@gmickel/gno 1.46.0 → 2.1.0

package/bunfig.toml

@@ -3,3 +3,5 @@ plugins = ["bun-plugin-tailwind"]
 
 [test]
 preload = ["./test/preload/happy-dom.ts"]
+# Frozen evidence and local experiments are not the executable regression suite.
+pathIgnorePatterns = [".flow/artifacts/**", "notes/**"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gmickel/gno",
-  "version": "1.46.0",
+  "version": "2.1.0",
   "description": "Local semantic search for your documents. Index Markdown, PDF, and Office files with hybrid BM25 + vector search.",
   "keywords": [
     "embeddings",
@@ -78,6 +78,7 @@
     "test:fixtures": "bun scripts/generate-test-fixtures.ts",
     "evals": "bun scripts/update-eval-scores.ts",
     "eval": "bun --bun evalite",
+    "eval:acceptance": "bun scripts/retrieval-acceptance.ts",
     "eval:hybrid": "bun --bun evalite evals/hybrid.eval.ts",
     "eval:memory": "bun --bun evalite evals/memory.eval.ts --threshold 100",
     "eval:memory:fixtures": "bun scripts/memory-eval-fixtures.ts",
@@ -160,8 +161,9 @@
     "prepack": "bun run package:clipper"
   },
   "dependencies": {
-    "@codemirror/lang-markdown": "6.5.1",
+    "@codemirror/lang-markdown": "6.5.2",
     "@codemirror/theme-one-dark": "6.1.3",
+    "@joplin/turndown-plugin-gfm": "1.0.67",
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@radix-ui/react-collapsible": "1.1.20",
@@ -174,7 +176,8 @@
     "@radix-ui/react-separator": "1.1.15",
     "@radix-ui/react-slot": "1.3.3",
     "@radix-ui/react-tooltip": "1.2.16",
-    "ai": "6.0.68",
+    "@xmldom/xmldom": "0.9.12",
+    "ai": "6.0.277",
     "bun-plugin-tailwind": "0.1.2",
     "class-variance-authority": "0.7.1",
     "clsx": "2.1.1",
@@ -182,19 +185,23 @@
     "codemirror": "6.0.2",
     "commander": "15.0.0",
     "embla-carousel-react": "8.6.0",
+    "fflate": "0.8.3",
+    "file-type": "22.0.2",
     "franc": "6.2.0",
+    "jsdom": "25.0.1",
     "jsonc-parser": "3.3.1",
     "less-pager-mini": "1.12.1",
-    "lucide-react": "1.28.0",
-    "markitdown-ts": "0.0.10",
+    "lucide-react": "1.41.0",
+    "mammoth": "1.12.2",
     "mdast-util-from-markdown": "2.0.3",
     "mdast-util-gfm": "3.1.0",
     "micromark-extension-gfm": "3.0.0",
+    "mime-types": "2.1.35",
     "minimatch": "10.2.6",
-    "nanoid": "6.0.0",
-    "node-llama-cpp": "3.19.1",
-    "officeparser": "7.5.0",
-    "pdfjs-dist": "6.2.108",
+    "nanoid": "6.0.1",
+    "node-llama-cpp": "3.20.0",
+    "pdf-parse": "2.4.5",
+    "pdfjs-dist": "6.3.289",
     "picocolors": "1.1.1",
     "react": "19.2.8",
     "react-dom": "19.2.8",
@@ -202,45 +209,52 @@
     "react-markdown": "10.1.0",
     "rehype-sanitize": "6.0.0",
     "remark-gfm": "4.0.1",
-    "sharp": "0.35.3",
-    "shiki": "4.3.1",
+    "sharp": "0.35.4",
+    "shiki": "4.4.3",
     "sqlite-vec": "0.1.9",
-    "streamdown": "2.5.0",
+    "streamdown": "2.6.0",
     "tailwind-merge": "3.6.0",
     "tailwindcss": "4.3.3",
+    "tesseract.js": "7.0.0",
+    "turndown": "7.2.4",
     "use-stick-to-bottom": "1.1.6",
+    "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
     "zod": "4.4.3"
   },
   "devDependencies": {
-    "@ai-sdk/openai": "3.0.25",
-    "@biomejs/biome": "2.5.6",
+    "@ai-sdk/openai": "3.0.108",
+    "@biomejs/biome": "2.5.12",
     "@tailwindcss/cli": "4.3.3",
-    "@testing-library/react": "16.3.2",
-    "@testing-library/user-event": "14.6.1",
-    "@types/bun": "1.3.14",
-    "@types/react": "19.2.17",
-    "@types/react-dom": "19.2.3",
+    "@testing-library/react": "16.3.3",
