ltcai 12.2.0 → 12.2.1

package/README.md

@@ -12,100 +12,97 @@
 [![CD Status](https://github.com/TaeSooPark-PTS/LatticeAI/actions/workflows/publish.yml/badge.svg)](https://github.com/TaeSooPark-PTS/LatticeAI/actions/workflows/publish.yml)
 [![License](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 
-![v12.2.0 Living Brain walkthrough](output/release/v12.2.0/gifs/v12.2.0-living-brain-walkthrough.gif)
+![v12.2.1 Living Brain walkthrough](output/release/v12.2.1/gifs/v12.2.1-living-brain-walkthrough.gif)
 
-Chat, files, folders, notes, and web pages all flow into one durable knowledge
-graph on your computer. The default is local. Cloud is optional — an
-OAuth-authenticated CLI (`agy` / `grok`) or an API key you configure — and
-nothing leaves your machine without explicit consent.
+Lattice AI is a Digital Brain that lives on your computer. Chat, files,
+folders, notes, and web pages all land in one knowledge graph you own.
+The default is local. Cloud is optional, and nothing leaves the machine
+without your consent.
 
 대화·파일·폴더·웹페이지가 전부 내 컴퓨터 안의 지식 그래프로 쌓입니다.
-기본은 로컬이고, 클라우드는 선택입니다 (OAuth CLI 지원).
+기본은 로컬이고, 클라우드는 선택입니다.
 
-## What You Can Do
-
-| | |
-| --- | --- |
-| **See your Brain's story in time** — a growth curve, an activity heatmap, and each day's story, rewindable to any past moment ![Brain Chronicle](output/release/v12.2.0/screenshots/13-chronicle.png) | **Chat with a Brain that remembers** — every conversation grows durable, source-linked memory ![Brain Chat](output/release/v12.2.0/screenshots/04-brain-chat-home.png) |
-| **See how knowledge connects** — a real relationship graph, not a file list ![Memory Graph](output/release/v12.2.0/screenshots/05-memory-graph.png) | **Capture anything** — files, whole folders, notes, screenshots, web pages ![Capture](output/release/v12.2.0/screenshots/06-capture.png) |
-| **Automate with review** — agent changes become proposals you approve first ![Review Center](output/release/v12.2.0/screenshots/12-review-center.png) | **Pick a model in one click** — recommended local models for your hardware ![Recommended Models](output/release/v12.2.0/screenshots/02-recommended-models.png) |
-| **Watch a file become memory** — three named steps, not a pipeline diagram ![Material to memory](output/release/v12.2.0/screenshots/11-knowledge-journey.png) | **Say how much it may do alone** — one dial in plain words; dangerous actions stay blocked either way ![Settings](output/release/v12.2.0/screenshots/08-system.png) |
-
-## Why Lattice AI
-
-- **Own your memory** — knowledge lives in a local SQLite Brain you can back up,
-  export, inspect, and restore (`.latticebrain` encrypted archive).
-- **Model-independent** — switch between local MLX models and cloud models
-  without rebuilding context from zero.
-- **Honest by design** — the Brain tells you when retrieval context is limited,
-  when captured pages extracted poorly, and when the vector index is catching up.
-- **Safe automation** — automations are consent-first drafts; edits to existing
-  content always pass through a reviewable proposal with a diff.
-- **Runs on the model your machine can hold** — the loop measures what a model
-  can actually produce and adapts: a model too small to emit a tool call is
-  walked through numbered choices instead, with the same permission gates,
-  snapshots and sanitizers as every other profile.
-
-매번 AI에게 프로젝트 맥락을 다시 설명하고 있다면, 지식이 여러 서비스에 흩어져
-있다면, 그 기억을 특정 회사가 아니라 내가 소유하고 싶다면 — Lattice AI가 그
-브레인입니다.
-
-## Quick Start
+## Install
 
 ```bash
 pip install ltcai        # or: npm install -g ltcai
 LTCAI                    # then open http://127.0.0.1:4825/app
 ```
 
-Apple Silicon local models: `pip install "ltcai[local]"`. Desktop app (Tauri)
-ships as a dmg on each [GitHub Release](https://github.com/TaeSooPark-PTS/LatticeAI/releases).
+- Apple Silicon local models: `pip install "ltcai[local]"`
+- Mac app: the `.dmg` on each [GitHub Release](https://github.com/TaeSooPark-PTS/LatticeAI/releases)
+- Editor: the [VS Code / Cursor / Open VSX](https://marketplace.visualstudio.com/items?itemName=parktaesoo.ltcai) extension
 
-First-run flow — wake the Brain, pick the owner, load a recommended model:
+## First five minutes
+
+1. Open the app and sign in as the owner.
+2. Pick a recommended local model for this computer.
+3. Drop a folder, a file, or a note into Capture.
+4. Ask the Brain a question in your own words.
 
