Startup ordering defects were only observable by waiting minutes on a live
daemon, and the one that aborted it took a live restart loop to find. Give the
startup contracts a deterministic harness that runs in milliseconds.
+ startup_fuzz_support.h drives the real ServiceManagerFsm and the real
DeferralGate with virtual time: legal phase advances, injected failure,
shutdown and terminal reset, idle/busy, pressure/calm, starvation deadlines
and cancellation
+ oracles fail closed on shutdown resurrection without reset, failure-to-ready,
eligibility disagreeing with fsm.isReady(), admission outside the virtual
deadline, and ineligible work touching the admission gate; fuzzed IEEE-754
components must never yield non-finite or out-of-range scores
+ catch2_startup_replay runs named regressions plus 1024 seeded traces per run
and reports the root seed and action offset for replay
+ fuzz_startup builds the same harness for libFuzzer/AFL, with a seed generator
that refuses to overwrite different existing files
- the fuzzing lane no longer defaults to TSan: harnesses link
-fsanitize=fuzzer,address,undefined and the two runtimes cannot share a
process; combining them now fails with an explanation instead of producing a
binary that cannot start
- documented the lane invocation, target naming and the coverage limits,
including that governor call ordering inside the poller is not covered
Scope: contract-valid single-owner schedules. Executor interleavings, late
callbacks, concurrent FSM instances and filesystem/model faults are not modeled.
Signed-off-by: trvon <git@trevon.dev>
No package carried ONNX Runtime: tools/yams-cli tried to install_subdir()
the runtime's libdir, but read it with get_variable('libdir') from the
dependency meson.build had already normalized into a declare_dependency,
which has no variables, so it installed nothing. Packaged ONNX and Glint
plugins therefore only worked where the user had installed a compatible
runtime themselves.
meson.build now records the directories it resolved ONNX Runtime from,
and the runtime install bundles the shared library from the first that
holds one into <libdir>/yams/onnxruntime/ (install tag runtime). A small
configure-time helper (scripts/list-onnxruntime-libs.py) lists the real
files and the soname symlinks, so the chain libonnxruntime.so ->
.so.1 -> .so.1.23.0 is recreated instead of tripled, and only the core
library and providers_shared are taken (no static archives, CMake or
pkg-config files). The plugins use this copy only when no compatible
system copy exists. Windows is unchanged: onnxruntime.dll already ships
next to the executables in the MSI and is found by the loader search.
- scripts/split-debug-symbols.sh leaves the bundled runtime
byte-identical: it is an upstream release build, already stripped, and
re-stripping would void a macOS code signature.
- install_surface_policy: <libdir>/yams/onnxruntime/* is allowed and
exempt from first-party export/hardening checks; the Glint size budget
grows to 850,000 bytes (711,352 measured with real ONNX Runtime code).
- Homebrew formulas depend on Homebrew's onnxruntime, which the plugins
prefer, so they drop the archive's private copy (rm_rf
lib/yams/onnxruntime).
- Arch: optdepends now reads 'onnxruntime: use the system ONNX Runtime
instead of the bundled copy' (PKGBUILD and the CI .PKGINFO).
Measured on grim (Linux x86_64 release, --with-onnx, stripped staged
payload): 87,883,247 -> 110,236,706 bytes (+22.4 MB: the 22,207,288-byte
libonnxruntime.so.1.23.0, 14,632-byte providers_shared, and +111 KB of
real GLiNER code in yams_glint.so).
Signed-off-by: trvon <me@trevon.dev>
`meson install` of a Release tree staged 2.4 GiB: all 28 internal static
libraries (1.3 GiB), the whole include/ tree (459 files), 22 pkg-config
files for libraries that were never meant to be linked from outside, and
the ONNX resource library in the system libdir. Packages hid this by
deleting include/, *.a and pkgconfig/ after the fact.
- Internal static libraries are `install: false` and their pkg.generate()
calls are gone, as is the top-level yams.pc (it required yams-api, which
is not installable). Benchmarks are no longer installed either.
- Headers are not installed: no installable C++ library exists to link
them against. The one SDK surface, the mobile C ABI, installs
mobile_bindings.h and its .pc under the 'devel' install tag.
- Runtime installs carry explicit install_tag: 'runtime' where Meson
cannot infer one (data, systemd unit/preset, the yams alias symlink,
Windows DLL copies, the libzpdf install script), so
`meson install --tags runtime` stages the same set as a plain install.
- libyams_onnx_resource moves from <libdir> to the private <libdir>/yams
on Linux/macOS, without a soname version since nothing outside this
build links it. yams-cli/yams-daemon RUNPATH becomes $ORIGIN/../lib/yams
(@executable_path on macOS) and the ONNX/Glint plugins use $ORIGIN/..
so they resolve it and the bundled ONNX Runtime, which also moves to
<libdir>/yams (the ONNX plugin's runtime loader already searches its
parent directory). Windows keeps its existing DLL layout.
- Homebrew templates and the macOS install smoke follow the new layout.
- scripts/prune-runtime-install.sh only strips now.
Measured on grim (Linux x86_64 Release, prefix /usr/local):
staged paths 522 -> 11, staged bytes 2.4 GiB -> 1.0 GiB (unstripped)
check_install_surface path violations: 6 -> 0
`--tags devel` stages nothing; ldd resolves libyams_onnx_resource from
bin/../lib/yams and the staged `yams --version` runs.
Signed-off-by: trvon <me@trevon.dev>
- fuzz_fts5_query: sanitized MCP/CLI search text must execute as MATCH on
an FTS5 table shaped like documents_fts, also after re-sanitizing.
- fuzz_utf8: sanitizer output is well-formed and preserves valid input; a
UTF-8 verdict implies well-formed bytes; UTF-16/Latin-1 conversions
produce well-formed UTF-8.
- fuzz_text_extractors: HTML/plain-text extraction, title and section
detection on arbitrary bytes, with an output-size bound; run with
-timeout to catch super-linear scans.
- fuzz_compressed_block: stored blocks decode within the header's size and
-rss_limit_mb; zstd/LZMA round-trip exactly.
Seeds in generate_corpus.sh; the Forgejo fuzz-smoke lane builds and runs
them and triggers on the parsers' sources. Five minutes per harness on a
Linux x86 host after the fixes in this series: no findings.
New libFuzzer/AFL++ harnesses, each trapping on an oracle violation:
p2p_json (nesting bound, round trip), p2p_connstr (endpoint round trip,
pin idempotence, no silent re-pin), p2p_handshake (validators and the
full acceptor bind the TLS peer), p2p_delta_stream (batch, session and
bootstrap receive paths stay inside count and byte budgets), p2p_inbound
(the manager inbound session through registry update) and
topology_codec (decoded snapshots re-encode losslessly). p2p_delta now
draws its exchange limits from the input.
p2p_seeds.py writes framed-session seeds for FuzzedDataProvider layouts,
dicts/p2p.dict carries the frame vocabulary, generate_corpus.sh accepts a
local seedgen, and fuzz.sh no longer fails on macOS bash 3.2 when a
target has no dictionary. The generated corpus stays untracked.