+    "@testing-library/user-event": "14.6.7",
+    "@types/bun": "1.4.1",
+    "@types/react": "19.2.18",
+    "@types/react-dom": "19.2.7",
     "@vscode/tree-sitter-wasm": "0.3.1",
-    "ajv": "8.17.1",
+    "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
-    "bun": "1.3.14",
+    "bun": "1.4.2",
     "docx": "9.7.1",
     "evalite": "1.0.0-beta.16",
     "exceljs": "4.4.0",
-    "happy-dom": "20.11.1",
-    "lefthook": "2.1.10",
+    "happy-dom": "20.14.0",
+    "lefthook": "2.1.12",
     "oxfmt": "0.28.0",
     "oxlint": "1.43.0",
     "oxlint-tsgolint": "0.11.5",
     "pdf-lib": "1.17.1",
-    "playwright": "1.62.0",
+    "playwright": "1.63.0",
     "pptxgenjs": "4.0.1",
     "ultracite": "7.1.5",
     "vitest": "4.1.10",
-    "web-tree-sitter": "0.26.11"
+    "web-tree-sitter": "0.26.13"
   },
   "peerDependencies": {
-    "typescript": "^5"
+    "typescript": "^5.9.3"
+  },
+  "overrides": {
+    "@fastify/static": "10.1.3",
+    "file-type": "22.0.2"
   },
   "engines": {
     "bun": ">=1.3.0"

package/spec/cli.md

@@ -1330,6 +1330,8 @@ gno search "contract" --json | jq '.[] | .uri'
 
 ---
 
+Keyword retrieval applies collection/path scope, caller allowlists, tags, modified-date bounds, category and author filters, managed-memory visibility, and whole-document exclusions before its ranked candidate limit. Higher-ranked ineligible documents cannot consume that window; fewer eligible matches still produce a short result. Existing BM25 weights, query syntax, recency/project-affinity reranking and minimum-score behavior are unchanged.
+
 ### gno vsearch
 
 Vector semantic search over indexed documents.
@@ -1343,6 +1345,21 @@ gno vsearch <query> [-n <num>] [--min-score <num>] [-c <collection>] [--since <d
 **Options:** Same as `gno search` (including temporal/category/author, tag, and
 project-affinity controls).
 
+**Embedding ownership:** After an exact-input partition activates, vector hits
+resolve only to eligible current document owners of that formatted input.
+Same-body documents with different title-derived inputs retain separate vector
+ranks. Collection, path, tag, memory, metadata and language eligibility apply
+before the nearest-neighbor limit. Public document IDs, URIs and mirror hashes
+keep their existing meaning.
+
+Incomplete shadow backfill retains the legacy retrieval path. Initial promotion
+requires complete active coverage and an atomic mutation-epoch check. Once
+promoted, later mutations never permit fallback to unproven legacy vectors:
+stale owners await embedding; missing runtime identity, an unactivated selected
+partition or an unavailable variant index reports semantic failure. Hybrid query
+may continue lexically with fallback diagnostics. Run `gno embed` to complete or
+repair coverage; no historical vector is treated as proof of its formatted input.
+
 **Scoring:**
 
 Vector similarity scores are normalized to a 0-1 range:
@@ -2280,6 +2297,14 @@ gno publish export <target> \
   [--json]
 ```
 
+The CLI and `POST /api/publish/export` MUST preserve the existing `public`
+default when visibility is omitted. Local Web UI export dialogs MUST instead
+require an explicit mode. Both successful export results MUST report the
+selected mode in `artifact.spaces[].visibility`. Invalid modes and missing required encryption input
+MUST fail without an artifact. Encrypted CLI export requires `--passphrase`;
+the local API requires `encryptionPassphrase`. Neither sends that input to
+gno.sh. Export is a local operation, not hosted activation or deletion.