 | | | |
 | --- | --- | --- |
-| ![Login](output/release/v12.2.0/screenshots/01-login.png) | ![Model install](output/release/v12.2.0/screenshots/03-install-load-progress.png) | ![Model library](output/release/v12.2.0/screenshots/07-model-library.png) |
+| ![Login](output/release/v12.2.1/screenshots/01-login.png) | ![Model install](output/release/v12.2.1/screenshots/03-install-load-progress.png) | ![Model library](output/release/v12.2.1/screenshots/07-model-library.png) |
+
+Screenshot index:
+[output/release/v12.2.1/SCREENSHOT_INDEX.md](output/release/v12.2.1/SCREENSHOT_INDEX.md)
 
-Screenshot index and capture notes:
-[output/release/v12.2.0/SCREENSHOT_INDEX.md](output/release/v12.2.0/SCREENSHOT_INDEX.md)
+## What you can do
+
+| | |
+| --- | --- |
+| **See your Brain's story in time** — a growth curve, an activity heatmap, and each day's story ![Brain Chronicle](output/release/v12.2.1/screenshots/13-chronicle.png) | **Chat with a Brain that remembers** — every conversation grows durable, source-linked memory ![Brain Chat](output/release/v12.2.1/screenshots/04-brain-chat-home.png) |
+| **See how knowledge connects** — a real relationship graph, not a file list ![Memory Graph](output/release/v12.2.1/screenshots/05-memory-graph.png) | **Capture anything** — files, whole folders, notes, screenshots, web pages ![Capture](output/release/v12.2.1/screenshots/06-capture.png) |
+| **Automate with review** — agent changes become proposals you approve first ![Review Center](output/release/v12.2.1/screenshots/12-review-center.png) | **Pick a model in one click** — recommended local models for your hardware ![Recommended Models](output/release/v12.2.1/screenshots/02-recommended-models.png) |
+| **Watch a file become memory** — three named steps, not a pipeline diagram ![Material to memory](output/release/v12.2.1/screenshots/11-knowledge-journey.png) | **Say how much it may do alone** — one dial in plain words ![Settings](output/release/v12.2.1/screenshots/08-system.png) |
+
+## Why this is yours
+
+- **The memory stays.** Knowledge lives in a local SQLite Brain you can back up, export, inspect, and restore (`.latticebrain`).
+- **The model is replaceable.** Switch local MLX and optional cloud without rebuilding context from zero.
+- **It says when it does not know.** Thin retrieval, a poor page extract, or hash-only search is named, not dressed as meaning.
+- **Edits wait for you.** New files can land with little friction. Changing or deleting existing files becomes a proposal with a diff.
+- **Small models can still act.** A 2B-class local model can call tools and skills; a model too small to emit JSON is walked through numbered choices.
+
+매번 AI에게 프로젝트 맥락을 다시 설명하고 있다면, 지식이 여러 서비스에 흩어져
+있다면, 그 기억을 특정 회사가 아니라 내가 소유하고 싶다면 — Lattice AI가 그
+브레인입니다.
 
 ## Current Release
 
-The current release is **12.2.0 — Small Voice**:
-
-12.1.0 made remembering faster. This release makes a small local model
-able to *act*: 2B-class models can call MCP tools and skills without
-emitting perfect JSON, and the home screen names those actions in
-plain words. The door is still **422 operations / 41 families** over a
-**20-route worker**. Cloud is still optional and the default is still local.
-
-- **Small models speak tools.** `name`/`arguments`, Qwen XML, and
-  `Action: mcp.grep` parse as the same call. Compact lists stay at nine
-  rows. A skill's "use when" line is consulted even if the user never
-  typed `skill.`. A quoted search term fills a missing `pattern`.
-- **The composer offers the work.** Folder search, read-and-summarize,
-  memory, and skill review are chips under the box. Settings says the
-  same in one card. MCP/skill steps in the timeline get a plain prefix.
-- **12.1.0 Fast Path is unchanged.** Folder overlap, one embed body,
-  rebuild outside the write lock, auto-HNSW at 512.
-
-What this release does not close — small-model *content* quality, the
-mock-only `api_key` path, hash embeddings as the no-download fallback,
-watch never deleting on its own, the ad-hoc-signed dmg — is listed in
-[RELEASE_NOTES_v12.2.0.md](RELEASE_NOTES_v12.2.0.md).
-
-Expected artifacts for 12.2.0 release must use exact filenames:
-
-- `dist/ltcai-12.2.0-py3-none-any.whl`
-- `dist/ltcai-12.2.0.tar.gz`
-- `ltcai-12.2.0.tgz`
-- `dist/ltcai-12.2.0.vsix`
-- `src-tauri/target/release/bundle/dmg/Lattice AI_12.2.0_aarch64.dmg`
+The current release is **12.2.1 — True Count**:
+
+Search, skip, watch, and small-model answers now count what is actually
+there instead of dumping, rehashing, or pretending. The door is still
+**422 operations / 41 families** over a **20-route worker**. Cloud is
+still optional and the default is still local.
+
+- **Search does not dump the Brain.** A warm HNSW query is `COUNT(*)`
+  then, if needed, the missing vectors only. Writes stay on one
+  `GraphWriter`.
+- **A touch is a stamp, not a re-ingest.** Same bytes with a new mtime
+  restamp provenance so the next scan skips by stamp.
+- **A vanished watched file leaves the graph.** Disk is never deleted.
+- **A thin summary is filled from the file that was read**, or held for
+  review — never marked done with empty words.
+- **MCP tools stay in the compact nine-row list.** `api_key` cloud
+  verifies with a live `GET /models` (no billed completion). Hash
+  search is named as hash, with a path to a meaning model.
+
+Release notes live in [docs/releases/](docs/releases/). This version:
+[docs/releases/RELEASE_NOTES_v12.2.1.md](docs/releases/RELEASE_NOTES_v12.2.1.md).
+Guide: [RELEASE.md](RELEASE.md) · History: [docs/CHANGELOG.md](docs/CHANGELOG.md).
+
+Expected artifacts for 12.2.1 must use exact filenames:
+
+- `dist/ltcai-12.2.1-py3-none-any.whl`
+- `dist/ltcai-12.2.1.tar.gz`
+- `ltcai-12.2.1.tgz`
+- `dist/ltcai-12.2.1.vsix`
+- `src-tauri/target/release/bundle/dmg/Lattice AI_12.2.1_aarch64.dmg`
 