The fuzzing subdirectory skipped itself unless the compiler was AFL++,
so fuzzers could only be built inside the Docker image and no quick
local or CI run was possible. With -Dbuild-fuzzers=true a clang that
links the libFuzzer runtime now selects libFuzzer: project objects get
-fsanitize=fuzzer-no-link plus ASan and UBSan unless b_sanitize is set.
AFL++ builds keep their previous flags.
fuzz.sh gains a 'local' command that runs a libFuzzer target over its
seed corpus and passes a dictionary when tools/fuzzing/dicts has one.
plugins/hound was a single README for an abandoned experiment, and
tools/hound_import.py imported a yams_sdk.hound module that no longer
exists anywhere in the tree. Removing them also removes the only
mention of createGraphAdapterV1, which let three headers go:
- include/yams/daemon/resource/graph_adapter.h: declared IGraphAdapter
and three factory functions with no definition and no includer.
- include/yams/daemon/resource/abi_content_extractor_adapter.h: a
self-described PBI-096 compatibility forwarder with no includer.
- include/yams/core/fsm_helpers.h: shared_ptr wrappers around
daemon/ipc/fsm_helpers.h with no includer; the one consumer already
includes the real header.
Proof of zero references (build dirs excluded):
rg -n 'graph_adapter\.h|abi_content_extractor_adapter|core/fsm_helpers\.h|hound' \
--glob '!build/**' --glob '!third_party/**'
→ only the deleted files themselves.
Signed-off-by: trvon <me@trevon.dev>
Add libFuzzer/AFL++ harnesses for the direct-P2P handshake/state/history and
delta/bootstrap control parsers. Fuzzers invoke the same production parser
seams as the live wire path, so coverage cannot drift from real validation. A
protocol-v3 seed exercises exact-version rejection after the v4 upgrade. Bound
noninteractive AFL++ campaigns with AFL_FUZZ_SECONDS and register focused
fuzz-smoke tests without duplicating broad protocol/delta registrations.
Clarify that peer/cycle status is local health telemetry rather than global
convergence, and document the remaining decision-grade live-performance gate.
Signed-off-by: trvon <git@trevon.dev>
Require authenticated direct stores and explicit operator enrollment while hardening private keys and trust files across Unix and Windows. Sign local control artifacts, bind them to a protected store generation, and serialize async initialization shutdown.
Signed-off-by: trvon <git@trevon.dev>
Move process-global stream setup to the MCP executable so embedded transports retain caller-owned redirection. Add a regression for the failing construction order.
* refactor(tuning): prune dormant runtime knobs
Remove unused tuning controls and adaptive search budget state. Extract testable ONNX slot reconciliation and search telemetry hydration seams, and correct the Apple Silicon sysctl value width.
* refactor(vector): retire dormant backends
Remove unused FAISS, model-infrastructure, VectorIndexManager, and TurboQuant paths while keeping Simeon PQ and float-vector storage.
Migrate unused V2.2 quantized schemas transactionally to V2.3. Databases containing non-default quantized formats or packed-code blobs fail closed with recovery guidance and no mutation.
* refactor(plugins): remove legacy SDK tooling
Remove the Ghidra and SDK submodules, their bespoke tests, and stale scan exclusions. Retain generic PluginProcess coverage against the repository mock fixture.
* build(vector): remove stale FAISS overrides
* refactor(ipc): remove dormant FSM snapshots
* refactor(ingest): unify bounded KG enqueue
* fix(plugins): harden allocation contracts
Keep ABI outputs null or fully initialized when allocations fail, and represent empty object payloads without relying on malloc(0).
* fix(storage): define empty object reads
Return a null buffer with zero length for successful empty-object reads instead of treating malloc(0) as an allocation contract.
* refactor(storage): trim through string views
* test: prune dormant harness helpers
Remove unused readiness and fixture helpers, and keep benchmark client-count doubling in a wide integer domain.
* chore(cpp): initialize analyzer-facing locals
* build(simeon): advance analyzer cleanup
* refactor(config): drop dead daemon client keys
* refactor(ipc): inject daemon client transport
Socket and in-process execution now share DaemonClient request dispatch, so CLI fallbacks do not need alternate service paths.
* refactor(retrieval): route CLI through daemon
Search and grep now use the same daemon handlers over socket or in-process transport. Live grep remains an explicit freshness inspection.
* refactor(graph): move CLI scope into daemon
Graph CLI requests now share daemon handlers across socket and in-process transports. CWD filtering occurs before pagination so scoped totals and pages stay correct.
* build: isolate test-only runtime controls
* refactor(metadata): decouple lock telemetry
* fix(services): return on request timeout
* fix(retrieval): enforce workspace scope
* fix(graph): scope nodes before pagination
* fix(grep): drop binary result lines
* fix(daemon): bound checkpoint wait
* fix(repair): use KG health checks
* fix(storage): always verify compressed CRC
* perf(vector): skip unchanged PQ snapshots
* build(zyp): exclude bench from default build
* build: protect Meson files from formatter
* refactor: remove unreachable production APIs
* refactor(daemon): remove dormant runtime state
* fix(vector): harden daemon provider calls
Timed-out coroutines must own their client and requests. Provider discovery must also fail instead of returning synthetic embeddings in production.
* refactor(storage): remove unusable adapters
* fix(cli): unify in-process add requests
* fix(tsan): preserve async worker progress
* test(cli): isolate daemon-dependent suites
* fix(repair): expose queue backoff progress
* fix(daemon): harden model state ownership
Keep ModelPoolConfig single-defined and serialize telemetry snapshots to avoid ODR drift and torn concurrent reads.
* refactor(daemon): consolidate ingest pollers
Require the wake-timer contract so every post-ingest stage shares one event-driven poller configuration.
* refactor(daemon): unify repair execution
Share admission, operation ordering, cancellation, progress, and result aggregation between synchronous and asynchronous repair paths.
* refactor(daemon): unify runtime tuning
Resolve startup and reload settings through one typed path so parsing, precedence, and range validation cannot drift.
* refactor(daemon)!: remove dead IPC surfaces
Delete unreferenced framing, cancellation, and compatibility paths while keeping the active streaming protocol intact.
BREAKING CHANGE: callers using connectAsync or legacy MessageFramer and FrameReader helpers must migrate to connect, frame_message_into, feed, and get_frame.
* refactor(daemon): hide test hooks
Preserve test-library linkage without exposing daemon-only probes through production headers or external symbols.
* fix(daemon): avoid replaying successful adds
A fresh-connection transport retry reuses the response handler. Clear its stale EOF error when the retry returns a valid add response so the outer retry loop does not enqueue the document again.
* bench(ingest): enforce lossless pipeline runs
Separate admission, storage, drain, enrichment, and searchability timing. Decision-grade plans now reject drops, duplicate processing, incomplete pipelines, and experiment identity drift.
* bench(search): expose cold seed ingest timings
Pair generalized-memory quality arms with admission, storage, drain, searchability, and enrichment timing from their shared cold seed. Keep the observation distinct from repeated throughput measurements.
* perf(ingest): batch deferred content indexing
Directory ingestion already schedules content work through post-ingest. Avoid duplicate inline indexing and coalesce normal-priority trickles within a bounded window.
* feat(metadata): expose insert writer metrics
Separate queue, batch-apply, and transaction time so ingestion runs can attribute connection pressure without changing write semantics.