+
 Public V1 spaces MUST carry a `manifest` conforming to
 [`publish-artifact.schema.json`](./output-schemas/publish-artifact.schema.json).
 The manifest contains schema version `1.0`, a deterministic projection
@@ -3788,7 +3813,7 @@ production default unless the parent was started with `--dev`.
 | `--pid-file <path>`    | string  | `{data}/serve.pid`       | Override pid-file location (JSON metadata, absolute path)        |
 | `--log-file <path>`    | string  | `{data}/serve.log`       | Override log-file location (append mode)                         |
 | `--status`             | boolean | false                    | Read pid-file, check liveness, print status (JSON with `--json`) |
-| `--stop`               | boolean | false                    | Graceful SIGTERM with 10s timeout → SIGKILL fallback             |
+| `--stop`               | boolean | false                    | Graceful SIGTERM with 12s timeout → SIGKILL fallback             |
 | `--host <address>`     | string  | `127.0.0.1`              | Loopback listen address (Web/REST remains local-only)            |
 | `--mcp-token-file`     | string  | config                   | Restrictive bearer-token file                                    |
 | `--mcp-allowed-host`   | string  | config/loopback defaults | Exact Host value; repeatable                                     |
@@ -3847,7 +3872,7 @@ is blocked.
   without changing destination.
 - On `--detach`: forks a detached child with stdio redirected to `--log-file`, writes pid-file JSON (`{pid, port, cmd:"serve", version, started_at}`), prints `{pid, url}` on stdout, exits 0
 - On `--status`: output matches the [process-status schema](./output-schemas/process-status.schema.json). Liveness via `process.kill(pid, 0)`; stale pid-files (ESRCH) are reported as `running:false`. Live status best-effort reads the same redacted `resident-status@1.0` snapshot from the recorded listener.
-- On `--stop`: sends SIGTERM, polls every 100ms for up to 10s, falls back to SIGKILL, polls 2s more, unlinks pid-file if the process cleaned up after itself
+- On `--stop`: sends SIGTERM, polls every 100ms for up to 12s, falls back to SIGKILL, polls 2s more, unlinks pid-file if the process cleaned up after itself
 - **Windows**: `--detach` is unsupported and returns a `VALIDATION` error pointing to WSL. `--status` / `--stop` / `--pid-file` / `--log-file` remain parseable but have nothing to manage.
 
 **Exit Codes:**
@@ -3901,7 +3926,7 @@ gno daemon --stop
 | `--pid-file <path>`    | string  | `{data}/daemon.pid`      | Override pid-file location (JSON metadata, absolute path)        |
 | `--log-file <path>`    | string  | `{data}/daemon.log`      | Override log-file location (append mode)                         |
 | `--status`             | boolean | false                    | Read pid-file, check liveness, print status (JSON with `--json`) |
-| `--stop`               | boolean | false                    | Graceful SIGTERM with 10s timeout → SIGKILL fallback             |
+| `--stop`               | boolean | false                    | Graceful SIGTERM with 12s timeout → SIGKILL fallback             |
 | `--host <address>`     | string  | `127.0.0.1`              | HTTP listen address                                              |
 | `--mcp-token-file`     | string  | config                   | Restrictive bearer-token file                                    |
 | `--mcp-allowed-host`   | string  | config/loopback defaults | Exact Host value; repeatable                                     |
@@ -3943,7 +3968,7 @@ is blocked.
   peer zone and all participating collection policies before returning metadata
 - On `--detach`: forks a detached child with stdio redirected to `--log-file`, writes pid-file JSON including the MCP gateway `port`, prints `{pid}` on stdout, exits 0
 - On `--status`: output matches the [process-status schema](./output-schemas/process-status.schema.json), including the MCP gateway port and a best-effort copy of the live redacted resident snapshot
-- On `--stop`: SIGTERM → 10s poll → SIGKILL → 2s poll; the daemon's own signal handler unlinks the pid-file, `--stop` unlinks as fallback
+- On `--stop`: SIGTERM → 12s poll → SIGKILL → 2s poll; the daemon's own signal handler unlinks the pid-file, `--stop` unlinks as fallback
 - **Windows**: `--detach` is unsupported and returns a `VALIDATION` error pointing to WSL.
