…D env

Provides FastAPI lifespan startup/shutdown for the Qdrant adapter, analogous
to MilvusLifespanProvider but no-op unless VECTOR_STORE_BACKEND=qdrant. So
the Milvus backend stays the default at runtime until cutover.

On startup (when active):
- Resolves the 'qdrant_client_factory' DI bean.
- Collects all concrete QdrantCollectionBase subclasses via get_all_subclasses.
- Groups them by _DB_USING and ensures the client per group, then runs
  ensure_all() on each collection (currently a stub no-op; will create
  collections + payload indexes in Phase 1.2).

On shutdown: closes all cached Qdrant clients. Cleans the same app.state
attributes pattern as the milvus provider.

Order=19 sits between milvus_lifespan (18) and business_lifespan (20),
so during cutover both backends can briefly coexist.

Generic[QdrantCollectionType] ABC with an abstract @classmethod from_mongo()
that subclasses implement to convert Mongo source docs into Qdrant point
payloads (PointStruct or compatible dicts).

get_qdrant_model() introspects the Generic argument from __orig_bases__ so
the bound collection class can be retrieved at runtime — same pattern as
the Milvus base converter, which the search-repository layer relies on.

…query_points()

Replaces the Phase 1.1 stub with a full collection-management base class:

- IndexConfig as @DataClass: size, distance, on_disk, hnsw_m,
  hnsw_ef_construct, payload_indexes (dict field_name -> schema_type).
  to_vectors_config() builds the qdrant_client VectorParams + HnswConfigDiff.
- Module-level _DISTANCE_MAP and _PAYLOAD_SCHEMA_TYPE_MAP translate string
  configs to SDK enums — subclasses stay decoupled from the SDK.
- QdrantCollectionBase methods: client() (lazy DI lookup), exists(),
  count(), ensure_collection() (idempotent), ensure_payload_indexes()
  (idempotent), ensure_all(), upsert(), search() (qdrant-client
  query_points wrapper), delete(), drop().
- Compared to MilvusCollectionBase this is ~half the LOC because Qdrant
  has no alias mechanism — collection names are direct.

CRITICAL fix in the same commit: qdrant-client 1.16.1 (the version
resolved against our >=1.12,<2 pin) removed the legacy
QdrantClient.search method; only query_points is available now. The
search() wrapper here calls query_points(query=..., ...) and unwraps
QueryResponse.points so call sites still get List[ScoredPoint].

uv.lock is regenerated to include qdrant-client (1.16.1) and its
transitive deps (h2, hpack, hyperframe, portalocker).

…t naming

Adds the multi-tenancy adapter for Qdrant. Deliberately schlanker than the
Milvus counterpart (~270 LOC total vs ~750 LOC for milvus' tenant layer)
because Qdrant has no alias mechanism and no partition_key feature — multi-
tenancy is realized via collection-per-tenant naming alone.

src/core/tenants/tenantize/oxm/qdrant/config_utils.py:
- get_tenant_aware_collection_name(original_name): resolves the final
  Qdrant collection name from the active tenant context. Lookup order is
  storage_info['qdrant'] -> storage_info['milvus'] (migration bridge,
  reuses the same collection_prefix for both backends until per-tenant
  qdrant config is wired) -> base resource prefix fallback.
- get_qdrant_connection_cache_key(config): builds a stable factory cache
  key, hashing api_key fingerprints (8 hex chars) so the raw key never
  appears in the cache identifier.
- _load_qdrant_env(prefix): env-fallback loader for tenant-aware connection
  routing. Currently exported as private until the routing layer consumes
  it; documented to avoid dead-code flags.

src/core/tenants/tenantize/oxm/qdrant/tenant_aware_qdrant_collection_with_suffix.py:
- TenantAwareQdrantCollectionWithSuffix(QdrantCollectionBase): overrides
  the name property to return tenant-prefixed + optional explicit suffix.
  The collection base remains unchanged; concrete Phase-2 collections
  inherit from this class instead of QdrantCollectionBase directly.
- __init__(suffix) accepts explicit override or falls back to the
  SELF_QDRANT_COLLECTION_NS env-var.
- _MULTI_TENANT_STRATEGY ClassVar is informational; a future version may
  opt into Qdrant's native payload-partitioning instead of separate
  collections per tenant.