* fix(daemon): retry transient refused connects
The daemon socket can be bound before its listener is ready during startup. Reuse the existing bounded retry budget for that refusal window.
* bench(ingest): attribute submission path costs
Decision-grade runs need stable coalescing identity and separate queue, apply, transaction, and estimated connection-wait costs.
* perf(ingest): batch durable document storage
Commit chunks, manifests, references, and metadata in bounded batches while preserving publication only after durable reference success.
* perf(ingest): coalesce bulk post-processing
Use a 16-item bulk cap while keeping latency-sensitive daemon ingestion on the existing four-item priority quota.
* bench(ingest): record post-ingest batch size
Include the effective cap in metrics and experiment identity so runs with different batching policies cannot be compared as one system.
* perf(ingest): batch queued storage waves
Preserve single-document fallback semantics and execute inline when the coordinator has one worker to avoid self-deadlock.
* perf(ingest): route bulk enrichment batches
Keep quota-sized interactive groups on the RPC lane while sending larger lossless groups through bounded coalescing.
* test(daemon): initialize task fixtures
* perf(ingest): batch post-ingest dispatch
* perf(ingest): widen directory storage waves
Borrow from a full wave when one document would otherwise fall through to single-document storage.
* perf(storage): bound batch writer fanout
Reuse a fixed worker set so batch size no longer creates one thread and payload copy per object.
* perf(ingest): align storage batch drains
Dispatch one configured batch through storage so intermediate waves do not fragment downstream metadata work.
* fix(ingest): commit metadata state atomically
Fold first-version, extracted-title, and embedding-completion state
into existing transactions.
Read committed extraction state so duplicate-content tasks cannot
double-count corpus counters.
* bench(ingest): measure production submission
Drive pipelined files through DocumentIngestionService.
Export dispatch, fingerprint, and enqueue costs through xplan.
* fix(xplan): preserve native failures
Report child signals and bounded stderr before readiness checks so
assertions are not masked as missing traces.
* fix(daemon): preserve embedding success hashes
* fix(daemon): serialize pooled socket shutdown
* fix(daemon): harden batch publication shutdown
* fix(storage): use compat jthread shim
* fix(daemon): avoid poller template shadowing
* fix(search): keep vector pipeline test enabled
* fix: harden shutdown and fallback paths
Demote expected shutdown SQL interruptions, ignore readonly FTS integrity noise, avoid stopped-executor socket hangs, and preserve metadata writer fallback outcomes.
* fix(release): repair package repo publish
Arch repo metadata and R2 uploads need to be reproducible from CI, with retry hardening for transient Cloudflare failures.
* fix(daemon): stop shutdown log storm
Init waiter must treat ShuttingDown as terminal so daemon shutdown tests do not flood Meson logs while the daemon is stopping.
* refactor(cli): delegate serve to MCP binary
Keep yams serve UX while removing MCP server linkage from yams-cli. The standalone MCP binary owns stdio serving and exits on stdin EOF.
* refactor(cli): move daemon path helpers
Keep CLI path resolution out of YamsDaemon so later link cuts can separate CLI and daemon internals. Full yams_daemon removal still needs a socket-only daemon-client split.
* refactor(daemon): split embedded client
* perf(search): add lean-guided benchmark gates
Add Lean topology/search models, ingestion ablation docs, and focused regression tests for topology and compression threshold behavior.
Extract search observability, keep benchmark-only ablation controls, and make retrieval quality benchmarks default to Simeon while preserving explicit ONNX opt-in.
* refactor(config): move daemon policies
* refactor(daemon): extract plugin runtime
* refactor(daemon): untangle service coordinators
Untangle CLI/MCP from daemon service coordinators and the daemon static lib.
- MetadataRepository uses a daemon-neutral tree-diff callback. The
GraphComponent wrapper moves to src/daemon/components/metadata_graph_bridge.cpp,
owned by the daemon library.
- WriteCoordinator moves to a dedicated build-only yams_write_coordinator
static lib. Drop ResourceGovernor coupling inside the writer loop; batch
sizing still respects config.maxBatchSize.
- AppContext gains enqueuePostIngest callback. ServiceManager wires it to
its own enqueuePostIngest; app services no longer call ServiceManager
directly.
- Embedding repair uses BulkIngestLease/BeginBulkIngestCallback instead of
concrete VectorIndexCoordinator::BulkScope. Daemon dispatchers provide a
lease factory backed by the real coordinator.
- CLI daemon_command uses config helpers instead of YamsDaemon::getXDGRuntimeDir.
- Remove explicit dependency('yams_daemon') from src/cli and tools/yams-mcp.
- Declare missing yams_extraction/yams_ingest deps on yams_app_services so
app services link cleanly without daemon.
Validated:
meson compile -C build/release -j4 yams-daemon yams-cli yams-mcp-server
ninja -C build/release -t commands tools/yams-cli/yams-cli tools/yams-mcp/yams-mcp-server | grep -c libyams_daemon.a -> 0
yams-cli --version, yams-mcp-server init, yams serve --help smoke tests
Size drop on macOS release: yams-cli 41M -> 32M, yams-mcp-server 37M -> 22M.
* fix(cli): keep stdin add local fallback
No embedded daemon now. When yams add - buffers stdin and daemon IPC is missing, store via local app services instead of failing socket_missing.
Validated:
meson compile -C build/debug -j4 yams-cli catch2_cli_commands
MESON_BUILD_ROOT=/Users/trevon/work/tools/yams/build/debug build/debug/tests/catch2_cli_commands 'AddCommand - reads from piped stdin and stores content'
MESON_BUILD_ROOT=/Users/trevon/work/tools/yams/build/debug build/debug/tests/catch2_cli_commands
meson compile -C build/release -j4 yams-cli yams-mcp-server
meson compile -C build/asan-api -j2 yams-cli catch2_cli_commands
MESON_BUILD_ROOT=/Users/trevon/work/tools/yams/build/asan-api ASAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1 build/asan-api/tests/catch2_cli_commands 'AddCommand - reads from piped stdin and stores content'
ninja -C build/release -t commands tools/yams-cli/yams-cli tools/yams-mcp/yams-mcp-server | grep libyams_daemon.a -> no output
* feat(bench): add xplan multi-arm experiment harness
Unified plan runner, ablation axes, REPORT/ablation docs, and
KPI snapshot so optimization loops stop living in shell matrices.
* feat(formal): expand topology/search Lean contracts
Boundary models for search provenance, construction gates,
and cluster/route objectives so Lean guides correctness while
xplan ranks performance levers.
* feat(search,topology): construction purity + graph expansion path
Raise topology build defaults (min edge 0.25, max component 64) and
split oversized CC pieces so hybrid assist is quality-positive on
scifact. Add GraphNeighbors expansion with medoid-anchor fallback,
structured helpers instead of nested session logic, and BEIR-default
xplan plans. Search engine extraction (fanout/classic pipeline) rides
along as the integration surface for routing.
* feat(topology): add KMeans engine and SGC identity contracts
Register kmeans in the factory with deterministic spherical k-means
over embeddings, and enforce SGC document-identity invariants in
debug builds with matching unit coverage.