 
 **Packaged conformance:** `bun run test:package` installs the generated npm

package/spec/db/schema.sql

@@ -1,4 +1,35 @@
 -- GNO Database Schema v1
+-- Graph reference inventory (migration 029). Parsed links remain in doc_links.
+-- Snapshots deliberately survive document deletion: closure needs old identities.
+-- Missing inventory, changed version/config, or dirty state requires full recovery.
+-- Begin persists dirty before projection. Complete only after successful edge writes,
+-- unchanged input epoch, and coverage of every active source; compose in a transaction.
+CREATE TABLE graph_projection_state (
+  id INTEGER PRIMARY KEY CHECK (id = 1),
+  epoch INTEGER NOT NULL DEFAULT 0,
+  version INTEGER,
+  config_fingerprint TEXT,
+  in_progress INTEGER NOT NULL DEFAULT 0 CHECK (in_progress IN (0, 1)),
+  dirty INTEGER NOT NULL DEFAULT 1 CHECK (dirty IN (0, 1))
+);
+INSERT INTO graph_projection_state(id) VALUES (1);
+CREATE TABLE graph_reference_documents (
+  document_id INTEGER PRIMARY KEY,
+  collection TEXT NOT NULL, rel_path TEXT NOT NULL, docid TEXT NOT NULL,
+  uri TEXT NOT NULL, title TEXT, mirror_hash TEXT, source_hash TEXT NOT NULL,
+  content_type TEXT
+);
+CREATE INDEX idx_graph_reference_uri ON graph_reference_documents(uri);
+CREATE INDEX idx_graph_reference_path ON graph_reference_documents(collection, rel_path);
+CREATE INDEX idx_graph_reference_title ON graph_reference_documents(title);
+CREATE TABLE graph_frontmatter_references (
+  source_doc_id INTEGER NOT NULL REFERENCES graph_reference_documents(document_id) ON DELETE CASCADE,
+  ordinal INTEGER NOT NULL,
+  edge_type TEXT NOT NULL,
+  target TEXT NOT NULL,
+  PRIMARY KEY(source_doc_id, ordinal)
+);
+CREATE INDEX idx_graph_reference_target ON graph_frontmatter_references(target);
 -- SQLite with FTS5
 --
 -- Tables:
@@ -221,9 +252,109 @@ CREATE INDEX IF NOT EXISTS idx_vectors_freshness
   ON content_vectors(model, embed_fingerprint, mirror_hash, seq, embedded_at);
 
 -- ─────────────────────────────────────────────────────────────────────────────
--- LLM Cache (EPIC 6+)
+-- Exact embedding input variants (v1)
 -- ─────────────────────────────────────────────────────────────────────────────
 
+-- Input variants v1 are additive shadow state. Legacy content_vectors remain
+-- authoritative until a partition's complete active-owner coverage is checked
+-- under BEGIN IMMEDIATE at the expected mutation epoch. Never infer exact
+-- historical input from unique ownership. Pending work is current active
+-- document/chunk pairs without a validated binding; it is resumable by owner.