 Do not use wildcard artifact uploads. Package registry publishing remains owner-run.
 
-Release notes: [RELEASE.md](RELEASE.md) · Full history: [docs/CHANGELOG.md](docs/CHANGELOG.md)
-
 ## Architecture At A Glance
 
 One Rust server on localhost is the source of truth: `lattice-host` answers
@@ -132,8 +129,9 @@ Validation via `npm run lint`, `npm run test:unit`, `npm run test:visual`.
   migration tooling is not part of the 12.1.0 worker.
 - Docker, model downloads, cloud model calls, Brain Network, and update checks
   require explicit user action. Cloud is optional: `cli_oauth` (`agy` /
-  `grok`) was live-checked at zero billing; the `api_key` path is
-  mock-verified only.
+  `grok`) was live-checked at zero billing; the `api_key` path probes
+  `GET /models` with the key and fail-closes if the provider is
+  unreachable — it does not run a billed completion to verify.
 - **The Telegram bridge was removed in 11.6.0** — it lived in the platform code
   that became the AI worker. **SSO/OIDC login and callback flows were removed
   with it**; the configuration surface remains and password login is native.
@@ -153,16 +151,18 @@ Validation via `npm run lint`, `npm run test:unit`, `npm run test:visual`.
   100%-lines-and-branches gate was removed). The enforced claim is the
   floor, not whatever a given run measures.
 - **Small-model *content* quality is gated honestly.** With the `guided`
-  profile even a 0.5B model writes the requested file and reaches DONE;
-  a weak summary still fails the critic and the run ends
-  FAILED/NEEDS_REVIEW rather than claiming success.
+  profile even a 0.5B model writes the requested file and reaches DONE.
+  A requested summary is filled from the file that was actually read;
+  if those words are still missing the run is held for review, not
+  marked done.
 - Vector search env still defaults to `brute` — exact and byte-compatible
   on a small Brain. At 512+ vectors with a bound worker sidecar it tries
   `hnsw+rescore` first and falls back to the exact scan if the sidecar
   cannot answer. `LATTICEAI_VECTOR_INDEX=hnsw` is still the explicit
   opt-in.
-- Watch never deletes on its own: a vanished file is reported, and
-  cleanup runs only through the confirmed folder-prune flow.
+- Watch prune removes vanished files from the **graph**, never from
+  disk. A one-shot folder ingest still reports vanished files and
+  waits for the confirmed prune door.
 - The macOS dmg is ad-hoc signed — effectively unsigned — so first launch
   needs the usual Gatekeeper step.
 - Pointer-control tools execute in the worker and are installed with
@@ -170,18 +170,19 @@ Validation via `npm run lint`, `npm run test:unit`, `npm run test:visual`.
   pending-only, no Self-Model refiner, `delete_node` leaving `PART_OF`,
   review events silent without an owner, KG-api ingest text-only, two
   store cycles per review mutation) are listed with their reasons in
-  [RELEASE_NOTES_v12.2.0.md](RELEASE_NOTES_v12.2.0.md) and prioritized in
-  [docs/ROADMAP.md](docs/ROADMAP.md).
+  [docs/releases/RELEASE_NOTES_v12.2.1.md](docs/releases/RELEASE_NOTES_v12.2.1.md)
+  and prioritized in [docs/ROADMAP.md](docs/ROADMAP.md).
 