…ollectionBase

Wraps the sync qdrant-client API via asyncio.to_thread so the repository
surface stays async (parity with the milvus repository layer).

Methods:
- upsert(point) -> str (point id, parity with milvus 'insert' returning entity_id)
- upsert_batch(points) -> UpdateResult (full result, exposes wait-status)
- find_by_id(id) / find_by_ids(ids) -> Optional[Record] / List[Record]
- delete_by_id(id) -> bool; delete_batch(ids) -> UpdateResult
- search(query_vector, limit, query_filter, ...) -> List[ScoredPoint]
- count(exact=True) -> int
- collection: lazy-instantiated QdrantCollectionBase subclass
- get_model_name() -> str

Error-handling semantics mirror the milvus counterpart:
- upsert / upsert_batch / delete_batch / search → log + raise on failure
- find_by_id / find_by_ids / delete_by_id → log + return None / False
  (resilient read path)

Subclasses bind the generic parameter to the concrete collection model
class:

    class EpisodicMemoryRepository(
        BaseQdrantRepository[EpisodicMemoryCollection]
    ):
        def __init__(self):
            super().__init__(EpisodicMemoryCollection)

…+converter

First two of six Qdrant collections matching the Milvus search adapter layout
under src/infra_layer/adapters/out/search/. Subsequent commits add the
remaining four (agent_skill, foresight, atomic_fact, user_profile).

Collections (src/infra_layer/adapters/out/search/qdrant/memory/):
- episodic_memory_collection.py: TenantAwareQdrantCollectionWithSuffix
  subclass, base name v1_episodic_memory. Vector 1024-dim Cosine, HNSW
  m=16 ef_construct=200. Payload indexes: user_id/group_id/session_id/
  parent_id/parent_type/type (keyword) + timestamp (integer, epoch ms).
- agent_case_collection.py: base name v1_agent_case. Same vector params;
  payload indexes minus participants/type, plus timestamp as epoch
  seconds (parity with milvus converter).

Converters (src/infra_layer/adapters/out/search/qdrant/converter/):
- episodic_memory_qdrant_converter.py: BaseQdrantConverter[
  EpisodicMemoryCollection]. from_mongo() builds a PointStruct from a
  MongoDB v1_episodic_memories document. Handles missing optional fields
  (sender_ids, type, subject, summary) and serializes the search_content
  list to JSON for downstream search service consumption.
- agent_case_qdrant_converter.py: BaseQdrantConverter[AgentCaseCollection].
  Maps AgentCaseRecord -> PointStruct, truncates task_intent to 5000 chars
  (Milvus parity), uses epoch-seconds timestamp.

Qdrant is schema-flexible, so unlike the Milvus side there is no field
schema declaration — only the vector params and the explicit payload
indexes (the rest of the payload is whatever the converter writes).

…verter

Adds collections 3 and 4 of six. Same TenantAwareQdrantCollectionWithSuffix
+ BaseQdrantConverter pattern as batch 1.

Collections:
- agent_skill_collection.py: base name v1_agent_skill. Payload indexes for
  user_id/group_id/cluster_id (keyword) + maturity_score/confidence (float)
  for threshold range queries.
- foresight_collection.py: base name v1_foresight_record. Payload indexes
  for user_id/group_id/session_id/parent_id/parent_type/type (keyword) +
  start_time/end_time (integer, epoch ms).

