@gmickel/gno 2.7.1 → 2.8.0

package/src/mcp/http-egress.ts

@@ -124,6 +124,21 @@ const collectionFromRef = (value: unknown): string | null => {
   return value.slice(0, slash).trim().toLowerCase() || null;
 };
 
+/**
+ * Tools whose results follow resolved graph edges. Links resolve across a
+ * link workspace, so a ref's own collection does not bound the result: the
+ * scope is the explicit collection argument (else every collection) plus the
+ * collection of every referenced document.
+ */
+const GRAPH_RESULT_TOOLS = new Set([
+  "gno_backlinks",
+  "gno_graph",
+  "gno_graph_neighbors",
+  "gno_graph_path",
+  "gno_graph_query",
+  "gno_impact",
+]);
+
 const requestedCollections = (
   params: unknown,
   collections: readonly Collection[]
@@ -134,17 +149,41 @@ const requestedCollections = (
 
   const names = new Set<string>();
   const direct = args.collection;
-  if (typeof direct === "string") names.add(direct.trim().toLowerCase());
-  if (record?.name === "gno_audit" && Array.isArray(args.collections)) {
+  // Handlers treat a blank collection as omitted, so it must not count as a
+  // scope here either (a graph call with one is authorized as unscoped).
+  if (typeof direct === "string" && direct.trim())
+    names.add(direct.trim().toLowerCase());
+  if (
+    (record?.name === "gno_audit" || record?.name === "gno_impact") &&
+    Array.isArray(args.collections)
+  ) {
     for (const value of args.collections) {
       if (typeof value !== "string") continue;
       const normalized = value.trim().toLowerCase();
       if (normalized) names.add(normalized);
     }
   }
+  const graphTool =
+    typeof record?.name === "string" && GRAPH_RESULT_TOOLS.has(record.name);
+  // A graph result spans every collection a link resolves into: without an
+  // explicit scope, authorize them all.
+  // `gno_similar` with crossCollection returns documents from every collection.
+  const crossCollectionSimilar =
+    record?.name === "gno_similar" && args.crossCollection === true;
+  if ((graphTool && names.size === 0) || crossCollectionSimilar) {
+    for (const { name } of collections) names.add(name);
+  }
+  // The referenced documents' own collections are always authorized too:
+  // graph tools serialize the target's metadata even when the result scope
+  // is narrower. A graph-tool ref whose collection cannot be read without
+  // the index (a docid) authorizes every collection (fail closed).
   for (const key of ["ref", "target", "from", "to", "root", "uri"]) {
-    const collection = collectionFromRef(args[key]);
+    const value = args[key];
+    const collection = collectionFromRef(value);
     if (collection) names.add(collection);
+    else if (graphTool && typeof value === "string" && value.trim()) {
+      for (const { name } of collections) names.add(name);
+    }
   }
   if (Array.isArray(args.refs)) {
     for (const ref of args.refs) {

package/src/mcp/tools/audit.ts

@@ -5,7 +5,11 @@ import { z } from "zod";
 import type { AuditCategory, AuditReport } from "../../core/audit";
 import type { ToolContext } from "../server";
 
-import { AUDIT_CATEGORIES } from "../../core/audit";
+import {
+  AUDIT_CATEGORIES,
+  AUDIT_MAX_FINDINGS_ALL,
+  AUDIT_MAX_FINDINGS_LIMIT,
+} from "../../core/audit";
 import { runWorkspaceAudit } from "../../core/audit-workspace";
 import { normalizeTag, validateTag } from "../../core/tags";
 import { normalizeCollectionName } from "../../core/validation";
@@ -19,7 +23,12 @@ export const auditInputSchema = z
     collections: z.array(z.string().min(1)).max(256).default([]),
     paths: z.array(z.string().min(1)).max(256).default([]),
     tags: z.array(z.string().min(1)).max(256).default([]),
-    maxFindings: z.number().int().min(1).max(1000).default(100),
+    maxFindings: z
+      .union([
+        z.number().int().min(1).max(AUDIT_MAX_FINDINGS_LIMIT),
+        z.literal(AUDIT_MAX_FINDINGS_ALL),
+      ])
+      .default(100),
     maxAgeDays: z.number().int().min(1).optional(),
     orphanRoots: z.array(z.string().min(1)).max(256).default([]),
     orphanIgnorePrefixes: z.array(z.string().min(1)).max(256).default([]),