 ## Release History
 
 Public history starts at 11.0.0. 11.6.0 rebuilt the product server in Rust and
 reduced the Python package to an AI worker, so a 10.x or 9.x install is a
 different program; `SECURITY.md` supports only 11.x, and this table states the
-same boundary. Earlier notes stay in the tree as `RELEASE_NOTES_v*.md` files.
+same boundary. Earlier notes live in [docs/releases/](docs/releases/).
 
 | Version | Theme |
 | --- | --- |
+| 12.2.1 | True Count |
 | 12.2.0 | Small Voice |
 | 12.1.0 | Fast Path |
 | 12.0.0 | Open House |
@@ -199,4 +200,4 @@ same boundary. Earlier notes stay in the tree as `RELEASE_NOTES_v*.md` files.
 | 11.0.1 | Both Branches |
 | 11.0.0 | Full Measure |
 
-Per-release details: [RELEASE_NOTES.md](RELEASE_NOTES.md)
+Per-release details: [RELEASE_NOTES.md](RELEASE_NOTES.md) · folder: [docs/releases/](docs/releases/)

package/docs/CHANGELOG.md

@@ -4,6 +4,32 @@ The top entry is either the current unreleased main-branch work or the current
 release line. Older entries are historical and may describe behavior as it
 existed at that release.
 
+## [12.2.1] - 2026-08-29 — True Count
+
+### Added
+- HNSW sidecar COUNT+delta load: a warm query never dumps `vector_embeddings`;
+  growth fetches missing ids only and appends.
+- Skip-by-hash restamps size/mtime on the existing provenance row via
+  `GraphWriter`.
+- Watch prune: a vanished watched file is removed from the graph
+  (`delete_document_tree`, confirm=true). Disk is never deleted.
+- `complete_a_summary`: a thin "I summarized" answer is filled from the
+  `read_file` / `mcp.read_file` result already on the transcript.
+- Compact catalog CORE now keeps `mcp.grep`, `mcp.list_dir`, `mcp.read_file`,
+  `mcp.knowledge_search` through the nine-row cap.
+- `api_key` cloud `GET /models` probe (no completion). Unreachable keys
+  fail-close status.
+- First-run and library copy name hash search as hash, with a path to a
+  meaning model.
+
+### Changed
+- Per-version `RELEASE_NOTES_v*.md` files live in `docs/releases/`.
+- README is user-first: install, first five minutes, then the release.
+
+### Fixed
+- Loaded HNSW graphs can append a delta instead of rebuilding from the
+  incoming set alone (which wiped live labels).
+
 ## [12.2.0] - 2026-08-29 — Small Voice
 
 ### Added
@@ -210,7 +236,7 @@ existed at that release.
 - DMG는 ad-hoc 서명(미서명)이다.
 - 11.8.0이 열어 둔 항목(커버리지 바닥 라인 90, 멀티모달 이미지/비디오
   HTTP 문 없음, 11.7.0 leftover)은 그대로다. 전문은
-  [RELEASE_NOTES_v11.9.0.md](../RELEASE_NOTES_v11.9.0.md).
+  [RELEASE_NOTES_v11.9.0.md](releases/RELEASE_NOTES_v11.9.0.md).
 
 ## [11.8.0] - 2026-08-16 — Travel Light
 
@@ -292,7 +318,7 @@ existed at that release.
 - `tests/visual/mock_server`가 고아 mock 라우트 하나를 아직 서빙합니다
   (현재 증거가 해시로 묶여 있어 다음 캡처 사이클에 정리).
 - 11.7.0이 열어 둔 항목은 그대로입니다. 전문은
-  [RELEASE_NOTES_v11.8.0.md](../RELEASE_NOTES_v11.8.0.md).
+  [RELEASE_NOTES_v11.8.0.md](releases/RELEASE_NOTES_v11.8.0.md).
 
 ## [11.7.0] - 2026-08-15 — Clean Sweep
 
@@ -336,7 +362,7 @@ existed at that release.
   `delete_node`는 `PART_OF`를 남김. owner 없는 리뷰 이벤트는 침묵.
   KG-api ingest는 텍스트 전용. 리뷰 변이 = 스토어 사이클 2회.
   snooze 422 detail은 영문 리터럴. 전문은
-  [RELEASE_NOTES_v11.7.0.md](../RELEASE_NOTES_v11.7.0.md).
+  [RELEASE_NOTES_v11.7.0.md](releases/RELEASE_NOTES_v11.7.0.md).
 
 ## [11.6.0] - 2026-08-15 — One Door
 
@@ -411,7 +437,7 @@ existed at that release.
   비어 있음 · 리뷰 스누즈 offset-aware 500 · 제안 이중 거절 500),
   업로드 추출 UTF-8 전용, 공급 벡터 1차 노드 한정, 네이티브 도구의 사용자
   훅 미발화, `sanitize_write_content` 미적용, 워커 원점으로 남은 seam 호출
-  3건. 전문은 [RELEASE_NOTES_v11.6.0.md](../RELEASE_NOTES_v11.6.0.md).
+  3건. 전문은 [RELEASE_NOTES_v11.6.0.md](releases/RELEASE_NOTES_v11.6.0.md).
 
 ## [11.5.2] - 2026-08-12 — Tight Ship
 

package/docs/COMMUNITY_AND_PLUGINS.md

@@ -1,6 +1,6 @@
 # Community And Plugins
 
-Current release: **12.2.0 — Small Voice**.
+Current release: **12.2.1 — True Count**.
 