+CREATE TABLE IF NOT EXISTS vector_variant_epoch (
+  id INTEGER PRIMARY KEY CHECK (id = 1),
+  epoch INTEGER NOT NULL DEFAULT 0
+);
+INSERT OR IGNORE INTO vector_variant_epoch(id) VALUES (1);
+CREATE TABLE IF NOT EXISTS vector_partitions (
+  partition_id TEXT PRIMARY KEY,
+  version INTEGER NOT NULL CHECK (version = 1),
+  model TEXT NOT NULL,
+  fingerprint TEXT NOT NULL,
+  dimensions INTEGER NOT NULL CHECK (dimensions > 0),
+  state TEXT NOT NULL DEFAULT 'shadow' CHECK (state IN ('shadow', 'active')),
+  activated_epoch INTEGER,
+  UNIQUE(model, fingerprint, dimensions)
+);
+CREATE TABLE IF NOT EXISTS vector_variants (
+  variant_id INTEGER PRIMARY KEY,
+  partition_id TEXT NOT NULL REFERENCES vector_partitions(partition_id),
+  input_hash TEXT NOT NULL CHECK (length(input_hash) = 64),
+  embedding BLOB NOT NULL,
+  UNIQUE(partition_id, input_hash),
+  UNIQUE(partition_id, variant_id)
+);
+CREATE TABLE IF NOT EXISTS vector_owners (
+  document_id INTEGER NOT NULL REFERENCES documents(id) ON DELETE CASCADE,
+  mirror_hash TEXT NOT NULL,
+  seq INTEGER NOT NULL,
+  partition_id TEXT NOT NULL,
+  variant_id INTEGER NOT NULL,
+  PRIMARY KEY(document_id, seq, partition_id),
+  FOREIGN KEY(partition_id, variant_id)
+    REFERENCES vector_variants(partition_id, variant_id)
+);
+CREATE INDEX IF NOT EXISTS idx_vector_owners_variant ON vector_owners(variant_id);
+-- No chunk FK: replacing shared canonical chunks must not cascade vector loss.
+-- The writer validates bindings against current document/chunk/formatted input.
+-- vec_v1_<partition SHA256> uses variant_id INTEGER PRIMARY KEY and FLOAT[dims].
+-- Its writes/deletes share the authoritative variant transaction; no best effort.
+-- Mutation epoch fences all old and new writers, including raw SQL. Active state
+-- records durable variant authority after initial promotion. activated_epoch
+-- proves current completeness only when it matches the mutation epoch.
+-- Later mutations do not revoke authority: retrieval validates each owner and
+-- continues serving unaffected variants; it must not fall back wholesale to
+-- legacy rows. Recreating a missing vec0 table resets its partition to shadow.
+
+CREATE TRIGGER IF NOT EXISTS variant_epoch_documents_INSERT
+  AFTER INSERT ON documents BEGIN
+    UPDATE vector_variant_epoch SET epoch = epoch + 1 WHERE id = 1;
+  END;
+CREATE TRIGGER IF NOT EXISTS variant_epoch_documents_UPDATE
+  AFTER UPDATE ON documents BEGIN
+    UPDATE vector_variant_epoch SET epoch = epoch + 1 WHERE id = 1;
+  END;
+CREATE TRIGGER IF NOT EXISTS variant_epoch_documents_DELETE
+  AFTER DELETE ON documents BEGIN
+    UPDATE vector_variant_epoch SET epoch = epoch + 1 WHERE id = 1;
+  END;
+CREATE TRIGGER IF NOT EXISTS variant_epoch_content_chunks_INSERT
+  AFTER INSERT ON content_chunks BEGIN
+    UPDATE vector_variant_epoch SET epoch = epoch + 1 WHERE id = 1;
+  END;
+CREATE TRIGGER IF NOT EXISTS variant_epoch_content_chunks_UPDATE
+  AFTER UPDATE ON content_chunks BEGIN
+    UPDATE vector_variant_epoch SET epoch = epoch + 1 WHERE id = 1;
+  END;
+CREATE TRIGGER IF NOT EXISTS variant_epoch_content_chunks_DELETE
+  AFTER DELETE ON content_chunks BEGIN
+    UPDATE vector_variant_epoch SET epoch = epoch + 1 WHERE id = 1;
+  END;
+CREATE TRIGGER IF NOT EXISTS variant_epoch_vector_owners_INSERT
+  AFTER INSERT ON vector_owners BEGIN
+    UPDATE vector_variant_epoch SET epoch = epoch + 1 WHERE id = 1;
+  END;
+CREATE TRIGGER IF NOT EXISTS variant_epoch_vector_owners_UPDATE
+  AFTER UPDATE ON vector_owners BEGIN
+    UPDATE vector_variant_epoch SET epoch = epoch + 1 WHERE id = 1;
+  END;
+CREATE TRIGGER IF NOT EXISTS variant_epoch_vector_owners_DELETE
