deviation_engine: link kpi_value_id on deviation/trend alert rows; skip when period not attributable or kpi_values row missing; dedupe key now (entity_id,kpi_id,kpi_value_id,alert_type)
deviation_push: same-source R1/R5 guards, no-period request writes nothing
tests: add test_alert_caliber_r5_residual_20260919 (13 cases incl. negative controls); adapt r1r4/r5 fixtures to the supplemental ruling
-m- ai_suggestions.get_suggestion: filter by session entity_id (foreign 404)
- ai_suggestions.preview_suggestion: use the existing entity_id dependency in the query
- deviation_push.get_map_nodes: add entity_id dependency and (entity_id or 1) ownership guard
- tests: 4 regression cases (3 RED -> GREEN + auth baseline 401)
alert-to-plan, deviation-push review topic and AI-suggestion-to-plan built ActionPlan(...) without entity_id, so non-e1 sessions wrote rows with the model default 1 and entity_id stayed untrustworthy on those paths. Write the session entity at all three sites, scope the deviation-push topic dedupe by entity (a foreign same-title topic no longer suppresses the session entity's own topic), and require the applied suggestion to belong to the session entity. Adds 7 regression tests (both directions + cross-entity negative controls + auth floor).
Hermes CI Fix