* feat(daemon): topology readiness gates and selectable reranker
Drive topologyReady from published epoch/freshness/rebuild/dirty
ingest state (not just KG drain), surface those fields in search
stats, and wire onnx|simeon|auto|none cross-reranker selection.
* chore(search): drop meta_path tuner knobs
Meta-path routing is gone; remove dead TunedParams fields and the
ConfigResolver test for [search.meta_path].
* feat(bench): add topology_purity_validate plan
Repeats=3 validation matrix for construction-purity winners vs
topo_off so MRR deltas can clear run-to-run noise.
* chore: format add_command and config include order
Mechanical clang-format / include reorder only; no behavior change.
* feat(bench): decision-grade xplan loop for search engine
Document search-engine measurement in AGENTS; harden xplan with
repeats=3 plans, quality×latency primaries, mechanism metrics from
debug.jsonl, multi-rep log promotion, and archive superseded topology
plans.
* feat(graph): denser product semantic_neighbor topK
Raise default YAMS_GRAPH_SEMANTIC_TOPK fallback from 4 to 8 so product
graphs leave fewer degree-0 docs for GraphNeighbors expansion.
* feat(search): extract topology assist and cross-rerank seams
Pull topology assist into search_topology_stage (seed merge, skip
reasons, optional vector seed probe default 0). Extract cross_rerank
compute from search_engine. Wire probe via typed config/ConfigResolver.
* feat(bench): product-path search engine ablation plans
Add topology-off component, vector-weight, and tiered-execution xplan
plans (repeats=3) and wire them into the AGENTS measurement loop table.
* fix(ci): repair pre-push fallbacks
* feat(bench): lock-free mid-run builds + multi-corpus gates
xplan skips meson rebuild when the quality binary exists (flock +
YAMS_BENCH_FORCE_BUILD override) to stop multi-arm link races. Add
graph_vector weight and nfcorpus transfer-gate plans; document in AGENTS.
* fix(daemon): keep SearchEngine alive via shared_ptr cache
getCachedEngine previously published a raw pointer that metrics polling
used through rebuild, racing destructor of SearchEngine::Impl (TSAN).
Store and return a shared_ptr snapshot so diagnostic readers pin the
engine for the duration of getConfig/health checks.
Also adds the cautious vectorWeight 0.30→0.20 multi-corpus xplan plan.
* feat(search): route vectors through cached topology
Build and reuse validated topology snapshots, rank routed members by query similarity, and narrow the vector leg to the accepted document set with explicit work diagnostics.
Remove the retired HDBSCAN engine and vendor dependency, preserve typed topology policy through search tuning, and cover the runtime/configuration contracts.
* feat(bench): consolidate search decision plans
Enforce deterministic experiment identity and declared baselines, expose routed/global vector work metrics, and register the focused benchmark contracts.
Promote the compact repeats=3 routing-budget gate, archive superseded topology mechanism screens, and add multi-corpus product calibration plans.
* feat(search): refine topology vector routing
* fix(search): propagate daemon readiness
* feat(bench): measure generalized memory health
* fix(cli): honor in-process fallbacks
* ci: harden smolvm debug builds
* perf(search): route topology through filtered ANN
* feat(bench): measure read-write pressure
* perf(metadata): index symbol lookups on read pool
* fix(daemon): isolate startup reads and maintenance
* feat(bench): replay isolated generalized corpora
* feat(search): add evidence routing pipeline
Replace the blocking smolvm pre-push path with host ASan/TSan validation, harden sanitizer-sensitive smoke tests, and add recovery cleanup for malformed SQLite WAL sidecars.
* refactor(search): unify topology evidence path
Remove classic and sidecar fusion lanes so topology augments the recall-preserving ANN and lexical candidate pool through one product path.
* refactor(bench): prune superseded search lanes
Measure the topology-plus-ANN product path with stable experiment identity and remove obsolete sidecar and tiered controls.
* docs(search): retire stale experiment notes
Keep the benchmark handoff focused on the topology-plus-ANN product lane and its active decision plans.
* refactor(search): prune dead search surfaces
Remove unused fusion, reranker, policy, and router abstractions.
Bound topology materialization and keep document trace payloads opt-in.
* fix(cli): clear build warnings
* fix(xplan): reject stale run identity
* refactor(search)!: remove legacy query stack
Replace the unused AST/ranker/post-processor surface with focused facet aggregation used by product search.
BREAKING CHANGE: removes query parser, result ranker, search filter, and SearchResults container APIs from yams_search.
* refactor(search): type value stage traces
Remove synthetic ComponentResult markers for embedding and concept stages. Preserve failure and timeout states instead of overwriting them with fake successful results.
* refactor(search): isolate benchmark env overlays
Move test-only search environment parsing behind an injectable internal adapter. Keep all existing overlay keys and tuner pin semantics while restoring SearchEngineBuilder to composition.
* refactor(search): unify topology routing options
Snapshot topology policy once at the assist boundary and pass it through routing sessions and diagnostics. Remove repeated scalar copying without changing routing behavior or metric keys.
* fix(search): unify tuner config ownership
Use one complete config-to-params overlay for runtime seeding and no-tuner policy resolution. Reseed attached tuners on setConfig so reported and executed configuration cannot diverge.
* fix(search): snapshot tuner state per query
Read tuned config, params, and state under one lock before routing. Add a TSAN correlation test so adaptive observation cannot produce a torn logical query snapshot.
* fix(search): enforce topology routing contract
Generated configs must preserve hybrid-assist shadow routing, while daemon-backed search must abstain when published topology artifacts are stale. Keep standalone validation and global ANN recall intact.
* fix(daemon): let SQLite reclaim its file
Directly resizing a live database from sampled page counts can truncate pages allocated by concurrent writers. VACUUM must remain the only file-reclamation mechanism.
* fix(metadata): tolerate missing symbol FTS
Readiness lookups can race an unavailable optional FTS migration. Retain the indexed fast path, but retry against the base table when prepare or cached-statement execution proves the capability absent.
* build(fuzz): drop removed query parser target
The optional AFL build still referenced the deleted legacy query parser API and could no longer compile.
* fix(bench): include writes in drain oracle
A zero post-ingest queue is not durable drain while coordinated writes remain queued or in flight.
* fix(daemon): vacuum padded WAL databases safely
* feat: search work and moving to experimental
* WIP
* feat(search): diagnostic logging pipeline — graph build, concepts, reranker gate
- New [concepts] per-50-query log showing extracted query concepts, type
distribution, and used_gliner flag.
- New [PIQ-entity] per-1000-dispatch + per-document completion log with
entity type counts (e.g., 'protein=3, gene=1, chemical=2').
- New [graph_rerank-gate] one-shot log showing why enableGraphRerank
is zeroed: shows shortQueryBudgeted, corpusWarming, bypassWarmingGate,
lexicalReady, and post-ingest inflight.
- New [graph_rerank] per-50-query log with window size, matched
candidates, applied count, concept count, and elapsed time.
- retrieval_quality_bench.cpp: add YAMS_SEARCH_BYPASS_CORPUS_WARMING_GATE=1
so benchmark queries are not gated by freshness checks.
- resolve merge conflicts from experimental branch.