package/src/mcp/tools/changes.ts

@@ -24,6 +24,7 @@ export const diffInputSchema = z.object({
 
 export const impactInputSchema = z.object({
   ref: z.string().trim().min(1).max(4096),
+  collections: z.array(z.string().trim().min(1)).max(256).optional(),
   maxDepth: z.number().int().min(1).max(6).default(3),
   maxNodes: z.number().int().min(1).max(1000).default(100),
   maxEdges: z.number().int().min(1).max(5000).default(250),

package/src/mcp/tools/links.ts

@@ -219,6 +219,8 @@ interface BacklinksInput {
 interface BacklinkOutput {
   sourceDocUri: string;
   sourceDocTitle?: string;
+  /** Collection of the linking document. */
+  sourceCollection?: string;
   linkText?: string;
   position: { startLine: number; startCol: number };
 }
@@ -308,6 +310,7 @@ export function handleBacklinks(
         (b: BacklinkRow) => ({
           sourceDocUri: b.sourceDocUri,
           ...(b.sourceDocTitle && { sourceDocTitle: b.sourceDocTitle }),
+          ...(b.sourceCollection && { sourceCollection: b.sourceCollection }),
           ...(b.linkText && { linkText: b.linkText }),
           position: { startLine: b.startLine, startCol: b.startCol },
         })

package/src/mcp/tools/sessions.ts

@@ -13,9 +13,11 @@
 
 import { z } from "zod";
 
+import type { Config } from "../../config/types";
 import type { ToolContext } from "../server";
 
 import { runAutomationProfile } from "../../sessions/automation";
+import { refreshServedConfig } from "../../sessions/config-refresh";
 import {
   formatAutomationRunText,
   formatImportReceiptText,
@@ -99,9 +101,36 @@ export const SESSIONS_IMPORT_MCP_ANNOTATIONS = {
   openWorldHint: false,
 } as const;
 
-function service(ctx: ToolContext): SessionsService {
-  return new SessionsService({
+/**
+ * The config file as it is now, adopted when the CLI changed it while this
+ * server runs (same binding checks and errors as the REST routes). Inside a
+ * request `ctx.config` stays the snapshot taken at its start, so callers use
+ * the returned config. An adoption moves the egress policy epoch; this
+ * request advances with it rather than voiding itself.
+ */
+function currentConfig(ctx: ToolContext): Promise<Config> {
+  return refreshServedConfig({
+    configPath: ctx.actualConfigPath,
+    indexName: ctx.indexName,
+    store: ctx.store,
     config: ctx.config,
+    setConfig: (config) => {
+      ctx.config = config;
+    },
+    invalidateEgressPolicy: async () => {
+      const invalidation = await ctx.invalidateEgressPolicy?.();
+      if (invalidation) {
+        ctx.advanceRequestAuthorizationEpoch?.(invalidation.policyEpoch);
+      }
+    },
+    markContentMutation: () => ctx.markContentMutation?.(),
+    markIndexMutation: () => ctx.markIndexMutation?.(),
+  });
+}
+
+async function service(ctx: ToolContext): Promise<SessionsService> {
+  return new SessionsService({
+    config: await currentConfig(ctx),
     configPath: ctx.actualConfigPath,
     indexName: ctx.indexName,
     store: ctx.store,
@@ -120,7 +149,7 @@ export function handleSessionsStatus(ctx: ToolContext): Promise<ToolResult> {
     "gno_sessions_status",
     async () => {
       try {
-        return await service(ctx).status();
+        return await (await service(ctx)).status();
       } catch (error) {
         return rethrowSessionsError(error);
       }
@@ -146,7 +175,7 @@ export function handleSessionsImport(
       try {
         // A child process keeps this server answering during a long import.
         receipt = await importInChildProcess({
-          config: ctx.config,
+          config: await currentConfig(ctx),
           configPath: ctx.actualConfigPath,
           indexName: ctx.indexName,
           sourceId: args.sourceId,

package/src/mcp/tools/status.ts

@@ -10,6 +10,7 @@ import type { ToolContext } from "../server";
 import { buildContentTypeBoostStatus } from "../../config/content-types";
 import { formatChunkingStatus } from "../../core/chunking-status";
 import { OWNER_CONFIG_PATH_FIELDS, withoutFields } from "../../core/host-paths";
+import { formatLinkWorkspace } from "../../core/link-workspace";
 import { formatVectorPartitionLines } from "../../core/vector-partition-status";
 import { resolveModelUri } from "../../llm/registry";
 import { createStandaloneResidentStatus } from "../../serve/resident-status";
@@ -55,6 +56,8 @@ function formatStatus(status: StatusView): string {
         `  ${c.name}: ${c.activeDocuments} docs, ${c.totalChunks} chunks` +
           (c.embeddedChunks > 0 ? `, ${c.embeddedChunks} embedded` : "")
       );
+      const workspace = formatLinkWorkspace(c);
+      if (workspace) lines.push(`    Link workspace: ${workspace}`);
     }
   }
 

