Unify acquired graph reads and operation-scoped configuration

.sdd/graph/2026/09/06-231136-s-tac-ynt.md

@@ -0,0 +1,13 @@
+---
+type: signal
+layer: tactical
+kind: gap
+participants:
+    - Christopher
+confidence: high
+topics:
+    - reliability/pre-flight
+summary: 'Pre-flight validation can fail with a JSON parse error when an entry description contains a brace literal such as `Options{Zebra: true}`, as reported in GitHub issue #6. This is a tactical gap signal with high confidence, noting that braces in a description should not trigger a validation error or prevent entry capture.'
+---
+
+Pre-flight can fail with a JSON parse error when an entry description contains a brace literal such as `Options{Zebra: true}`, as reported in [GitHub issue #6](https://github.com/networkteam/sdd/issues/6). Braces in a description should not cause a validation error or prevent capture.

.sdd/graph/2026/09/06-234056-d-tac-bae.md

@@ -0,0 +1,42 @@
+---
+type: decision
+layer: tactical
+kind: directive
+refs:
+    - id: 20260906-121218-d-tac-ccm
+      kind: builds-on
+    - id: 20260717-144536-s-tac-h3q
+      kind: builds-on
+    - id: 20260830-114446-d-cpt-xc3
+      kind: grounded-in
+participants:
+    - Christopher
+confidence: high
+intent: pending
+topics:
+    - portability/runtime
+    - cli/architecture
+    - collaboration/concurrent-work
+    - reliability/testing
+summary: SDD commits to consolidating all application graph reads around a single acquired, revision-fixed source per operation — covering ordinary reads, workflow graph access, attachment reads, configuration, search, and mutation preparation — with strict revision selection semantics, per-operation authorization, and explicit cleanup of resource owners. It builds on the fixed search sources and exact entry indexing (20260906-121218-d-tac-ccm), preserves the artifact-branch read behavior (20260717-144536-s-tac-h3q), and follows the application-package single composition root (20260830-114446-d-cpt-xc3), removing current inconsistencies between materialized graphs, attachment bytes, and branch selection without a new graph-manager hierarchy.
+---
+
+SDD will consolidate application graph reads around one acquired, revision-fixed source per operation, extending pinned search and indexing to ordinary reads, workflow graph access and mutation preparation.
+
+This builds on the fixed search sources and exact entry indexing in 20260906-121218-d-tac-ccm, preserves the artifact-branch behavior delivered in 20260717-144536-s-tac-h3q, and follows the single application composition root in 20260830-114446-d-cpt-xc3. Current reads can combine a materialized graph with later attachment bytes or route read-only branch selection through mutation acquisition. One acquired source removes those inconsistencies without another public graph-manager hierarchy or search prepare/execute protocol.
+
+Keep SnapshotReadQuery and SnapshotReader. An empty branch selects current authority, never the write-routing DefaultBranch. A named branch resolves once; ExactRevision selects precisely that revision or fails; IncludesRevision requires causal inclusion on the selected authority. Exact and including revisions remain exclusive. Read selection requires read authorization and must not depend on TargetAcquirer. Writes retain target acquisition and finalizers.
+
+Add Branch and BranchFromSession to ReadAttachmentRequest and forward session branch selection from MCP. Resolve entry membership and page bytes through the same acquired source. Pages are independent operations; no revision token spanning pages is added. This supports immutable attachment identities without promising consistency across pages when existing editing features replace bytes.
+
+Add optional Config *ProjectConfig to AcquiredSnapshot. A nonnil value supplies committed configuration from the same revision as graph and attachments. Derive effective language and dependency declarations once for the current operation; never overwrite shared ProjectRuntime configuration or mutate cached source configuration. AcquiredSnapshot.Config is the application configuration authority. SnapshotData.Config remains stored document data, not a second independently interpreted source of effective settings; document that relationship explicitly. Empty source dependency lists mean no dependencies. Authorization remains independent and current for every selected project. Configuration cannot grant permission.
+
+Config == nil explicitly selects compatibility with runtime configuration. It is never recovery from a failed source-config read. Revision-bound adapters must return errors for missing or malformed source configuration. Preserve the distinction between committed configuration and runtime composition, including local overrides, credentials, providers and index settings. Source DefaultBranch must not silently reroute writes. Document local configuration precedence and any changed local behavior in adoption guidance.
+
+Migrate Show, View, attachment reads, procedure discovery, CurrentSnapshot, workflow graph access, dependency expansion, ReconcileSearchIndex and mutation preparation through shared acquisition where they need source access. Each independent session operation acquires anew. Materialized immutable values may survive release; attachment readers and lazy dependencies may not silently outlive their source. Search acquires authorized home and dependency sources before preparation and uses those same sources for coverage and retrieval. No atomic snapshot across projects is promised.
+
+GraphStore implementations without SnapshotReader retain current-authority reads as explicitly unpinned compatibility. Reject named-branch, exact and causal requests requiring acquired semantics. Never fall back after an acquisition error. Migrate supported local adapters in this change, preserving branch-scoped validation and working ordinary branch reads without mutation acquisition. Resource owners release on success, operation failure, cancellation and partial acquisition failure, joining cleanup errors rather than hiding them. Iterator ownership must make early stop and lifetime limits explicit.
+
+Exact-source indexing and discovery continuations retain reproducible revisions and descriptors rather than live leases. Missing exact sources fail; completed publication still skips source acquisition and embedding. Preparation uses a fixed base revision and Apply checks that expected revision so concurrent advancement conflicts at the boundary. Existing recovery remains separate.
+
+Implementation must demonstrate concurrent branch readers, branch advancement between and during operations, independent authorization, source configuration isolation, dependency and attachment consistency, exact-source restart or unavailability, iterator termination, cleanup errors and preparation/apply conflicts. Keep batching, publication, discovery identity and search preparation behavior intact. Run repository and nested-example tests, vet, lint and build. Delivery includes the API delta, caller/lifetime audit, regression evidence, consumer adoption guidance and separate commit, merge and release status. Consumer Git caches, eviction, durable retention and scheduling are outside this change; broader public changes return to dialogue.