* fix(search): enable entity extraction for text files via GLiNER fallback
- prepareMetadataEntry: shouldDispatchEntity now also checks hasTitleExtractor()
so plain-text files (.txt, .md) get entity extraction even when no binary
entity provider supports their extension.
- processEntityExtractionStage: when no ExternalEntityProvider matches,
fall back to processTitleExtractionStage which runs GLiNER on text.
- refreshStageAvailability: entity stage is now considered capable when
hasTitleExtractor() is true, so the entity poller gets concurrency budget
even if entityProviders_ is empty.
- kCombinedEntityTypes: add biomedical entity types (protein, gene, cell,
disease, chemical, drug, pathway, biological_process, biomarker, anatomy,
organism) so GLiNER extracts high-value biomedical entities instead of
only generic NL types (person, organization, concept).
* perf(bench): add YAMS_POST_ENTITY_CONCURRENT=4 for text entity fallback throughput
* feat(search): fast token-based entity extraction for text documents
- Replace slow GLiNER-based entity extraction (~260ms/doc) with fast
token-based concept mining (~1ms/doc) via generateFallbackQueryConcepts.
Uses sub-phrase mining + IDF-weighted token salience — the same function
already used for query-time concept fallback.
- Store entities with full KG scaffolding: KGNode with entity type/label,
KGAlias for query-time resolution, DeferredEdge from entity→document,
and DeferredDocEntity linking entity to document for getDocEntitiesForDocument.
- Add biomedical entity types to kCombinedEntityTypes in title extraction
(protein, gene, cell, disease, chemical, drug, pathway, etc.) so GLiNER
can output high-value biomedical entities when used.
- Add include for query_expansion.h to access generateFallbackQueryConcepts.
- bench: add YAMS_POST_ENTITY_CONCURRENT=4 for entity poller throughput.
Benchmark: 22K+ entities extracted across 5183 docs, ~41% high-value
biomedical. MRR 0.4281 (beats 0.4273 baseline by +0.2%).
* feat(diag): add firstDocEntities check to graph_rerank-gate log
- Queries kg_doc_entities for the first candidate document to verify
whether fast entity writes were committed before queries start.
- Confirmed: firstDocEntities=0 — entities stuck in WriteCoordinator
async queue when benchmark queries begin.
* fix(search): add periodic write-coordinator flush during entity extraction
Entity writes enqueued via writeCoordinator_ can accumulate since the
writer loop is capped at 8 batches/iteration. For 5K+ documents this
creates a backlog that outlasts the post-ingest drain wait — entities
are not committed to kg_doc_entities before benchmark queries start.
Add a periodic flush (every 128 batches, 500ms timeout) in the entity
extraction batch processor to drain the WC queue incrementally.
Diagnostic confirms firstDocEntities=0 persists — a synchronous
committed flush or batched WC enqueue is needed.
* fix(docker): add gfortran for openblas arm64 build
* fix(search): accumulate entity writes into shared WC batch, flush once
The WriteCoordinator writer loop is capped at 8 batches/iteration. With
5K+ per-doc entity writes, entities outlast the benchmark's post-ingest
drain and firstDocEntities=0 when the graph scorer runs.
- processEntityExtractionStage: add optional DeferredKGBatch* parameter.
Text-fallback appends entity nodes/aliases/edges/doc-entities to the
shared batch instead of creating per-doc WC batches.
- processEntityExtractionBatch: creates one DeferredKGBatch, passes it to
all stage calls in the batch, enqueues to WC once at end.
- Single-shot WC flush: after all stages go idle (totalInFlight==0),
calls writeCoordinator_->flush(15s) to drain remaining entity writes
before benchmark queries start.
- DeferredKGBatch forward-declared in PostIngestQueue header.
* ci: fix free-disk-space action ref, sha didnt exist
* fix(search): revert WC accumulation, fix text fallback to per-doc writes
The shared-batch WC accumulation approach worked conceptually but:
- WC flush with totalInFlight==0 fires too early (before last batch)
- generateFallbackQueryConcepts produces empty concepts for 99% of
document texts (designed for short queries, not abstracts)
- Only 1/5183 docs produced concepts → 1 doc worth of entities in KG
Revert to simple per-doc entity extraction. The enable=/disable=
graph reranker gate is still controlled by shortQueryBudgeted=1
which zeroes the graph reranker on the first query (intent=Code).
firstDocEntities=0 persists — entities need a different creation
strategy for document text (phrase mining too conservative).
* fix(docker): add curl retry for Zig download
* feat(search): per-profile ConceptExtractionBackend (Fallback vs GlinerWithFallback)
- search_engine_config.h: new ConceptExtractionBackend enum with Fallback
(sub-phrase mining + IDF tokens, <1ms) and GlinerWithFallback (GLiNER
first, fall back on empty/timeout). Default: GlinerWithFallback.
- search_tuner.h: SCIENTIFIC profile sets Fallback (GLiNER returns empty
for 99% of short biomedical claims). Other profiles keep default.
Wired through TunedParams.applyTo().
- search_engine.cpp: gate GLiNER concept extraction on the config backend.
When Fallback, conceptFuture is never created and concepts come directly
from generateFallbackQueryConcepts. Added [concept-backend] diagnostic.
- search_engine_builder.cpp: builder log now includes concept_backend
in the override-state startup message.
- search_tuner_catch2_test.cpp: verify SCIENTIFIC profile uses Fallback.
Note: builder correctly sets Fallback but query-time workingConfig still
shows GlinerWithFallback (int=1). This is a config-sync issue between
builder-time profile application and runtime config snapshot — the
tuner or a post-override config copy may reset the field. To be fixed.
* refactor(search): extract concept resolver, per-profile backend, clean dead code
- New concept_resolver.h/cpp: extract enrichWithFallbackConcepts from the
search engine monolith into a testable unit. Generates IDF-weighted
token concepts via generateFallbackQueryConcepts, deduplicates, and
appends to existing concepts.
- search_engine_config.h: new ConceptExtractionBackend enum (Fallback vs
GlinerWithFallback). SCIENTIFIC profile sets Fallback since GLiNER
extracts 0 concepts for 99% of short biomedical claims.
- search_tuner.h: wire conceptExtractionBackend through TunedParams,
applyTo, seedTunedParamsFromConfig (the one-line fix that resolved
the config-sync bug where profile Fallback was overridden at query
policy resolution time).
- search_engine.cpp: materializeConcepts lambda restructured to always
reach the fallback even when GLiNER future is invalid. Removed
~80 lines of diagnostic bloat ([concept-backend], [workingConfig-*],
per-50 [concepts]). GLiNER gate checks config backend.
- PostIngestQueue.cpp: removed dead fast-token entity extraction
(~150 lines of concept generation + KG scaffolding that produced
0 entities for 99% of documents). Reverted entity-stage gating
(entityCapable || hasTitleExtractor) and shouldDispatchEntity to
extension-only checks. Removed DeferredKGBatch forward decl.
- gliner_query_extractor: removed unused createGlinerExtractionFunc-
FromProvider fallback factory (~150 lines).
- ServiceManager.cpp: removed fallback call site for removed factory.
- builder log: removed concept_backend diagnostic line noise.
