fix: harden qdrant payload and paging

.superpowers/sdd/2026-08-08-internal-qdrant-ollama/task-5-report.md

@@ -96,3 +96,75 @@ git diff --check
   `/Users/mp/.agents/skills/adversarial-review`; I performed a manual adversarial self-review
   instead
 - the focused suite still emits one pre-existing warning from `testcontainers.postgres`
+
+## Fix round 1 — 2026-08-08
+
+### Findings addressed
+
+- IMPORTANT: metadata collisions could override canonical Qdrant payload identity fields and break
+  workspace isolation
+- IMPORTANT: scroll-based operations only read the first page and did not follow
+  `next_page_offset`, making `existing_hashes`, `list_evidence_generations`, and delete counts
+  inexact beyond one page
+
+### RED evidence
+
+Command:
+
+```bash
+cd harness
+./.venv/bin/pytest tests/test_qdrant_vector_store.py tests/test_vector_port_contract.py -q
+```
+
+Observed before the fix:
+
+- exit code `1`
+- `2 failed, 31 passed, 1 warning`
+
+Representative failures:
+
+- `assert payload["workspace_id"] == "demo"` failed because colliding `record.metadata`
+  overwrote canonical payload fields
+- paginated scroll test missed later pages, so `existing_hashes` and generation cleanup counts
+  were incomplete
+
+### GREEN evidence
+
+Command:
+
+```bash
+cd harness
+./.venv/bin/pytest tests/test_qdrant_vector_store.py tests/test_vector_port_contract.py -q
+```
+
+Observed after the fix:
+
+- exit code `0`
+- `33 passed, 1 warning`
+
+Touched-file lint:
+
+```bash
+cd harness
+./.venv/bin/ruff check tht/adapters/vector/qdrant.py tht/vectorstore/records.py \
+  tests/test_qdrant_vector_store.py tests/test_vector_port_contract.py
+```
+
+- exit code `0`
+- `All checks passed!`
+
+Patch hygiene:
+
+```bash
+git diff --check
+```
+
+- exit code `0`
+
+### Minimal fix
+
+- made `qdrant_payload` apply canonical fields after `record.metadata` so workspace ID, semantic
+  kind, original record kind, canonical record key, and content hash cannot be overridden by
+  metadata collisions
+- paginated `_scroll` until `next_page_offset` is absent, sent the returned `offset` back on the
+  next request, and reject repeated offsets as malformed to avoid infinite loops