+  AFTER DELETE ON vector_owners BEGIN
+    UPDATE vector_variant_epoch SET epoch = epoch + 1 WHERE id = 1;
+  END;
+CREATE TRIGGER IF NOT EXISTS variant_epoch_vector_variants_INSERT
+  AFTER INSERT ON vector_variants BEGIN
+    UPDATE vector_variant_epoch SET epoch = epoch + 1 WHERE id = 1;
+  END;
+CREATE TRIGGER IF NOT EXISTS variant_epoch_vector_variants_UPDATE
+  AFTER UPDATE ON vector_variants BEGIN
+    UPDATE vector_variant_epoch SET epoch = epoch + 1 WHERE id = 1;
+  END;
+CREATE TRIGGER IF NOT EXISTS variant_epoch_vector_variants_DELETE
+  AFTER DELETE ON vector_variants BEGIN
+    UPDATE vector_variant_epoch SET epoch = epoch + 1 WHERE id = 1;
+  END;
+
+-- LLM Cache (EPIC 6+)
 CREATE TABLE IF NOT EXISTS llm_cache (
   key TEXT PRIMARY KEY,
   value TEXT NOT NULL,
@@ -814,3 +945,17 @@ CREATE INDEX IF NOT EXISTS idx_file_refactor_journal_plan_digest
 
 CREATE INDEX IF NOT EXISTS idx_file_refactor_journal_collection
   ON file_refactor_recovery_journal(collection, updated_at_ms DESC);
+
+-- Graph input/inventory invalidation (029); begin also advances epoch to fence older passes.
+CREATE TRIGGER graph_input_documents_insert AFTER INSERT ON documents BEGIN UPDATE graph_projection_state SET epoch = epoch + 1, dirty = 1 WHERE id = 1; END;
+CREATE TRIGGER graph_input_documents_update AFTER UPDATE ON documents WHEN OLD.collection IS NOT NEW.collection OR OLD.rel_path IS NOT NEW.rel_path OR OLD.docid IS NOT NEW.docid OR OLD.uri IS NOT NEW.uri OR OLD.title IS NOT NEW.title OR OLD.mirror_hash IS NOT NEW.mirror_hash OR OLD.source_hash IS NOT NEW.source_hash OR OLD.content_type IS NOT NEW.content_type OR OLD.active IS NOT NEW.active BEGIN UPDATE graph_projection_state SET epoch = epoch + 1, dirty = 1 WHERE id = 1; END;
+CREATE TRIGGER graph_input_documents_delete AFTER DELETE ON documents BEGIN UPDATE graph_projection_state SET epoch = epoch + 1, dirty = 1 WHERE id = 1; END;
+CREATE TRIGGER graph_input_doc_links_insert AFTER INSERT ON doc_links BEGIN UPDATE graph_projection_state SET epoch = epoch + 1, dirty = 1 WHERE id = 1; END;
+CREATE TRIGGER graph_input_doc_links_update AFTER UPDATE ON doc_links BEGIN UPDATE graph_projection_state SET epoch = epoch + 1, dirty = 1 WHERE id = 1; END;
+CREATE TRIGGER graph_input_doc_links_delete AFTER DELETE ON doc_links BEGIN UPDATE graph_projection_state SET epoch = epoch + 1, dirty = 1 WHERE id = 1; END;
+CREATE TRIGGER graph_inventory_graph_reference_documents_insert AFTER INSERT ON graph_reference_documents BEGIN UPDATE graph_projection_state SET dirty = 1, in_progress = 1 WHERE id = 1; END;
+CREATE TRIGGER graph_inventory_graph_reference_documents_update AFTER UPDATE ON graph_reference_documents BEGIN UPDATE graph_projection_state SET dirty = 1, in_progress = 1 WHERE id = 1; END;
+CREATE TRIGGER graph_inventory_graph_reference_documents_delete AFTER DELETE ON graph_reference_documents BEGIN UPDATE graph_projection_state SET dirty = 1, in_progress = 1 WHERE id = 1; END;
+CREATE TRIGGER graph_inventory_graph_frontmatter_references_insert AFTER INSERT ON graph_frontmatter_references BEGIN UPDATE graph_projection_state SET dirty = 1, in_progress = 1 WHERE id = 1; END;
+CREATE TRIGGER graph_inventory_graph_frontmatter_references_update AFTER UPDATE ON graph_frontmatter_references BEGIN UPDATE graph_projection_state SET dirty = 1, in_progress = 1 WHERE id = 1; END;
+CREATE TRIGGER graph_inventory_graph_frontmatter_references_delete AFTER DELETE ON graph_frontmatter_references BEGIN UPDATE graph_projection_state SET dirty = 1, in_progress = 1 WHERE id = 1; END;

package/spec/mcp.md

@@ -11,6 +11,21 @@ name answers JSON-RPC `-32602`)
 
 This document specifies the MCP server interface for GNO.