Converters:
- agent_skill_qdrant_converter.py: AgentSkillRecord -> PointStruct. Builds
  the content payload from name + description, truncates to 5000 chars.
  Coerces optional maturity_score / confidence to 0.0 when absent (Qdrant
  silently excludes null-valued payloads from range filters, so treating
  'unscored' as 'lowest score' keeps them visible to threshold queries).
- foresight_qdrant_converter.py: ForesightRecord -> PointStruct. Time-field
  parser accepts datetime / ISO-8601 / numeric. **Diverges from Milvus
  template**: numeric inputs above 1e10 are treated as already-milliseconds
  rather than blindly multiplied by 1000 — the Milvus version corrupts
  already-ms inputs. content payload is intentionally passed verbatim
  (incl. None) for downstream sentinel semantics; documented inline.

…onverter (Phase 2 complete)

Adds the final two of six Qdrant collections — Phase 2 of the
Milvus->Qdrant migration is now structurally complete (6 collections + 6
converters under src/infra_layer/adapters/out/search/qdrant/).

Collections:
- atomic_fact_collection.py: base name v1_atomic_fact_record. Payload
  indexes for user_id/group_id/session_id/parent_id/parent_type/type
  (keyword) + timestamp (integer, epoch ms).
- user_profile_collection.py: base name v1_user_profile. No session_id
  (user-level aggregation). Payload indexes for user_id/group_id/scenario/
  item_type (all keyword).

Converters:
- atomic_fact_qdrant_converter.py: AtomicFactRecord -> PointStruct. Falls
  back to RawDataType.CONVERSATION when source.type is absent. exc_info
  on error log.
- user_profile_qdrant_converter.py: **diverges from the other converters'
  return type** — returns List[Dict[str, Any]] (one item per
  explicit_info / implicit_trait / user_goal entry) for parity with the
  Milvus counterpart. ProfileIndexer downstream wraps each item into a
  PointStruct after embedding. Module-level _EXPLICIT_FIELDS and
  _IMPLICIT_FIELDS constants (Milvus version had them inline). Carries
  '# type: ignore[override]' on from_mongo with docstring justification.

Phase 2 file inventory:
  src/infra_layer/adapters/out/search/qdrant/
  ├── __init__.py
  ├── memory/
  │   ├── __init__.py
  │   ├── episodic_memory_collection.py
  │   ├── agent_case_collection.py
  │   ├── agent_skill_collection.py
  │   ├── foresight_collection.py
  │   ├── atomic_fact_collection.py
  │   └── user_profile_collection.py
  └── converter/
      ├── __init__.py
      ├── episodic_memory_qdrant_converter.py
      ├── agent_case_qdrant_converter.py
      ├── agent_skill_qdrant_converter.py
      ├── foresight_qdrant_converter.py
      ├── atomic_fact_qdrant_converter.py
      └── user_profile_qdrant_converter.py

…ories

First 2 of 6 Qdrant repositories, mirroring the surface of the corresponding
Milvus repositories so the search-service layer can swap backends via the
VECTOR_STORE_BACKEND env flag.

Both repositories:
- Inherit from BaseQdrantRepository[<Collection>], registered as
  @repository(name='..._qdrant_repository', primary=False).
- Build filters as qmodels.Filter(must=[FieldCondition(...)]) using
  MatchValue / MatchAny / Range instead of Milvus' string expression
  syntax. Filter-construction is fully typed — no injection vector
  remains in the search path.
- Honour the MAGIC_ALL sentinel for user_id / group_id with the same
  semantics as the Milvus repositories.
- Use a two-stage score gating pattern (server-side score_threshold via
  Qdrant + client-side post-filter at the caller's hard threshold);
  the rationale is documented inline so future readers don't read it
  as a duplicated check.

AgentSkillQdrantRepository:
- vector_search() with maturity_threshold / confidence_threshold range
  filters plus optional cluster_id / group_ids.
- delete_by_cluster_id() — uses scroll() for a best-effort delete count
  (Qdrant's filter-based delete doesn't return one) then deletes via
  FilterSelector(filter=...).

