm-tier, so concatenating tiers without dedup returned the same memory twice for a single stored entry. Fixed in both the in-memory backend and the SurrealDB fallback.

test(bus) — fake-green test_bus_backpressure: the test published 10 events to a size-5 queue but never checked publish()'s return value, so it passed regardless of whether backpressure actually worked. Rewritten to assert the first 5 succeed and the overflow 5 are shed.

fix(bus) — should_render dead code contradicting its own docstring: the method's comment claimed it 'always renders the last one (summary)' but every branch past the threshold returned False — the promised behavior never happened (and the method wasn't even wired into the dispatch loop, documented honestly as opt-in/unused rather than hidden).

Verification (independently redone by me): fresh clone, fresh pip install -e ".[dev]", full suite: 54/54 pass. Reverted the reflex-mean fix specifically and reran its regression test — genuinely fails with the exact contaminated value described, confirming it's a real guard.

Operational note: goose made all 7 of these commits locally but never actually ran git push — I found and pushed them directly after independently confirming they existed and were sound. Worth watching for in future non-interactive dispatches.

[SuperInstance]

Update — Fix 7 landed (5f20ae2, independently verified by me on a fresh clone): ruff lint cleanup (40 → 0 errors: unused imports, unused vars, ambiguous l variable names, an empty f-string) plus a real ruff check . gate added to CI (which previously only ran pytest, so lint issues were invisible). Final state: 54/54 tests pass, ruff check . clean.