 LatticeAI defines the path from a strong local-first framework (8.4.0
 action-aware baseline, 8.5.0 registry+DI hardening, 8.6.0 capture/navigation

package/docs/DEVELOPMENT.md

@@ -3,7 +3,7 @@
 > **Status: canonical** — current contributor guidance, kept in sync with the
 > current release.
 
-Current release: **12.2.0 — Small Voice**.
+Current release: **12.2.1 — True Count**.
 
 This document is the contributor onboarding path: how to boot the tree, where
 a change belongs, which gates will go red, and the house rules that keep the
@@ -80,7 +80,7 @@ worker interpreter with `LTCAI_PYTHON` when both exist.
 `rust/target/release/lattice-host`, then `rust/target/debug/lattice-host`. If
 none exist it runs `cargo build -p lattice-host` (debug). A stale
 `rust/target/release/lattice-host` wins over a current debug binary — pin or
-rebuild (`cargo build -p lattice-host --release`) if `-V` is not 12.2.0.
+rebuild (`cargo build -p lattice-host --release`) if `-V` is not 12.2.1.
 
 Do not run `npm start` and `npm run dev` on the same port. The worker
 entrypoint defaults to `LATTICEAI_PORT` or **4825**, the same port as the
@@ -237,7 +237,7 @@ in `rust/`.
 Markdown) and `scripts/check_doc_status.mjs` (every relative link under the
 root canonical docs and `docs/**`). A red line is a broken relative path —
 fix the href or put the file where the href says. Canonical docs (this one
-included) must carry `Current release: **12.2.0 — …**` matching
+included) must carry `Current release: **12.2.1 — …**` matching
 `package.json`; do not bump that marker here ahead of the release lane.
 `npm run docs:check-current` is the release-set version pin
 ([`scripts/check_current_release_docs.mjs`](../scripts/check_current_release_docs.mjs)).
@@ -248,7 +248,7 @@ changelog entries that mention old versions stay.
 ### Release-evidence binding
 
 `scripts/check_release_evidence_bound.mjs` (lint member 9) checks that
-`output/release/v12.2.0/SCREENSHOT_INDEX.md` still names the live
+`output/release/v12.2.1/SCREENSHOT_INDEX.md` still names the live
 `static/app/asset-manifest.json` digest and the visual mock-server
 fingerprint. It exists so a later `npm run build:assets` cannot ship
 screenshots of an older UI, and so a mock-server edit cannot leave the
@@ -317,19 +317,19 @@ For user-facing, API, runtime, release, or packaging changes, check:
   appears
 
 The release-docs lane owns README / ARCHITECTURE / FEATURE_STATUS version
-bumps. Do not move this file's `Current release` marker off 12.2.0 ahead of
+bumps. Do not move this file's `Current release` marker off 12.2.1 ahead of
 that lane.
 
 Release/publish examples must use exact target-version filenames. Do not
 document wildcard artifact upload commands.
 
-For 12.2.0 release work, exact artifacts are:
+For 12.2.1 release work, exact artifacts are:
 
-- `dist/ltcai-12.2.0-py3-none-any.whl`
-- `dist/ltcai-12.2.0.tar.gz`
-- `ltcai-12.2.0.tgz`
-- `dist/ltcai-12.2.0.vsix`
-- `src-tauri/target/release/bundle/dmg/Lattice AI_12.2.0_aarch64.dmg`
+- `dist/ltcai-12.2.1-py3-none-any.whl`
+- `dist/ltcai-12.2.1.tar.gz`
+- `ltcai-12.2.1.tgz`
+- `dist/ltcai-12.2.1.vsix`
+- `src-tauri/target/release/bundle/dmg/Lattice AI_12.2.1_aarch64.dmg`
 
 The dmg is ad-hoc signed (effectively unsigned); `npm run release:validate`
 checks the names and presence, not a Developer ID signature.

package/docs/ONBOARDING.md

@@ -1,6 +1,6 @@
 # Lattice AI Onboarding
 
-Current release: **12.2.0 — Small Voice**.
+Current release: **12.2.1 — True Count**.
 
 The first-run goal is a five-minute path from "I opened the app" to "my Brain
 has a source, a question, and proof." This page is the product contract behind

package/docs/OPERATIONS.md

@@ -1,4 +1,4 @@
-# Lattice AI — Operations Guide (v12.2.0)
+# Lattice AI — Operations Guide (v12.2.1)
 
 > **Status: canonical** — kept in sync with the current release. Storage layout
 > below reflects the SQLite live Brain store and workspace scoping, not the

package/docs/ROADMAP.md

@@ -3,7 +3,7 @@
 > **Status: reference** — point-in-time inventory, redated at v12.0.0. Not a
 > canonical current-release document; version gates do not bind it.
 