EpisodicMemoryQdrantRepository:
- create_and_save_episodic_memory() — convenience constructor that builds
  a PointStruct and upserts, returns the same lightweight summary dict
  as the Milvus repository for caller parity.
- vector_search() with full scope + time-range filters.
- delete_by_filters() — batch delete by user_id/group_id/time-range;
  same MAGIC_ALL guard and 'at least one filter required' contract as
  the Milvus repository.

Resolves the full set of findings from a CodeRabbit code review on
feature/qdrant-adapter (1 critical, 10 major, 19 minor).

**Critical**
- episodic_memory_qdrant_repository.delete_by_filters: scroll with hard-
  coded limit=10_000 could undercount large tenants. Replaced with an
  exact client.count() call so the returned delete-count reflects the
  full set.

**Major**
- agent_skill_qdrant_repository.delete_by_cluster_id: same scroll-limit
  bug. Same fix (exact count + filter delete) and re-raise on error.
- episodic_memory_qdrant_repository.vector_search: two-stage score
  gating now uses min(radius, score_threshold) for server-side
  filtering so a wider radius doesn't accidentally make the server cut
  stricter than the client-side post-filter.
- AgentCase / AgentSkill / EpisodicMemory / Foresight / AtomicFact
  converters: explicit non-empty vector validation (raise instead of
  silently writing an empty list) and explicit id None-guard
  (no more str(None) -> 'None' point ids).
- foresight_qdrant_converter._parse_time_field: 'if not time_value'
  treated epoch 0 as missing. Now 'if time_value is None'.
- atomic_fact_qdrant_converter: _build_search_content is now actually
  written into the point payload (was dead code); vector access uses
  getattr defensive; type fallback only when source.type is None
  rather than any falsy value.
- base_repository.find_by_id / find_by_ids / delete_by_id: stop
  swallowing all exceptions. Errors are logged and re-raised so callers
  can distinguish 'not found' from operational failures. Behaviourally
  consistent with the rest of the base methods (upsert/delete_batch/
  search) that already raised on failure.
- qdrant_collection_base.drop: log + re-raise instead of swallow.
- config_utils._load_qdrant_env and qdrant_client_factory.get_qdrant_config:
  safe int(QDRANT_PORT) with try/except + TCP range guard (1-65535).
- qdrant_client_factory: URL assembly preserves an already-schemed host
  verbatim (e.g. 'https://my-qdrant.cloud') instead of force-prefixing
  http:// and double-appending the port.
- qdrant_client_factory.get_client: threading.Lock with double-checked
  locking eliminates the cache-miss race that could create duplicate
  QdrantClient instances under concurrent FastAPI requests.

**Minor**
- 6x collection docstrings: 'dim=1024' -> 'dim=VECTORIZE_DIMENSIONS'
  (no more drift if the constant changes).
- 2x ValueError messages: 'cannot be empty' -> 'cannot be None' to
  match the actual 'is None' guard.
- config_utils.get_qdrant_connection_cache_key: api_key.encode now
  tolerates bytes/str/other.
- agent_skill_qdrant_repository.vector_search: 'user_id is None' now
  skips the filter entirely instead of matching the empty string.
- qdrant_client_factory.get_named_client: cache key normalized via
  .lower() so 'Default'/'DEFAULT'/'default' share one client.
- qdrant_client_factory.get_qdrant_config: 'https_raw' now uses the
  _env helper consistently with the other env vars.
- 2x qdrant_collection_base: 'assert cfg is not None' replaced with
  explicit RuntimeError so the guard survives python -O.

Total: 17 files changed, ~30 distinct fixes.