package/src/pipeline/expansion.ts

@@ -15,6 +15,7 @@ import {
   assertInferenceActive,
   assertInferenceResult,
   inferenceOptions,
+  withInferencePage,
 } from "../llm/inference-scope";
 import { ok } from "../store/types";
 
@@ -23,7 +24,6 @@ import { ok } from "../store/types";
 // ─────────────────────────────────────────────────────────────────────────────
 
 const EXPANSION_PROMPT_VERSION = "v3";
-const DEFAULT_TIMEOUT_MS = 5000;
 // Non-greedy to avoid matching from first { to last } across multiple objects
 const JSON_EXTRACT_PATTERN = /\{[\s\S]*?\}/;
 const QUOTED_PHRASE_PATTERN = /"([^"]+)"/g;
@@ -457,8 +457,6 @@ export function parseExpansionOutput(
 export interface ExpansionOptions extends InferenceOptions {
   /** Language hint for prompt selection */
   lang?: string;
-  /** Timeout in milliseconds */
-  timeout?: number;
   /** Optional context that steers expansion for ambiguous queries */
   intent?: string;
   /** Optional bounded context size override for expansion generation */
@@ -467,59 +465,49 @@ export interface ExpansionOptions extends InferenceOptions {
 
 /**
  * Expand query using generation model.
- * Returns null on timeout or parse failure (graceful degradation).
+ * Returns null when generation fails or times out, or its output does not
+ * parse (graceful degradation).
  */
 export async function expandQuery(
   genPort: GenerationPort,
   query: string,
   options: ExpansionOptions = {}
 ): Promise<StoreResult<ExpansionResult | null>> {
-  const timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;
-
   // Build prompt
   const prompt = buildExpansionPrompt(query, options);
 
   assertInferenceActive(options);
   const operational = inferenceOptions(options);
-  const budget = new AbortController();
-  const expiresAt = performance.now() + timeout;
-  const timer = setTimeout(() => budget.abort(), timeout);
   try {
-    const result = await genPort.generate(
-      prompt,
-      {
-        temperature: 0,
-        seed: 42,
-        maxTokens: 512,
-        contextSize: options.contextSize,
-      },
-      {
-        ...operational,
-        signal: operational.signal
-          ? AbortSignal.any([operational.signal, budget.signal])
-          : budget.signal,
-      }
+    // Expansion is best effort but has no budget of its own: slow hardware
+    // (CPU generation takes 15-20s) and a cold model load still expand. A
+    // generation that hits models.inferenceTimeout fails only expansion.
+    const result = await withInferencePage(() =>
+      genPort.generate(
+        prompt,
+        {
+          temperature: 0,
+          seed: 42,
+          maxTokens: 512,
+          contextSize: options.contextSize,
+        },
+        operational
+      )
     );
-    // The independent expansion budget preserves its existing fallback. Caller
-    // cancellation/deadline always wins and cannot become a lexical success.
+    // Caller cancellation/deadline always wins and cannot become a lexical success.
     assertInferenceActive(options);
-    if (budget.signal.aborted || performance.now() >= expiresAt)
-      return ok(null);
+    if (!result) return ok(null);
     assertInferenceResult(result);
     if (!result.ok) return ok(null);
     return ok(parseExpansionOutput(result.value, query));
   } catch (cause) {
     assertInferenceActive(options);
-    if (budget.signal.aborted || performance.now() >= expiresAt)
-      return ok(null);
     if (
       cause instanceof Error &&
       ["AbortError", "TimeoutError"].includes(cause.name)
     )
       throw cause;
     return ok(null);
-  } finally {
-    clearTimeout(timer);
   }
 }
 