-As of **2026-08-29**, against the 12.1.0 — Fast Path tree. The rows below
+As of **2026-08-29**, against the 12.2.1 — True Count tree. The rows below
 were gathered against 11.9.0 and re-checked when 12.0.0 shipped; what that
 release closed is marked closed rather than deleted, so the ledger still
 shows what was owed.
@@ -17,8 +17,8 @@ the contributor path is [DEVELOPMENT.md](DEVELOPMENT.md). This page is the
 honest leftover list, gathered from
 [FEATURE_STATUS.md](../FEATURE_STATUS.md) Known Limitations and the §정직한
 고지 sections of
-[RELEASE_NOTES_v11.9.0.md](../RELEASE_NOTES_v11.9.0.md) and
-[RELEASE_NOTES_v12.0.0.md](../RELEASE_NOTES_v12.0.0.md).
+[releases/RELEASE_NOTES_v11.9.0.md](releases/RELEASE_NOTES_v11.9.0.md) and
+[releases/RELEASE_NOTES_v12.0.0.md](releases/RELEASE_NOTES_v12.0.0.md).
 
 Four items those ledgers named **closed in 12.0.0**. They are kept below so
 they are not re-opened as work. Everything else is still open.
@@ -43,18 +43,18 @@ rather than being deleted: the small-model harness (P1) and the HNSW index
 
 | 무엇 | 왜 남았나 | 난이도 | 우선순위 | 제안 경로 |
 | --- | --- | --- | --- | --- |
-| **Small-model agent-run content quality** | **Half closed in 12.0.0.** The mechanical half is done: the `guided` profile stops asking for JSON, the dial is chosen by a measured probe, a run that produces nothing demotes itself downward mid-run, and a 0.5B model reached `DONE` in 3.9s with a real file. The half still open is the *writing* — a weak summary fails the critic and the run ends `FAILED` / `NEEDS_REVIEW`. The cross-model matrix is improving from 11 of 18. | L | **P1** — still the voice the product ships on 8GB, and still the reason a first run can end in a review state. | Keep measuring with the loop's own parser, not a second harness. New answers go under new fixture keys (`agent_loop` `*_extended`); do not rewrite frozen rows. The remaining lever is content, not format: better plan→content prompting and a critic that says *what* was thin, per-model hacks still forbidden. |
-| **Real-embedding default rollout** | **Narrowed in 12.0.0, not closed.** Auto-detection now adopts a real downloaded embedding model when one is present, the hash model is labelled `fallback` rather than presented as semantic, and vector identity is filtered by `(model, dim)` so two spaces cannot mix. What is still true: on a machine that has downloaded nothing, the default remains `lattice-local-hash-v1` (blake2 bag-of-features), and "semantic" recall is then a hash of tokens. | M | **P1** — recall is the product. Hash as a labelled fallback is fine; hash as the silent default is not. | Make the first-run flow offer the embedding model the way it offers a chat model, and keep the switch honest: drain the backlog through `lattice-jobs` so a change of embedder is a reindex, and report `stale_embedder` until the queue is empty. |
+| **Small-model agent-run content quality** | **Narrowed in 12.2.1.** Mechanical half closed in 12.0.0 (`guided`, measured probe). 12.2.1 fills a thin summary from the `read_file` / `mcp.read_file` result already on the transcript; missing evidence is `NEEDS_REVIEW`, not a false DONE. Remaining: a 2B that never read the file, and writing that is fluent but wrong. | L | **P1** — still the voice on 8GB. | Keep measuring with the loop's own parser. Do not add a per-model branch. |
+| **Real-embedding default rollout** | **Narrowed again in 12.2.1.** First-run and the library name hash search as hash and point at a meaning model. Auto-detection still adopts a real downloaded embedder when one is present. The no-download default is still `lattice-local-hash-v1`. | M | **P1** — recall is the product. | Offer an embedding model in first-run the way a chat model is offered. Drain through `lattice-jobs` on switch. No second embedder in `lattice-core`. |
 | **Worker-side batch embed** | **Closed in 12.1.0 on the ingest-time door**: one `/worker/embed` body is the document vector followed by every chunk, extract runs beside it, and `write_vectors_with` files those vectors. The drain planner stays the backlog path. Folder/watch overlap up to four files. What remains for a real-embed default is auto-detection on first run, not a second embedder. | M | **P1 → closed for the ingest door; the real-embed default row above is still open.** | Keep. Do not open a second embedder inside `lattice-core`. |
 