Adds repositories 3 and 4 of 6. Both apply all CodeRabbit-derived patterns
established in the previous Phase 2.5 fix-pass:

- user_id/MAGIC_ALL guard skips the filter when None/empty (no spurious
  user_id == '' match).
- Two-stage score gating: server-side passes min(radius, score_threshold)
  so a wider radius cannot accidentally tighten the cut; client-side post-
  filter enforces the hard caller minimum.
- client.count(exact=True) for delete-by-filter return values (not a
  bounded scroll page).
- All error paths re-raise after a structured log.

AgentCaseQdrantRepository:
- vector_search() with scope (user_id / session_id / group_ids / parent_id)
  and time-range filters in epoch seconds (parity with the AgentCase
  converter and the Milvus repository — agent_case is the one collection
  storing seconds, not milliseconds).
- Returns a datetime for timestamp (round-tripped from epoch
  seconds with tz=UTC).

AtomicFactQdrantRepository:
- create_and_save_atomic_fact() convenience constructor: builds the
  PointStruct (with empty vector validation), upserts, returns the
  Milvus-shaped summary dict for caller parity.
- vector_search() with full scope + time-range filters in epoch ms.
- batch_vector_search_by_parent_ids(): MRAG-Phase-3 expansion path —
  MatchAny over parent_ids with total_limit = limit * len(parent_ids).
  Returns early with an empty list when no parent_ids are passed.
- delete_by_filters(): uses exact count + filter-based delete; raises on
  any operational error so callers can distinguish 'no points' from
  failure.
- All search paths return datetime for timestamp (consistent with
  create_and_save_atomic_fact, parity with agent_case).

…s (Phase 2.5 complete)

Final 2 of 6 Qdrant repositories. Phase 2.5 is now structurally complete:
all six adapters (agent_skill, episodic_memory, agent_case, atomic_fact,
foresight, user_profile) exist as Qdrant repositories matching their
Milvus counterparts.

All four established Phase-2.5 patterns applied:
- user_id/MAGIC_ALL guard skips the filter on None/empty
- Two-stage score gating: min(radius, score_threshold) server-side
- client.count(exact=True) for delete-by-filter return values
- Re-raise after structured log (no swallowed errors)

ForesightQdrantRepository:
- create_and_save_foresight_mem(): convenience constructor + upsert.
  session_id is now an explicit parameter (writes into payload) so the
  matching vector_search(session_id=...) filter actually hits — the
  Milvus repository signature lacked this parameter and produced a
  silent zero-hit filter.
- vector_search() with scope (user_id/group_ids/session_id/sender_id/
  parent_type/parent_id) + time-range filters.
  **Diverges from Milvus**: filters on start_time/end_time payload
  fields (semantically correct range overlap) instead of the Milvus
  repository's non-existent 'timestamp' field. Documented inline.
  sender_id filter uses Qdrant's element-wise MatchValue on the
  sender_ids array — equivalent to Milvus' array_contains.
- delete_by_filters() with the same start_time/end_time semantics.

UserProfileQdrantRepository:
- vector_search() with user_id/group_id/scenario scoping (no
  session_id — user_profile is user-level aggregation).
- delete_by_user_group(): count + filter-based delete, raises on
  operational error (consistent with the Phase 2.5 fix-pass on
  base_repository).

CodeRabbit pass 2 found 7 follow-up findings after pass 1. All addressed:

**Major**
- Timezone-naive datetimes in time-range filters silently used the local
  timezone for .timestamp() conversion, producing wrong epoch values.
  Added module-level helpers in base_repository: to_epoch_ms(dt) and
  to_epoch_s(dt) which coerce tz-naive datetimes to UTC. All five
  repositories now use these helpers consistently:
    - agent_case (epoch seconds via to_epoch_s)
    - atomic_fact / episodic_memory / foresight (epoch ms via to_epoch_ms)
    - user_profile (no time fields, untouched)

**Minor**
- foresight create_and_save_foresight_mem: start_time/end_time fall back
  to None instead of 0 when missing — 0 would silently match epoch-1970
  records. Documented inline.
- base_repository.count(): wrapped in try/except + structured log to
  match the rest of the async methods.
- atomic_fact create_and_save: vector validation now explicit None/empty
  check (`if vector is None or len(vector) == 0`) instead of `if not
  vector`, so a legitimate all-zero embedding is no longer falsy-rejected.
- user_profile_qdrant_repository.vector_search: group_id and scenario
  filters now mirror user_id's MAGIC_ALL guard (skip filter on MAGIC_ALL
  sentinel) instead of treating MAGIC_ALL as a literal value to match.