package/src/pipeline/graph-retrieval.ts

@@ -196,6 +196,7 @@ const loadGraphLinks = async (
   seedDocumentIds: number[],
   options: {
     collection?: string;
+    collections?: string[];
     includeSimilar?: boolean;
   }
 ): Promise<
@@ -205,6 +206,7 @@ const loadGraphLinks = async (
     const neighborsResult = await store.getGraphNeighborsForSeeds({
       seedDocumentIds,
       collection: options.collection,
+      collections: options.collections,
       limitEdges: GRAPH_EDGE_LIMIT,
     });
     if (!neighborsResult.ok) {
@@ -239,6 +241,11 @@ export async function expandGraphCandidates(
   fusedCandidates: FusionCandidate[],
   options: {
     collection?: string;
+    /**
+     * Graph allowlist (plural request scope). Neighbours must belong to one of
+     * these collections; defaults to `[collection]` when unset.
+     */
+    collections?: string[];
     includeSimilar?: boolean;
     eligibility?: DocumentEligibilityOptions;
     limit?: number;
@@ -353,8 +360,14 @@ export async function expandGraphCandidates(
   }
 
   const seedDocumentIds = [...seedByDocid.values()].map(({ doc }) => doc.id);
+  const graphAllowlist = options.collections
+    ? new Set(options.collections)
+    : options.collection
+      ? new Set([options.collection])
+      : undefined;
   const linksResult = await loadGraphLinks(store, seedDocumentIds, {
     collection: options.collection,
+    collections: options.collections,
     includeSimilar: options.includeSimilar,
   });
   if (!linksResult.ok) {
@@ -400,9 +413,15 @@ export async function expandGraphCandidates(
     return { candidates: [], meta };
   }
 
+  // A plural allowlist hydrates across its collections; scope is enforced on
+  // each neighbour's own collection below, never widened past the allowlist.
+  const plural = options.collections !== undefined;
   const docsResult = await store.getDocumentsByDocids(rankedNeighborDocids, {
-    eligibility: options.eligibility,
-    collection: options.collection,
+    eligibility:
+      plural && options.eligibility
+        ? { ...options.eligibility, collection: undefined }
+        : options.eligibility,
+    collection: plural ? undefined : options.collection,
     activeOnly: true,
   });
   if (!docsResult.ok) {
@@ -413,6 +432,7 @@ export async function expandGraphCandidates(
   const metadataFilteredDocs = docsResult.value.filter(
     (doc) =>
       doc.mirrorHash &&
+      (!graphAllowlist || graphAllowlist.has(doc.collection)) &&
       (options.relPathPrefix === undefined ||
         sourceRelPath(doc) === options.relPathPrefix ||
         sourceRelPath(doc).startsWith(`${options.relPathPrefix}/`)) &&

package/src/pipeline/hybrid.ts

@@ -520,7 +520,6 @@ async function searchHybridWithHydration(
       const expandResult = await expandQuery(expandPort, query, {
         // Use queryLanguage for prompt selection, NOT options.lang (retrieval filter)
         lang: queryLanguage,
-        timeout: pipelineConfig.expansionTimeout,
         intent: options.intent,
         contextSize: deps.config.models?.expandContextSize,
       });
@@ -804,6 +803,7 @@ async function searchHybridWithHydration(
     fusedCandidates,
     {
       collection: options.collection,
+      collections: options.graphCollections,
       includeSimilar: vectorAvailable,
       eligibility: vectorEligibility,
       limit,

package/src/pipeline/types.ts

@@ -191,6 +191,12 @@ export interface SearchOptions extends InferenceOptions {
   minScore?: number;
   /** Filter by collection */
   collection?: string;
+  /**
+   * Internal graph allowlist for a request partitioned into one retrieval per
+   * collection (Context Capsules, replay): graph neighbours may come from any
+   * of these collections, never from others. Defaults to `[collection]`.
+   */
+  graphCollections?: string[];
   /** Internal exact corpus scope used by deterministic retrieval replay. */
   retrievalScope?: {
     relPathPrefix?: string;
@@ -406,8 +412,6 @@ export type RerankedCandidate = FusionCandidate & {
 
 /** Search pipeline configuration */
 export interface PipelineConfig {
-  /** Expansion timeout in ms */
-  expansionTimeout: number;
   /** Max candidates to rerank */
   rerankCandidates: number;
   /** RRF configuration */
@@ -418,7 +422,6 @@ export interface PipelineConfig {
 
 /** Default pipeline configuration */
 export const DEFAULT_PIPELINE_CONFIG: PipelineConfig = {
-  expansionTimeout: 5000,
   rerankCandidates: 20,
   rrf: DEFAULT_RRF_CONFIG,
   blendingSchedule: DEFAULT_BLENDING_SCHEDULE,

package/src/serve/findings-pass.ts

@@ -30,7 +30,7 @@ import {
 } from "../core/findings-run-state";
 import { acquireCliWriteLease } from "../core/write-lease";
 