 ## P2 — real, but the product still works without them
 
 | 무엇 | 왜 남았나 | 난이도 | 우선순위 | 제안 경로 |
 | --- | --- | --- | --- | --- |
-| **HNSW whole-rebuild** | **Closed in 12.0.0; the default is deliberately unchanged.** The sidecar appends incrementally instead of being invalidated by every write, and the index is now used in real search: `hnsw+rescore` fetches `k * 8` candidate ids (cap 200) from `POST /worker/vector/query` and rescores exactly those rows natively, so recall is approximate and ordering is exact. Failures fall back to the exact scan carrying their reason. | L | **P2 → resolved for scale; the default stays `brute`.** | Nothing to build. The remaining decision is when to flip the default, and that needs recall@10 re-measured against the exact scan on a Brain that has been ingesting continuously — not a synthetic corpus. |
+| **HNSW whole-rebuild / full-table dump** | **Closed in 12.2.1.** 12.0.0 appended instead of invalidating. 12.2.1 warm queries are `COUNT(*)` then missing ids only; a loaded sidecar appends a delta instead of rebuilding from the incoming set. Env default stays `brute`. | L | **P2 → closed for the dump; the default stays `brute`.** | Flip the default only after recall@10 vs exact scan on a live Brain. |
 | **Unsigned DMG** | `Lattice AI_12.0.0_aarch64.dmg` is ad-hoc signed (= unsigned). First launch needs the Gatekeeper bypass. `npm run release:validate` checks names and presence, not a Developer ID. | M | **P2** — first-run tax on desktop, not a Brain bug. Needs an Apple identity. | Developer ID Application + notarization in the release path. Exact artifact name stays `dist/…` / `src-tauri/target/release/bundle/dmg/Lattice AI_X.Y.Z_aarch64.dmg`. Credentials stay off the tree. |
-| **`api_key` cloud path is mock-only** | Contract-tested against a mock server. Never live-called — no billing budget. Live E2E is `cli_oauth` (`agy` / `grok`) at zero API billing. | S | **P2** — the supported cloud path already works. This is the paid-key twin. | One live contract test against a real OpenAI-compatible endpoint once a budget exists. Do not call the mock path "verified" in FEATURE_STATUS. Keep `local_only` winning on the request. |
-| **Vault-watch full-resync** | **Largely closed in 12.0.0**: the ingest fingerprint (size + mtime + content sha256) is on the watch path, so an unchanged note is not re-read, re-chunked or re-embedded. The pass itself still runs once through the bridge, because link edges need node ids only a completed ingest has. Cap is still 2,000 notes/run (`truncated: true`), still off by default. | M | **P2** — the wasteful part is gone; the shape of the pass is unchanged. | Attach links from the ids that already landed so the bridge does not need a whole pass at all. Keep the 2,000 cap and the `truncated` flag. Inline `#tags` stay out of scope. Watch still never deletes — cleanup is the confirmed prune door. |
+| **`api_key` cloud path is mock-only** | **Narrowed in 12.2.1.** Status now live-probes `GET /models` with the key (no completion) and fail-closes when the provider is unreachable. Chat completions are still not billed in CI. Live E2E remains `cli_oauth`. | S | **P2** — the key is proven to work; a billed completion is still a budget. | One live contract completion once a budget exists. Keep `local_only` winning on the request. |
+| **Vault-watch full-resync** | **Closed the remaining two holes in 12.2.1**: skip-by-hash restamps so a `touch` is not re-hashed forever, and vanished watched files are pruned from the graph (`delete_document_tree`). Disk is never deleted. Cap is still 2,000 notes/run. | M | **P2 → closed for skip and prune.** | Attach links from ids that already landed so the bridge does not need a whole pass. Keep the cap. |
 | **Self-Model has no screen** | Writes were restored in 11.7.0. `GET/POST/DELETE /api/memory/self-model*` and Review Center proposals work. `/app` has no profile view — "Brain이 나에 대해 뭐라고 생각하나" is an API call. | M | **P2** — the data path is real; the reader cannot see it. | A panel under `frontend/src/features/brain/` + `frontend/src/i18n/brain/`, reading the existing API. No new writer. Vitest 100% `all: true`. |
 
 ## P3 — honesty leftovers that should not grow

package/docs/TRUST_MODEL.md

@@ -1,6 +1,6 @@
 # Lattice AI Trust Model
 
-Current release: **12.2.0 — Small Voice**.
+Current release: **12.2.1 — True Count**.
 
 Lattice AI is local-first, explicit about external communication, and honest
 when a capability is unavailable.
@@ -87,7 +87,7 @@ does not mean secrets should appear in clear text.
 - Cloud model prompts follow the selected provider's policy once the user
   explicitly chooses that provider (or the `auto`/`always` escalation
   policy does, behind `cloud_allowed`). The `api_key` path is
-  mock-verified only in this release; live OAuth used `cli_oauth` at
+  probed with `GET /models` (no billed completion); live OAuth used `cli_oauth` at
   zero billing. Extracted cloud knowledge is proposal-first.
 - A local admin can inspect local files and process memory outside Lattice AI.
 - Marketplace and model registries are third-party services when explicitly

package/docs/WHY_LATTICE.md

@@ -1,6 +1,6 @@
 # Why Lattice AI Exists
 
-Current release: **12.2.0 — Small Voice**.
+Current release: **12.2.1 — True Count**.
 
 **Lattice AI is a local-first Digital Brain that keeps your knowledge durable
 across any AI model.**

package/docs/kg-schema.md

@@ -1,6 +1,6 @@
 # Knowledge Graph Schema
 
-Current release: **12.2.0 — Small Voice**.
+Current release: **12.2.1 — True Count**.
 
 명세 출처: `lattice_ai_full_spec.pptx` 슬라이드 20·21·22
 구현: `lattice_brain/graph/schema.py`

package/lattice_brain/__init__.py

@@ -31,7 +31,7 @@ from .multimodal import (
     transcribe_audio,
 )
 
-__version__ = "12.2.0"
+__version__ = "12.2.1"
 
 __all__ = [
     "AudioFacts",

package/latticeai/__init__.py

@@ -1,3 +1,3 @@
 """Lattice AI - modular server package."""
 