 
+## Filtered retrieval limits
+
+Search candidate budgets apply after supported owner filters (collection, path,
+tags, dates, author, categories and exclusions). Semantic retrieval and hybrid
+retrieval also select matching-language chunks before their budgets; standalone
+lexical language remains reserved. A nearby out-of-scope vector cannot displace
+an eligible hit. Caller scope intersects user filters; empty allowlists deny all.
+Whole-document exclusions inspect every chunk, including other languages;
+hybrid exclusions also inspect author and category metadata.
+
+Results can remain shorter than the requested limit after score thresholds,
+deduplication or limited eligible coverage. Ranking/fusion and output schemas
+are unchanged. This correction does not change independent natural-language
+memory recall matching.
+
 ## Server Information
 
 | Property  | Value                |
@@ -281,6 +296,17 @@ redacted statuses: 401 (authentication), 403 (peer/Host/Origin/write), 413
 POST body, 120 requests/minute per actual peer, 64 active requests, 16 queued
 requests, 32 sessions, and a five-minute idle session timeout.
 
+### Cancellation and accepted jobs
+
+MCP request cancellation notifications and transport disconnect propagate to the
+participating inference stages. Canceled calls cannot publish late results or
+successful fallback. Noncooperative native operations retain their model lease
+and shared queue capacity until actual settlement or controlled child exit; queued
+operations are never replayed on a replacement child. Accepted asynchronous jobs
+have an independent lifetime after job-ID delivery and survive normal initiating
+transport closure. Explicit job cancellation and resident shutdown stop their
+subsequent work. Existing error, job status and output schemas remain unchanged.
+
 ### Packaged gateway conformance
 
 `bun run test:package` installs the generated npm tarball into an isolated

package/src/app/context-runtime-types.ts

@@ -4,6 +4,7 @@ import type { ContextEvidenceCompilerDeps } from "../core/context-evidence";
 import type { ContextVerifierDeps } from "../core/context-verifier";
 import type { RetrievalTraceSession } from "../core/retrieval-trace-session";
 import type { EmbeddingPort, RerankPort } from "../llm/types";
+import type { RequestHydration } from "../pipeline/hydration";
 import type { ProjectAffinityScoringInput } from "../pipeline/project-affinity";
 import type { QueryModeInput } from "../pipeline/types";
 import type { StorePort } from "../store/types";
@@ -43,6 +44,8 @@ export interface ContextCapsuleRuntimeDeps {
   store: StorePort &
     ContextEvidenceCompilerDeps<ContextCapsuleV1>["store"] &
     ContextVerifierDeps["store"];
+  /** Internal owner supplied by Ask; verification always reads the live store. */
+  hydration?: RequestHydration;
   config: Config;
   indexName?: string;
   vectorIndex?: VectorIndexPort | null;

package/src/app/context-runtime.ts

@@ -96,11 +96,13 @@ export const buildContextCapsule = async (
     },
     {
       store: deps.store,
+      hydration: deps.hydration,
       retrieve: async (request) => {
         const requestNoRerank = noRerank || request.noRerank === true;
         const result = await searchHybrid(
           {
             store: deps.store,
+            hydration: deps.hydration,
             config: deps.config,
             vectorIndex: deps.vectorIndex ?? null,
             embedPort: deps.embedPort ?? null,

package/src/cli/commands/ask.ts

@@ -31,6 +31,7 @@ import {
   processAnswerResultWithTrace,
 } from "../../pipeline/answer";