-/** Audit report cap; matches the audit schema ceiling. */
+/** Audit report cap for the daemon findings pass. */
 const FINDINGS_AUDIT_MAX_FINDINGS = 1000;
 const LEASE_HOLDER_COMMAND = "gno daemon (findings pass)";
 const CONTROL_CHARS = /\p{Cc}/gu;

package/src/serve/public/pages/GraphView.tsx

@@ -83,6 +83,8 @@ interface GraphLink {
     resolution:
       | "exact-title"
       | "exact-path"
+      | "exact-name"
+      | "tie-break"
       | "path-fallback"
       | "ambiguous-fallback"
       | "similarity";

package/src/serve/routes/changes.ts

@@ -79,7 +79,12 @@ export async function handleImpact(
 ): Promise<Response> {
   const ref = url.searchParams.get("ref")?.trim();
   if (!ref) return errorResponse("VALIDATION", "ref is required");
-  const input: KnowledgeImpactInput = {};
+  const collections = url.searchParams
+    .getAll("collection")
+    .map((value) => value.trim())
+    .filter(Boolean);
+  const input: KnowledgeImpactInput =
+    collections.length > 0 ? { collections } : {};
   for (const [queryName, inputName] of [
     ["maxDepth", "maxDepth"],
     ["maxNodes", "maxNodes"],

package/src/serve/routes/links.ts

@@ -34,6 +34,8 @@ export interface LinkResponse {
     resolvedUri?: string;
     /** Resolved target title (if found) */
     resolvedTitle?: string;
+    /** Collection of the resolved target (may differ from the source's) */
+    resolvedCollection?: string;
   }>;
   meta: {
     docid: string;
@@ -49,6 +51,8 @@ export interface BacklinkResponse {
     sourceDocid: string;
     sourceUri: string;
     sourceTitle?: string;
+    /** Collection of the linking document */
+    sourceCollection?: string;
     linkText?: string;
     startLine: number;
     startCol: number;
@@ -189,6 +193,11 @@ export async function handleDocLinks(
       targetRefNorm: l.targetRefNorm,
       targetCollection: l.targetCollection || doc.collection,
       linkType: l.linkType,
+      source: {
+        collection: doc.collection,
+        relPath: doc.relPath,
+        explicit: Boolean(l.targetCollection),
+      },
     }))
   );
   const resolutionAvailable = resolvedResult.ok;
@@ -217,6 +226,9 @@ export async function handleDocLinks(
             resolvedDocid: resolved.docid,
             resolvedUri: resolved.uri,
             resolvedTitle: resolved.title ?? undefined,
+            ...(resolved.collection && {
+              resolvedCollection: resolved.collection,
+            }),
           }),
         }),
       };
@@ -273,6 +285,7 @@ export async function handleDocBacklinks(
     backlinks: backlinks.map((b) => ({
       sourceDocid: b.sourceDocid,
       sourceUri: b.sourceDocUri,
+      ...(b.sourceCollection && { sourceCollection: b.sourceCollection }),
       ...(b.sourceDocTitle && { sourceTitle: b.sourceDocTitle }),
       ...(b.linkText && { linkText: b.linkText }),
       startLine: b.startLine,

package/src/serve/routes/sessions.ts

@@ -16,7 +16,6 @@ import type { SqliteAdapter } from "../../store/sqlite/adapter";
 import type { RequestPeerServer } from "../request-locality";
 import type { ContextHolder } from "./api";
 
-import { getIndexDbPath } from "../../app/constants";
 import { getConfigPaths, loadConfig } from "../../config";
 import { withContentTypeRules } from "../../ingestion";
 import {
@@ -28,8 +27,14 @@ import {
   runAutomationProfile,
   setAutomationProfile,
 } from "../../sessions/automation";
-import { assertSessionBinding } from "../../sessions/binding";
 import { SessionSourceSchema, watchedCollections } from "../../sessions/config";
+import {
+  adoptServedConfig,
+  assertInstanceBinding as assertConfigBinding,
+  readInstanceConfig,
+  refreshServedConfig,
+  type ServedSessionsConfig,
+} from "../../sessions/config-refresh";
 import { importInChildProcess } from "../../sessions/import-child";
 import { SessionsService } from "../../sessions/service";
 import {
@@ -186,18 +191,11 @@ function instanceIdentity(ctxHolder: ContextHolder): {
 }
 