-__version__ = "12.2.0"
+__version__ = "12.2.1"

package/latticeai/core/vector_index/hnsw.py

@@ -118,6 +118,11 @@ class HnswIndex:
     def model_id(self) -> str:
         return self._model_id
 
+    @property
+    def labels(self) -> List[str]:
+        """Live label order — the sidecar's identity, loaded or rebuilt."""
+        return list(self._labels)
+
     def _identity_matches(self, dim: int, space: str, model_id: str) -> bool:
         return (
             int(dim) == self._dim
@@ -177,10 +182,12 @@ class HnswIndex:
         doors without guessing.
 
         Full rebuild when the embedder identity changed, when any currently
-        indexed id is missing from the incoming set (a deletion), when
-        deletes would exceed :data:`DELETE_REBUILD_RATIO`, or when this
-        instance was loaded from a sidecar and cannot append (no source
-        vectors to keep the label map honest).
+        indexed id is missing from a *full* incoming snapshot (a deletion),
+        or when deletes would exceed :data:`DELETE_REBUILD_RATIO`. A sidecar
+        that was loaded without source vectors still **appends**: the
+        caller passes only the new ids (COUNT+delta) and ``_append_live``
+        extends the graph. A disjoint incoming set is that delta, not a
+        wipe.
         """
         incoming: Dict[str, IndexItem] = {}
         for item_id, vector, metadata in items:
@@ -197,13 +204,36 @@ class HnswIndex:
             return "rebuild"
 
         if self._loaded:
+            current = set(self._labels)
+            incoming_ids = set(incoming)
+            overlap = current & incoming_ids
+            deleted = current - incoming_ids
+            # Delta-only: the caller passed new ids, none of the live labels.
+            # A full snapshot that dropped ids is a deletion and must rebuild.
+            delta_only = bool(incoming_ids) and not overlap
+            if deleted and not delta_only:
+                self.rebuild(incoming.values())
+                return "rebuild"
+            new_ids = [item_id for item_id in incoming if item_id not in current]
+            if not new_ids:
+                return "append"
+            for item_id in new_ids:
+                _, vector, metadata = incoming[item_id]
+                self._vectors[item_id] = [float(value) for value in vector]
+                self._metadata[item_id] = dict(metadata or {})
+            if self._ann is not None and self._module is not None:
+                self._append_live(new_ids)
+                return "append"
             self.rebuild(incoming.values())
             return "rebuild"
 
         current = set(self._vectors)
         incoming_ids = set(incoming)
         deleted = current - incoming_ids
-        if deleted:
+        overlap = current & incoming_ids
+        # Same discriminant as the loaded path: a disjoint incoming set is
+        # COUNT+delta, not a snapshot that deleted every live id.
+        if deleted and not (bool(incoming_ids) and not overlap):
             ratio = len(deleted) / max(1, len(current))
             if ratio >= DELETE_REBUILD_RATIO or not current:
                 self.rebuild(incoming.values())
@@ -339,18 +369,25 @@ class HnswIndex:
             return False
         return True
 
-    def load(self, db_path: Any, *, fingerprint: str) -> bool:
-        """Adopt a sidecar graph when it provably matches ``fingerprint``."""
+    def load(self, db_path: Any, *, fingerprint: str, strict: bool = True) -> bool:
+        """Adopt a sidecar graph when it matches this embedder identity.
+
+        ``strict`` (the default) also requires the stored fingerprint — size
+        included — so a grown store does not search a stale graph. Relaxed
+        load keeps dim/model and leaves COUNT+delta to append the missing
+        ids rather than dumping the whole table.
+        """
         module = self._module
         if module is None:
             return False
         index_path, meta_path = sidecar_paths(db_path)
         try:
             meta = json.loads(meta_path.read_text(encoding="utf-8"))
-            matches = str(meta["fingerprint"]) == str(fingerprint)
-            matches = matches and int(meta["dim"]) == self._dim
+            matches = int(meta["dim"]) == self._dim
             if meta.get("model_id") not in (None, "", self._model_id):
                 matches = False
+            if strict:
+                matches = matches and str(meta["fingerprint"]) == str(fingerprint)
             labels = [str(label) for label in meta["labels"]]
         except Exception:  # noqa: BLE001 — absent/corrupt sidecar = rebuild
             return False
@@ -358,7 +395,9 @@ class HnswIndex:
             return False
         try:
             graph = module.Index(space=self._space, dim=self._dim)
-            graph.load_index(str(index_path), max_elements=len(labels))
+            # Headroom so an in-process append does not have to rebuild
+            # just because load_index pinned max_elements to the old size.
+            graph.load_index(str(index_path), max_elements=max(len(labels) + 64, 1))
         except Exception:  # noqa: BLE001 — corrupt binary = rebuild
             return False
         self._ann = graph