Note: the foresight repository's two-stage score-gating pattern was
flagged as 'redundant filtering'. It is intentional — server-side uses
the more permissive bound (radius widening) and the client-side post-
filter enforces the caller's hard cut. The behaviour is documented in
the inline comment block; the CodeRabbit finding is a false positive.

… Qdrant)

Adds devops_scripts/migrate_milvus_to_qdrant.py, the workhorse for the
Phase 3 cutover. Standalone: no EverOS DI container required.

Reads OpenRouter, Mongo, Qdrant config from env (auto-loads .env via
python-dotenv when present). Migrates one (mongo-db, mongo-collection)
pair to one Qdrant collection per invocation; shell-loop over the six
EverOS collection types × N tenants for the full sweep.

Defaults match the documented xinfty stack:
  - VECTORIZE_MODEL=qwen/qwen3-embedding-8b
  - VECTORIZE_DIMENSIONS=4096
  - OPENROUTER_BASE_URL=https://openrouter.ai/api/v1
  - MONGO_URI=mongodb://localhost:27017
  - QDRANT_HOST=localhost, QDRANT_PORT=6333

CLI args expose the per-collection variation:
  --text-field         primary text used for embedding
  --extra-text-fields  comma-separated secondary text fields
  --timestamp-field    + --timestamp-unit ms|s
  --payload-fields     comma-separated mongo fields projected to qdrant payload
  --batch-size         embedding batch size (default 32)
  --limit              cap for smoke tests
  --force              re-embed and overwrite existing points
  --dry-run            count without calling OpenRouter or Qdrant.upsert
  --log-level          DEBUG/INFO/WARNING/ERROR

Idempotent by default: client.retrieve filters out point ids that
already exist in the target Qdrant collection (skip path); --force
overwrites them.

Embedded behaviour:
  - extract_text concatenates text_field + extra_text_fields with newlines
  - build_payload projects payload_fields + normalizes timestamp via
    datetime.timestamp() (epoch ms or s depending on --timestamp-unit)
  - search_content is JSON-serialized from the text pieces, mirroring the
    converter's payload shape used by EverOS' search service.

ensure_qdrant_collection creates the target collection with the same
HNSW/Cosine config the EverOS adapter writes (m=16, ef_construct=200,
distance=Cosine) so the schema matches what the live service expects.

Qdrant only accepts unsigned-int or RFC-4122-UUID point ids; the Mongo
ObjectId hex (e.g. 69ed6acfaf31e5cd7977bc56) is neither and the live
pilot hit a 400 Bad Request from the Qdrant retrieve endpoint.

Fix:
- base_repository: add mongo_id_to_qdrant_id() helper that does
  str(uuid.uuid5(NAMESPACE, str(mongo_id))). Namespace is a fixed UUID
  embedded in code (must never change without a full re-migration).
- migrate_milvus_to_qdrant.py: use the helper for the Qdrant point id;
  keep the original Mongo id in the payload as 'mongo_id' for reverse
  lookup.

The Phase-2 converters (search/qdrant/converter/*) still use
str(source_doc.id) and would fail the same way the moment they go live.
That fix is the next commit.

ModuleNotFoundError: 'core' when invoked as
    python src/devops_scripts/migrate_milvus_to_qdrant.py ...

Fix: prepend the script's parent-of-parent (the EverOS src/ tree) to
sys.path before the core.oxm.qdrant.base_repository import. Lets the
script run without PYTHONPATH or pip install.