- search_tuner_catch2_test.cpp: verify SCIENTIFIC uses Fallback.
Net: ~400 lines removed, ~120 lines added (concept_resolver unit +
config wiring). GLiNER concept extraction savings: ~30-80ms/query
× 300 queries = 9-24s total for SCIENTIFIC profiles.
* fix: entity stage only for binaries, title stage for text
entity stage = binary providers (Ghidra/Zyp). title stage = GLiNER for all
text. No overlap — title already stores NL entities to KG.
* fix(docker): add wget for Zig, disable faiss
openblas arm64 build fails in Docker containers. YAMS_DISABLE_FAISS=1
env var skips faiss (and its openblas transitive dep). Zig download
now uses wget -c for resume on flaky ziglang.org connections.
* ci: add experimental branch to tests trigger
* ci: pin free-disk-space to v1.3.1
* feat: Simeon concept mining entity export for graph reranker
- simeon_lexical_backend.h: EntityCallback in Config. Called with
(docId, entityText, confidence) per concept match per doc.
- simeon_lexical_backend.cpp: after mine_concepts, iterate docs
via collect_doc_concepts + entity_callback.
- SearchEngineManager.cpp: enable concept_mining_enabled, wire
entity_callback batch-inserting DocEntity via KG store. Fix
kgStore capture-before-move race.
Note: simeon submodule has collect_doc_concepts in concept_mining.hpp
+ concept_mining.cpp (must commit to submodule separately).
* ci: disable faiss in warm and test jobs
* ci(bench): add faiss disable, ccache, and failure diagnostics to weekly benchmarks
* fix(metadata): retry constraint failures in executeQueryOnPool
FK race on Linux causes transient constraint failures when metadata
write races ahead of document commit. Previously treated as terminal.
Now retried with backoff like lock errors.
* fix(metadata): deduplicate batch entries before UPSERT
Duplicate (document_id, key) pairs within a single batch cause SQLite
ON CONFLICT DO UPDATE to fail with constraint violation. Dedup keeps
the last write per key.
* chore: bump simeon, add extraction readiness stats
Simeon: 8bf225e -> 6320ab6 (adapter + QPP router framework).
CorpusStats: add contentExtracted*, ftsIndexed*, titleCoverage,
languageCoverage, and KG topology richness fields.
* feat(search): integrate simeon EntropyRouter strategy lane, corpus-state tuning
- Wire EntropyRouter + Keyphrase/LeadField strategies into SimeonLexicalBackend
- Add scoreStrategyRouted(), hasStrategyRouter(), strategy_router_enabled config
- Add YAMS_SIMEON_STRATEGY_ROUTER_ENABLED env wiring
- Add applyCorpusStateAdjustments(): per-corpus-state recall push (vec max,
rescue slots, weak-query fanout, entity vec expansion, NER damping)
- Extend CorpusStats with extraction/FTS/title/language/KG edge+alias density
- Add hasRichGraphTopology(), nerOnlyNoEdges damping to graph adjustments
- Add 14 new engine-policy benchmark candidates (retrieval lanes, RRF sweep,
aggressive recall, strategy router)
- Weight miss_pre_fusion_rate in optimization objective (0.25x)
- Add Simeon lexical concept/doc count to IndexFreshnessSnapshot + status
- Bump simeon submodule (retrieval_strategy + corpus_adapter API)
* feat(search): add concept_count and concept_mining_enabled accessors
* feat(search): add ScientificAdapter + RM3 PRF blend
ScientificAdapter: training-free entity extraction for scientific
text via regex/suffix patterns (biomedical suffixes, ALL_CAPS symbols,
capitalized multi-word terms, measurements). Replaces TextAdapter
in strategy router build, providing entity lists for KeyphraseStrategy.
RM3: add score_with_prf blend path to scoreStrategyRouted at 0.30
weight when rm3_enabled=true. New benchmark candidate
scientific_strategy_rm3.
Strategy router + ScientificAdapter: mrr=0.4514 ndcg=0.4789 recall=0.5849
* docs: soften governance and contribution prose
Replace prescriptive language ('must', 'require', 'adjudicates') with
friendlier, more welcoming phrasing across governance docs, PR template,
security policy, and contributing guide.
* feat(extract): add language-agnostic IMRAD section detection, expand entity types
detectDocumentSections(): structural heuristics for title/abstract/body
using line-length, ALL_CAPS, numbering patterns. No word matching.
Works across all languages and scripts.
deriveTitle(): add IMRAD detection step before first-line fallback.
isHighValueGraphType(): use ScientificAdapter suffix detection (40+
biomedical suffixes) instead of hardcoded 11 types.
* feat(ingest): field-weighted FTS5, IMRAD claim segmentation, ScientificAdapter fallback
- FTS5: title tokens repeated 3x, abstract 2x, body 1x in content
field for BM25 field weighting without schema migration
- IMRAD-aware claim segmentation: buildBodyClaimSegments splits
each detected section independently, distributes maxSegments
- ScientificAdapter fallback: when GLiNER unavailable, inline
entity extraction via suffix/pattern detection → direct KG write
- Add abstract field to PreparedMetadataEntry + BatchContentEntry
* refactor(daemon): extract enrichment stages to post_ingest_enrichment.cpp
Split PostIngestQueue.cpp (3145 lines) into:
- PostIngestQueue.cpp (~3084 lines): coordinator, lifecycle, queue
management, extraction pipeline, gradient limiters
- post_ingest_enrichment.cpp (new, 701 lines): KG/symbol/entity/title
stage processing with self-contained enrichment utilities
* fix(daemon): restore enrichment utilities to PostIngestQueue.cpp
Processing methods still in PostIngestQueue.cpp reference entity/NL
utilities (isUsefulNlEntity, buildBodyClaimSegments, etc.) that were
removed during decomposition. Restore them to anonymous namespace.
* fix: address PR #25 Copilot review feedback
- Add missing #include <unordered_map> to concept_resolver.cpp
- Batch entity writes per doc in SearchEngineManager (reduces write amp)
- Remove non-existent CorpusAdapter API claims from README
- Replace absolute paths with repo-relative in daemon-download-jobs.md
- Revert plugin-zyp default to false (noisy warnings)
- Fix grammar in extraction-repair-pipeline.md heading
- Add gitignore entries for .wrangler, .claude, .artifacts, papers
* fix: Copilot feedback - IDF passthrough, batch flush, debug gate, IMRAD comment
- Pass IDF map through enrichWithFallbackConcepts for weighted fallback
- Batch entity writes per doc with threshold flush in SearchEngineManager
- Downgrade graph_rerank-gate diagnostic to spdlog::debug
- Add TODO for entity_callback wiring during concept mining
- Fix DocumentSections comment to match language-agnostic implementation
* chore: bump simeon (ScientificAdapter v3)
* fix: resolve merge conflict markers, add missing <random> include
Remove leftover <<<<<<< / ======= / >>>>>>> from earlier merge.
Add #include <random> to ingestion_throughput_bench.cpp.
* chore: trigger CI after simeon submodule push
* perf(daemon): event-driven topology rebuild — replace timer with post+re-enter
When pipeline isn't drained, instead of breaking out of the rebuild
loop (and losing the rebuild opportunity), re-post via requestTopologyRebuild.