.sdd/graph/2026/09/06-234852-d-tac-vdu.md

@@ -0,0 +1,26 @@
+---
+type: decision
+layer: tactical
+kind: directive
+refs:
+    - id: 20260906-234056-d-tac-bae
+      kind: refines
+    - id: 20260718-185125-s-tac-ddd
+      kind: grounded-in
+    - id: 20260730-171311-d-cpt-0cv
+      kind: related
+participants:
+    - Christopher
+confidence: high
+intent: pending
+topics:
+    - portability/runtime
+    - collaboration/concurrent-work
+summary: 'This tactical directive commits to implementing the acquired-graph read consolidation while preserving the existing write semantics: fresh-read revalidation, three-attempt retry, and merge behavior for concurrent unrelated appends, with no new write validations or rejection rules. It corrects the preparation-revision wording in 20260906-234056-d-tac-bae as a provenance detail rather than a write precondition, grounds the preserved apply behavior in 20260718-185125-s-tac-ddd, and keeps the delivery-redesign direction of 20260730-171311-d-cpt-0cv out of scope, since document-specific preconditions would change the external write contract. All read-API and related commitments from 20260906-234056-d-tac-bae remain in force.'
+---
+
+The acquired graph reads implementation preserves current write behavior and the external consumer's GraphStore.Apply contract, correcting the preparation-revision wording in 20260906-234056-d-tac-bae.
+
+Preparation reads a fixed source, but its revision remains provenance rather than a new write precondition. Preserve the existing fresh-read, revalidation and retry behavior documented in 20260718-185125-s-tac-ddd. Concurrent unrelated appends must retain today's merge behavior. Introduce no new write validations or configuration-based rejection rules; keep existing genuine conflict handling, retry limits and recovery semantics.
+
+The broader delivery redesign in 20260730-171311-d-cpt-0cv remains outside this implementation because removing whole-graph CAS and adding document-specific preconditions changes the external write contract. Its direction remains active. This scope correction prevents a read-consistency change from becoming a write-semantics migration. All accepted read API, configuration, local adapter and source-lifetime commitments in 20260906-234056-d-tac-bae still apply, and this refinement closes with that implementation.

.sdd/graph/2026/09/07-102247-s-tac-0br.md

@@ -0,0 +1,22 @@
+---
+type: signal
+layer: tactical
+kind: done
+closes:
+    - 20260906-234056-d-tac-bae
+    - 20260906-234852-d-tac-vdu
+participants:
+    - Christopher
+confidence: high
+topics:
+    - implementation/engine
+    - implementation/mcp
+    - implementation/search
+summary: 'Implemented operation-scoped acquired graph reads with authoritative source configuration, branch-aware attachments, and read-only local branch acquisition in commit `0701f288`. This closes the acquired-graph read consolidation directive (20260906-234056-d-tac-bae) together with the write-preservation refinement (20260906-234852-d-tac-vdu): callers share and release the selected source per operation, and existing write revalidation and retry behavior is unchanged. A validation record covers acceptance criteria, caller audit, and concurrency evidence; the work is committed on `codex/acquired-graph-views` but not yet merged or released.'
+---
+
+Implemented operation-scoped acquired graph reads with authoritative source configuration, branch-aware attachments and read-only local branch acquisition in commit `0701f288`.
+
+This completes 20260906-234056-d-tac-bae with the write-preservation refinement in 20260906-234852-d-tac-vdu. Read callers share the selected source and release it after materialization or consumption; configuration stays operation-local. Local configuration overrides retain their existing precedence. Current write validation, revalidation and retry behavior remain unchanged.
+
+The [validation and adoption record](./07-102247-s-tac-0br/acquired-views-validation.md) carries the acceptance-criteria coverage, caller audit, concurrency and cleanup evidence, and adapter migration guidance. The implementation is committed on `codex/acquired-graph-views`; local merge and release have not occurred.