The Phase 2 converters used ``id=str(source_doc.id)`` directly when building
``PointStruct`` payloads. Qdrant only accepts unsigned integers or RFC-4122
UUIDs as point ids — a 24-hex-char Mongo ``ObjectId`` is neither, so the
Live-indexing path produced a 400 Bad Request on upsert.

The standalone re-embed CLI (commit c17ba60) already routed Mongo ids
through ``mongo_id_to_qdrant_id`` (uuid5 over a stable namespace), so the
two paths now agree:

- standalone migrate: Mongo doc -> uuid5 point id
- live converter:     Mongo doc -> uuid5 point id (this commit)

Both also persist the raw Mongo id in the payload as ``mongo_id`` for
round-trip lookup, idempotent re-embed, and debugging.

``user_profile_qdrant_converter`` is intentionally left untouched: it
emits multiple points per source doc (one per explicit_info/implicit_trait
entry), assigns fresh ObjectIds, and has its own Phase 3.1 path that needs
a separate point-id scheme.

Adds ``re_embed_sweep.py`` next to the standalone ``migrate_milvus_to_qdrant``
workhorse. The wrapper iterates every active (non-hyphen) Mongo database
times every supported collection type and invokes ``migrate(...)`` for each
non-empty pair.

Five collection types are covered:

- episodic_memory  (v1_episodic_memories  -> <prefix>_v1_episodic_memory)
- atomic_fact      (v1_atomic_fact_records -> <prefix>_v1_atomic_fact_record)
- foresight        (v1_foresight_records  -> <prefix>_v1_foresight_record)
- agent_case       (v1_agent_cases        -> <prefix>_v1_agent_case)
- agent_skill      (v1_agent_skills       -> <prefix>_v1_agent_skill)

``v1_user_profiles`` is deliberately excluded — it needs per-doc splitting
(one source doc -> many Qdrant points), handled by a separate Phase 3.1
script.

CLI shape mirrors the workhorse: ``--tenant``, ``--collection``,
``--batch-size``, ``--limit-per-pair``, ``--force``, ``--dry-run``,
``--log-level``. The wrapper imports ``migrate`` directly (no subprocess
fan-out) so config is read once and progress logs interleave naturally.

Critical
- ``migrate_milvus_to_qdrant`` now wraps the migration body in try/finally
  and closes ``mongo``, ``qdrant``, and ``openai`` clients explicitly. Long
  sweeps previously leaked connections on every per-pair invocation.

Major
- ``QdrantCollectionBase.exists`` only catches the qdrant-client transport
  exceptions (``ResponseHandlingException``, ``UnexpectedResponse``); other
  failures propagate so infrastructure issues stay visible instead of being
  silently treated as "collection missing".
- ``EpisodicMemoryQdrantRepository.create_and_save_episodic_memory`` rejects
  missing/empty vectors up front with a ``ValueError`` (mirrors the converter
  contract) instead of bubbling up a confusing 400 from Qdrant.
- ``EpisodicMemoryQdrantRepository.vector_search`` no longer treats the
  default ``user_id=None`` as a filter on the empty string. The condition
  now requires the caller to have provided an explicit (non-None,
  non-MAGIC_ALL) value, restoring full-recall behaviour for the unscoped
  search path.
- ``AtomicFactQdrantRepository.vector_search`` now returns ``atomic_fact``
  in the result dict (parity with the batch path and with the persisted
  payload from ``create_and_save_atomic_fact``).

Minor
- ``AgentSkillQdrantRepository.vector_search`` two-stage threshold now uses
  ``min(radius, score_threshold)`` server-side, matching the agent_case
  repository's "more permissive lower bound" semantics.

Nitpick
- ``logger.error`` in every except block touched by Phase 2/3 swapped for
  ``logger.exception`` (10 sites across converters, repositories, and the
  sweep wrapper) so the stack trace is always logged.
- ``build_payload`` now logs a warning when a timestamp field has an
  unexpected type instead of silently dropping the value.