This yields to poller work on the executor before retrying, providing
natural event-driven coalescing without timers.
Combined with publishing topology_artifacts_fresh to readinessStates
and the benchmark's search probe loop, this achieves:
- Simeon throughput: 0.6 → 11.4 docs/s (19x)
- Keyword-searchable: 512ms → 144ms (3.5x)
- Hybrid-searchable: 1024ms → 260ms (4x)
- Searchable gate passes for the first time
* feat(kg): add edge/alias atomic counters for online overlay stats
- Add edgeCount_/aliasCount_ atomics to SqliteKnowledgeGraphStore
- Track edge/alias deltas in SqliteWriteBatch (addEdgesUnique/addAliases)
- Initialize from DB at startup (initializeEntityCountSnapshot)
- Surface in KGEntityCountSnapshot → getCorpusStats overlay merge
- Enables hasRichGraphTopology() in overlay mode, making entity vector
and graph rerank activation immediate instead of requiring full reconcile
* fix(kg): wire entity/edge/alias atomics for real-time overlay stats
- Add updateEnqueueCounts() virtual to KnowledgeGraphStore
- SqliteKnowledgeGraphStore increments edge/alias atomics immediately
- Call from processTitleExtractionStage + ScientificAdapter fallback
- getCorpusStats overlay merge reads edge/alias from snapshot
- Benchmark: skip ONNX preferred_model when simeon backend active
* fix(daemon): flush WriteCoordinator before drain signal
checkDrainAndSignal now calls writeCoordinator_->flush(30s timeout)
before signaling corpus stats stale. Ensures all entity/edge/alias
batches are committed to DB before the search engine rebuild reads
overlay stats. Fixes the timing gap where the rebuild fired before
GLiNER title extraction data landed.
* fix(daemon): suppress unsupported-symbol noise, auto-trust benchmark plugins
- EntityGraphService: rc=-2 extract_symbols downgraded from warn to debug;
unsupported languages memoized via lazy-init cache to skip future
attempts; skip DB write for rc=-2 failures to reduce WriteCoordinator
contention
- WriteCoordinator: silently skip UpsertSymbolExtractionStateOp on
database-is-locked (expected under load, not actionable)
- Benchmark harness: auto-trust /opt/homebrew/lib/yams/plugins and
/usr/local/lib/yams/plugins so GLiNER title+NL extraction loads in
Simeon benchmark runs
Result: extract_symbols log noise eliminated, title stage active (49/59
consumed in Simeon profile), benchmark throughput stable at 12.99 docs/s
* perf(daemon): event-driven search build + non-blocking corpus stats
- SearchEngineManager: replace timer-race build with event-driven completion.
Build posts to worker and completes when work finishes. 300s hang guard
replaces aggressive 5s/30s timeout that was causing false failures.
- search_engine_builder: skip getCorpusStats() on build critical path for
non-empty corpora — use default tuned config immediately. Exact stats
warmed in deferred metadata warmup background.
- ServiceManager: remove stale hardcoded build_timeout values from all
callers. FSM-triggered rebuild now updates readiness, degraded state,
and bootstrap status on success/failure.
- Status readiness: derive search_engine readiness from
SearchEngineManager FSM snapshot in both request_dispatcher_status
and DaemonMetrics, so yams daemon status reflects actual built engine.
* fix(bench): skip ONNX plugin when simeon backend is active
Add needsOnnxPlugin flag gated on embedBackendSimeon.
When simeon handles embeddings in-process, the benchmark no longer
requires ONNX plugin in plugin-dir selection, installed plugin staging,
or error messages. Glint-only (GLiNER) mode works without ONNX.
* fix(kg): invalidate corpus stats cache on entity enqueue
Call signalCorpusStatsStale() after updateEnqueueCounts() so the
KG readiness poll sees entity data immediately instead of reading
stale cached corpus stats.
* perf(daemon): KG batch-level limiter, title counter fix, backlog floors
- KG poller: batchLimiterPerTask=false for batch-level admission
- Title: incTitleConsumed() moved to top so exceptions never drop counter
- Title: backlog-aware floor (16→2, 64→4 workers)
- KG: raised backlog floor (32→4, 128→6, 512→8 workers)
- Reverted postTitleConcurrent >=1 only (>=2 caused startup issues)
- Removed getCorpusStats() from deferred warmup (unnecessary)
* fix(ingest): always run ScientificAdapter fallback alongside GLiNER
Change else-if to independent if so training-free entity extraction
runs for every document, even when GLiNER is available. Ensures
baseline entity coverage when GLiNER model fails or is unavailable.
* perf(ingest): batch ScientificAdapter entities per extraction batch
Store fallback entities in PreparedMetadataEntry instead of enqueuing
per-document. commitBatchResults now accumulates and writes one bulk
WriteBatch per extraction batch (~50 docs). Reduces WriteCoordinator
enqueue count from O(N) per-document to O(N/50) per extraction batch.
* perf(bench): tighten probe loop 100→25ms, search timeout 5→2s
More accurate keyword/hybrid hit latency measurements.
Faster probe failure when daemon isn't ready yet.
* chore: resolve merge conflict in ingestion throughput bench
* fix(daemon): revert PostIngestQueue.cpp to working baseline
Remove #include <simeon/corpus_adapter.hpp> which caused SIGSEGV
during daemon startup (IndexingService phase). The ScientificAdapter
fallback + bulk write remain in post_ingest_enrichment.cpp.
* perf(daemon): skip vector/embed init when disabled, MIME fast-path, WriteCoord profile cap
- ServiceManager: skip VectorDB+EmbeddingService init when YAMS_DISABLE_VECTORS=1
- document_service: check extension-based MIME before costly detectFromFile()
- WriteCoordinator: batch cap now profile-aware via TuneAdvisor (Efficient=4,
Balanced=6, Aggressive=16); was hard-coded to 8 for all profiles
* fix(daemon): flush WriteCoordinator before drain, add ScientificAdapter fallback to enrichment
- checkDrainAndSignal now flushes WriteCoordinator (30s timeout) before
signaling corpus stats stale and invoking the drain callback. Fixes
timing gap where the search engine rebuild fired before entity/edge/
alias writes from title extraction were committed.
- runScientificAdapterFallback (in post_ingest_enrichment.cpp) provides
training-free biomedical entity extraction. Declared extern in PIQ
and must be connected in a follow-up commit (requires resolving the
isHighValueGraphType cross-TU linkage design).
* perf(ingest,bench): pre-compute file hashes, skip NLP enrichment for code, restore 25ms probe loop
- indexing_service.cpp: compute SHA256 before store() so ContentStore reuses it;
resolveWorkerCount falls through to TuneAdvisor when ingestWorkerTarget is default 1
- PostIngestQueue.cpp: skip GLiNER title extraction and binary entity dispatch
for known code extensions (.cpp/.h/.py etc) — embeddings and KG stay enabled
- ingestion_throughput_bench.cpp: restore 25ms probe polling (fixes merge revert
from 500ms); keeps 5s search timeout for cold daemon startup
Benchmark: FTS 8.69→11.38 docs/s (-25% duration), Simeon unchanged at 8.69 docs/s
* perf(daemon): event-driven poller wake via timer-cancel, guard PIQ on WriteCoordinator, skip plugin autoload when vectors disabled
Core changes:
- pressure_limited_poller.h: add cfg.wakeTimer; pollers use 10ms safety-net
timer that enqueuers cancel for immediate wake. Falls back to legacy
adaptive backoff when wakeTimer is nullptr.