 /** Refuse an archive config opened against a different index (and vice versa). */
-async function assertInstanceBinding(
+function assertInstanceBinding(
   ctxHolder: ContextHolder,
   config: Config = ctxHolder.config
 ): Promise<void> {
-  const { configPath, indexName } = instanceIdentity(ctxHolder);
-  if (!config.sessions) return;
-  await assertSessionBinding({
-    config,
-    configPath,
-    indexName,
-    dbPath: getIndexDbPath(indexName),
-  });
+  return assertConfigBinding(instanceIdentity(ctxHolder), config);
 }
 
 /** Service over the instance's own config/index pair, binding checked. */
@@ -215,55 +213,47 @@ async function archiveService(
   });
 }
 
+/** This instance's served config, as the shared config refresh sees it. */
+function servedConfig(
+  ctxHolder: ContextHolder,
+  store: SqliteAdapter
+): ServedSessionsConfig {
+  return {
+    ...instanceIdentity(ctxHolder),
+    store,
+    config: ctxHolder.config,
+    setConfig: (config) => {
+      ctxHolder.config = config;
+      ctxHolder.current = { ...ctxHolder.current, config };
+      ctxHolder.watchService?.updateCollections(
+        watchedCollections(config),
+        withContentTypeRules({}, config)
+      );
+    },
+    invalidateEgressPolicy: async () => {
+      await ctxHolder.invalidateEgressPolicy?.();
+    },
+    markContentMutation: () => ctxHolder.markContentMutation?.(),
+    markIndexMutation: () => ctxHolder.markIndexMutation?.(),
+  };
+}
+
 /**
  * Adopt a config the sessions service already persisted: project collections
  * and contexts into the open store, swap the in-memory context, and refresh
- * the watcher, egress policy and mutation generations (same sequence as the
- * config-sync route helpers).
+ * the watcher, egress policy and mutation generations.
  */
-async function adoptConfig(
+function adoptConfig(
   ctxHolder: ContextHolder,
   store: SqliteAdapter,
   config: Config
 ): Promise<void> {
-  const collections = await store.syncCollections(config.collections);
-  if (!collections.ok) {
-    throw new Error(
-      `Config saved but collection sync failed: ${collections.error.message}`
-    );
-  }
-  const contexts = await store.syncContexts(config.contexts ?? []);
-  if (!contexts.ok) {
-    throw new Error(
-      `Config saved but context sync failed: ${contexts.error.message}`
-    );
-  }
-  ctxHolder.config = config;
-  ctxHolder.current = { ...ctxHolder.current, config };
-  ctxHolder.watchService?.updateCollections(
-    watchedCollections(config),
-    withContentTypeRules({}, config)
-  );
-  await ctxHolder.invalidateEgressPolicy?.();
-  ctxHolder.markContentMutation?.();
-  ctxHolder.markIndexMutation?.();
+  return adoptServedConfig(servedConfig(ctxHolder, store), config);
 }
 
-/**
- * Read this instance's config file, binding checked: unreadable is an error,
- * never served stale, and a config rebound to another index is refused
- * before it can touch this one.
- */
-async function readConfigFile(ctxHolder: ContextHolder): Promise<Config> {
-  const loaded = await loadConfig(instanceIdentity(ctxHolder).configPath);
-  if (!loaded.ok) {
-    throw new SessionsError(
-      "SESSIONS_RUNTIME_FAILURE",
-      "The server could not read its config file; fix the file (gno doctor shows the error) and reload."
-    );
-  }
-  await assertInstanceBinding(ctxHolder, loaded.value);
-  return loaded.value;
+/** Read this instance's config file, binding checked (see readInstanceConfig). */
+function readConfigFile(ctxHolder: ContextHolder): Promise<Config> {
+  return readInstanceConfig(instanceIdentity(ctxHolder));
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -282,9 +272,7 @@ export async function refreshSessionsConfig(
   store: SqliteAdapter
 ): Promise<Response | null> {
   try {
-    const config = await readConfigFile(ctxHolder);
-    if (Bun.deepEquals(config, ctxHolder.config)) return null;
-    await adoptConfig(ctxHolder, store, config);
+    await refreshServedConfig(servedConfig(ctxHolder, store));
     return null;
   } catch (error) {
     return sessionsErrorResponse(error);