High (H1-H14, except H10 already in 9faac50)

H1 — Singleton repository cached tenant-bound collection
``BaseQdrantRepository.collection`` lazily cached the resolved tenant-
prefixed collection instance, so a DI-singleton repository would lock to
the first tenant that ever called it and silently route subsequent
tenants' reads/writes to the wrong Qdrant collection. The cache is gone;
``self.model()`` is invoked per-call and re-resolves the tenant suffix
each time.

H2 — Qdrant client cache key ignored transport flags
``get_qdrant_connection_cache_key`` now folds ``https`` and ``prefer_grpc``
into the key. Two tenants on the same host but with different transport
flags now get distinct cached clients.

H3 — ``exists()`` swallowed auth and 5xx errors
The previous catch was ``(ResponseHandlingException, UnexpectedResponse)``,
which converted 401/403/5xx HTTP responses into "collection missing".
``ensure_collection()`` then routed into a confusing create attempt. Only
``ResponseHandlingException`` (transport-level) is caught now; HTTP errors
propagate.

H4 — Sweep exited 0 on partial failure
``sweep()`` returns the failed-pair count; ``main()`` returns ``1`` when
any pair failed so cron / CI sees the run as red.

H5 / H13 — Numeric timestamps not unit-normalized
Extracted ``_normalize_timestamp_to_epoch`` (heuristic ms-vs-s detection
on numeric values). Applied to the primary ``timestamp_field`` AND to any
time-shaped values in ``payload_fields`` (e.g. foresight ``end_time``)
so callers don't see a mixed ``datetime`` / numeric population.

H6 — Dimension drift on pre-existing collections
Both the migration helper and the runtime ``ensure_collection`` now read
``get_collection`` and raise ``RuntimeError`` when the existing vector
size disagrees with the configured one. Loud failure replaces per-batch
"vector size mismatch" once data starts flowing.

H7 — TOCTOU between ``exists()`` and ``create_collection``
Idempotency for races: a 409 ``UnexpectedResponse`` from
``create_collection`` is swallowed (parallel process created it first);
other errors propagate.

H8 — Foresight time-range was containment, should have been overlap
``vector_search`` now filters ``payload.end_time >= q.start_time`` and
``payload.start_time <= q.end_time``. The previous filter dropped
foresights whose window only partially overlapped the query window.

H9 — Lifespan failure left clients open
On any error during ``startup``, the lifespan provider now calls
``close_all_clients()`` before re-raising. ``shutdown()`` gates on the
factory's initialization state, not the env flag (env flips between
startup and shutdown in tests would have leaked clients).

H11 — EpisodicMemory.vector_search returned raw epoch
Result dict now normalizes ``timestamp`` to ``datetime`` for parity with
the other Qdrant repositories.

H12 — PII in user_profile delete-path logs
``user_id`` and ``group_id`` are now SHA-256-fingerprinted (12-char
prefix) before logging instead of emitted in cleartext.

H14 — ``atomic_fact`` missing from sweep payload spec
Added to the atomic_fact sweep spec so migrated records carry the raw
text — ``AtomicFactQdrantRepository.vector_search`` reads it directly
out of the payload.

Medium / Trivial

M1 — ``assert cfg is not None`` stripped under ``python -O``: replaced
     with explicit RuntimeError in ``ensure_payload_indexes``.
M3 — QDRANT_TIMEOUT now clamped to [1, 300] s.
M4 — Shutdown no longer gates on env flag (see H9).
M5 — README path-list expanded to include the infra_layer Qdrant tree.
T1 — Removed redundant ``or None`` after ``getattr(..., None)`` in
     atomic_fact converter.
T2 — ``BaseQdrantConverter.from_mongo`` return annotation widened from
     the generic bound (which the concrete converters do not satisfy) to
     ``Any``; the generic still documents the target *collection*.