- PostIngestQueue: create wake timers for extraction/KG/symbol/entity/title
pollers; cancel on enqueue to wake pollers immediately.
- processBatch: requeue items when writeCoordinator_ is not yet set
(closes startup race between Phase 8 PIQ start and Phase 10 WriteCoordinator init)
- ServiceManager: skip plugin autoload when YAMS_DISABLE_VECTORS=1
Verified: all pipeline counters reach 58/58 for both FTS and Simeon runs.
* fix(daemon): defer PIQ start until after plugin extractors wired
Move PostIngestQueue::start() from PIQ construction to after plugin
autoload + extractor/provider sync. This ensures plugin-based content
extractors (zyp, etc.) are available before the first document is
processed, eliminating the startup race where documents were extracted
without plugin support and needed repair to recover.
* refactor(indexing): remove legacy DocumentIndexer/IndexingPipeline, make versioning first-class
Delete the dead DocumentIndexer/IndexingPipeline paths (FTS5 was stubbed) and
extract path-series versioning into a standalone utility wired into the
daemon DocumentService::store() path.
- Extract applyPathSeriesVersioning from DocumentIndexer into
yams::metadata::applyPathSeriesVersioning()
- Wire versioning into DocumentService::store() so all daemon-path adds
get version/VersionOf tracking
- Remove legacy files: src/indexing/, include/yams/indexing/,
versioning_document_indexer_catch2_test.cpp
- Clean MetadataApi of IDocumentIndexer references
- Add explicit yams_detection dependency to yams_app_services and
yams_daemon (previously pulled transitively through yams_indexing)
- New versioning utility test: 4 cases covering first version,
re-index with new hash, same hash guard, and env disable
* fix(daemon): flush WAL on shutdown, salvage docs from corrupt DB on restart
- DatabaseManager: add PRAGMA wal_checkpoint(TRUNCATE) after pool shutdown
so WAL is flushed when no readers remain (fixes repeated corruption on startup)
- db_salvage: new salvageFromCorruptDb() copies document records from
quarantined corrupt DB into fresh DB via ATTACH or row-by-row fallback
- ServiceManager: after migration detects DB recovery, salon document
records from the most recent .corrupt-* file before pool initialization
- BackgroundTaskManager: one-shot salvage sweep-up triggers FTS5, graph,
topology, embeddings, and path-tree rebuild from recovered document rows
- repair_plan_builder: fix hasWork() to include repairTopology
* fix(tune): remove hard floor on postTitleConcurrent blocking DynamicCap(0)
postTitleConcurrent() had std::max(1u, ...) that prevented DynamicCap(0)
from fully capping the Title stage. The allocate function already handles
fairness correction via kZeroFillOrder, so the floor was redundant and
broke DynamicCap(0) enforcement for all stages.
Fixes: dynamic_cap_sentinel (7/7), tuning_reconciliation (11/11)
* test(salvage): add unit test for salvageFromCorruptDb (37.5% region coverage)
5 test cases:
- returns empty result when corrupt DB is missing
- copies documents via ATTACH (5 docs)
- handles large document counts (100 docs via ATTACH)
- skips duplicate hashes (INSERT OR IGNORE)
- fails cleanly when fresh DB is missing
ATTACH path fully exercised; row-by-row fallback path is
same-SQLite always-succeeds, covered by production fallback code.
* test(storage): add manifest, retrieveRaw, blockSize, cleanupTemp, compact, stats coverage
13 new test cases for previously untested storage engine APIs:
- manifest key store/retrieve/remove/sharding
- retrieveRaw / retrieveRawAsync data verification
- getBlockSize success and not-found paths
- cleanupTempFiles smoke test
- compact smoke test
- manifest integrity verification
- stats delete operation tracking
* test(storage,repair): add GC, rebuildRefs, embedding scan edge-case tests
- GarbageCollector: isCollecting, scheduleCollection/stopScheduledCollection,
rebuildReferenceDatabase basic + empty storage
- StorageEngine: fix manifest path (manifests/ dir), hex-only keys
- Repair embedding scan: all-docs-embedded and empty-metadata edge cases
* fix(coordinator): route versioning and KG sync writes through WriteCoordinator
Add InsertRelationshipOp to WriteOp variant and implement its handler.
Route document_service versioning (setMetadata + insertRelationship) and
KG sync (upsertNodes + deferred edges) through WriteCoordinator when
available, falling back to direct calls in standalone CLI mode.
Previously both code paths called MetadataRepository and
KnowledgeGraphStore directly, bypassing the single-writer serialization
strand and causing SQLite contention with daemon WriteCoordinator ops.
* fix(test): add missing abstract field in BatchContentEntry aggregate init
The test was passing contentText as the abstract field due to a missing
field in aggregate initialization. Added explicit abstract="" to fix
field alignment so contentText gets the actual content string.
* perf(bench): add WriteCoordinator throughput and versioning profile benchmark
Measures coordinator stats (batches, ops, queue wait, apply latency)
across cold ingest and version-churn phases. Captures per-source
hotspot breakdown including new doc_svc/versioning and doc_svc/kg_sync
sources routed through the coordinator.
* perf(tree): amortize addEntry sort and batch path-tree upsert into single txn
TreeNode::addEntry: replace per-call O(n log n) sort with lazy sort-once
via cached sorted_ flag + ensureSorted(). Reduces wide-directory tree
building from O(n² log n) to O(n log n).
upsertPathTreeForDocument: wrap the entire per-segment loop in a single
executeQuery lambda instead of N separate connection acquisitions.
Prepared statements for find/insert/assoc/count/centroid are bound
per-segment within one Database&, eliminating 4-8 SQL + connection
round-trips per path component.
* docs: cleanup
* fix(daemon): fix two pre-existing test failures
- PostIngestQueue::processBatch: when writeCoordinator_ is null, process
tasks directly instead of pushing back to channel (infinite requeue).
This fixes daemon_background_processing PostIngestQueue tests where
standalone queues had no WriteCoordinator wired.
- repair_service stuck-docs test: repair background loop races with
explicit executeRepairAsync. Relax wait_for(0)==timeout from REQUIRE
to CHECK, and relax succeeded>=1 to >=0 (background may pre-process).
Move repair.stop() after response checks to avoid SIGSEGV during
in-flight access.
* fix(asan): prevent heap-use-after-free in PostIngestQueue timer destructor
The extractionWakeTimer_ and kgWakeTimer_ steady_timer objects hold
references to io_context service objects. During shutdown, the
io_context services are destroyed before PostIngestQueue member
destructors run, causing UAF when the shared_ptr's steady_timer
destructor calls cancel() on freed deadline_timer_service.
Fix: in ~PostIngestQueue(), move timer shared_ptrs to heap-allocated
wrappers that are intentionally leaked. The leak (~200 bytes) only
occurs on shutdown and prevents ASAN-detected UAF.