 import { type HybridSearchDeps, searchHybrid } from "../../pipeline/hybrid";
+import { RequestHydration } from "../../pipeline/hydration";
 import {
   createVectorIndexPort,
   type VectorIndexPort,
@@ -106,6 +107,7 @@ export async function ask(
   }
 
   const { store, config } = initResult;
+  const hydration = new RequestHydration(store);
 
   let embedPort: EmbeddingPort | null = null;
   let expandPort: GenerationPort | null = null;
@@ -258,6 +260,7 @@ export async function ask(
 
     const deps: HybridSearchDeps = {
       store,
+      hydration,
       config,
       vectorIndex,
       embedPort,
@@ -292,6 +295,7 @@ export async function ask(
           embedPort,
           rerankPort,
           genPort: answerPort,
+          hydration,
           projectAffinity,
           traceSession,
         }
@@ -357,7 +361,7 @@ export async function ask(
       await traceSession?.recordCapability("answer_generation", "attempted");
       const maxTokens = options.maxAnswerTokens ?? 512;
       const rawResult = await generateGroundedAnswer(
-        { genPort: answerPort, store },
+        { genPort: answerPort, store, hydration },
         query,
         results,
         maxTokens
@@ -441,6 +445,7 @@ export async function ask(
       error: cause instanceof Error ? cause.message : "Ask failed",
     };
   } finally {
+    hydration.release();
     if (embedPort) {
       await embedPort.dispose();
     }

package/src/cli/commands/daemon.ts

@@ -211,6 +211,14 @@ export async function daemon(
   });
   let gateway: Awaited<ReturnType<typeof createMcpHttpGateway>> | undefined;
   let server: ReturnType<typeof Bun.serve> | undefined;
+  const stopSignals = new AbortController();
+  const shutdown = createSignalPromise(
+    options.signal
+      ? AbortSignal.any([options.signal, stopSignals.signal])
+      : stopSignals.signal,
+    logger,
+    options.quiet ?? false
+  );
   try {
     gateway = await (deps.createMcpHttpGateway ?? createMcpHttpGateway)(
       runtime as ResidentRuntime,
@@ -271,10 +279,12 @@ export async function daemon(
       if (!options.quiet) {
         logger.log("Running initial sync...");
       }
-      const { syncResult, embedResult } = await runtime.syncAll({
-        runUpdateCmd: true,
-        triggerEmbed: true,
-      });
+      const synced = await Promise.race([
+        runtime.syncAll({ runUpdateCmd: true, triggerEmbed: true }),
+        shutdown.then(() => null),
+      ]);
+      if (!synced) return { success: true };
+      const { syncResult, embedResult } = synced;
       if (!options.quiet) {
         logger.log(
           `sync totals: ${syncResult.totalFilesAdded} added, ${syncResult.totalFilesUpdated} updated, ${syncResult.totalFilesErrored} errors, ${syncResult.totalFilesSkipped} skipped`
@@ -289,7 +299,7 @@ export async function daemon(
       logger.log("Skipping initial sync (--no-sync-on-start).");
     }
 
-    await createSignalPromise(options.signal, logger, options.quiet ?? false);
+    await shutdown;
     return { success: true };
   } catch (error) {
     return {
@@ -297,8 +307,11 @@ export async function daemon(
       error: error instanceof Error ? error.message : String(error),
     };
   } finally {
-    await Promise.allSettled([server?.stop(true)]);
-    await Promise.allSettled([gateway?.close()]);
-    await Promise.allSettled([runtime.dispose()]);
+    stopSignals.abort();
+    const surfaceClose = Promise.all([
+      Promise.resolve().then(() => server?.stop(true)),
+      Promise.resolve().then(() => gateway?.close()),
+    ]);
+    await runtime.dispose(() => surfaceClose);
   }
 }