.sdd/graph/2026/09/07-102247-s-tac-0br/acquired-views-validation.md

@@ -0,0 +1,67 @@
+# Acquired graph views: delivery evidence
+
+Implements 20260906-234056-d-tac-bae with the write-preservation refinement 20260906-234852-d-tac-vdu.
+
+## API and configuration
+
+- `AcquiredSnapshot.Config *ProjectConfig` supplies immutable committed configuration for one source revision. The application copies language and dependency declarations into an operation-local runtime value. It does not modify the shared runtime or the supplied configuration.
+- `SnapshotData.Config` remains stored document data. It is not interpreted as another effective configuration source. An adapter populating both representations must derive them from the same source.
+- `Config == nil` explicitly selects runtime configuration compatibility. Source configuration errors propagate; they do not select compatibility. Runtime credentials, providers, index settings and write routing remain composition concerns.
+- `ReadAttachmentRequest` adds `Branch` and `BranchFromSession`. MCP forwards both. Paging has no new revision parameter.
+- `SnapshotReader`, `SnapshotReadQuery`, `GraphStore.Apply`, Show/View/Search signatures and consumer search preparation remain intact.
+- The local `GitWorktreeAcquirer` gains a `ReadFactory` and implements `AcquireSnapshot`. A read-only composition can omit its mutation factory. The CLI composes this reader with its current filesystem store, preserving current-authority selection and registered-worktree branch validation.
+
+## Caller and lifetime audit
+
+| Caller | Source ownership |
+| --- | --- |
+| Show, View, Lint, Search | Shared acquisition helper; release after operation, including error paths. |
+| Attachment read | Home source establishes effective dependency scope; selected owner source supplies both entry membership and page bytes; release after paging. |
+| CurrentSnapshot, Info, Procedures | Acquire, materialize immutable value or operation configuration, release. |
+| Workflow graph access | Cache materialized views only within an operation; next operation invalidates the cache. View/entry-chain/procedure injections use the selected graph instead of reacquiring. |
+| Show/workflow dependency graphs | Materialize authorized dependency graphs before the resulting resolver can escape acquisition. No live source resources hide in lazy graph resolution. |
+| Read-side dependency closure | Use acquired home configuration on the session branch and acquired intermediate configuration; check access separately. |
+| ReconcileSearchIndex | Graph, hashing and attachment reads share the lease through reconciliation. |
+| Search preparation, coverage and retrieval | Same authorized acquired home and dependency sources, with callback-scoped target access. A resumed iterator checks expiry before the next source read. |
+| DiscoverSearchEntries | Existing caller-owned lease; caller consumes or stops the iterator before releasing it. |
+| IndexSearchEntry | Existing exact-revision acquisition and already-published shortcut retained. |
+| Mutation preparation | Acquire the target snapshot and release its storage resources once materialized. Preparation revision remains provenance. |
+| Apply retries | Each attempt obtains a fresh materialized snapshot through the helper. Existing revalidation, expected-revision apply, three-attempt retry and recovery logic remain. |
+
+The only application `GraphStore.Current` call outside a pinned wrapper is the explicit legacy current-authority compatibility branch. Named-branch and causal requests reject legacy stores; exact indexing also requires SnapshotReader. An acquisition failure does not fall back to Current.
+
+## Regression evidence
+
+- `TestAcquiredReadsUseReadAuthorityAndRelease`: Show, View, text search, attachment, snapshot, procedure and info reads use acquired sources. The mutation acquisition port refuses access and live Current/attachment reads fail if called.
+- `TestAcquiredConfigurationIsPerOperationAndHasOneAuthority`: acquired configuration overrides read settings, empty dependencies remove the runtime list, nil compatibility restores runtime settings, and conflicting SnapshotData.Config does not become another authority.
+- `TestSourceConfigurationCannotGrantDependencyAccess`: a source dependency declaration cannot override an access denial.
+- `TestAttachmentOperationPinsSourceAcrossBranchAdvance`: two readers observe their own revision and attachment bytes while the branch advances.
+- `TestWorkflowServeUsesOneViewAndRefreshesNextOperation`: one framing uses one source; the next operation sees the newer source and configuration.
+- `TestAcquiredReadFailuresKeepCleanupErrors`, `TestAcquiredReadCancellationReleasesSource`: operation errors, partial acquisition and cancellation release their source and preserve cleanup errors.
+- `TestLegacyReadsRejectBranchAndCausalSelection`: current reads remain available while unsupported guarantees fail explicitly.
+- `TestGitWorktreeReadAcquisitionWithoutMutationFactory`: real registered branches remain readable with no mutation factory; unregistered branches fail.
+- Existing search/index tests cover fixed preparation targets, exact-source publication, retained-source lifetime, restart and publication shortcuts, indexing interruption, cursor scope and incomplete coverage.
+- Existing interleaved-capture, prepared-transition, retry-exhaustion and summary-replacement tests preserve today's write behavior. Unused unavailable dependencies do not become a new write gate.
+- `ExampleAcquiredSnapshot` demonstrates loading graph and committed configuration from one immutable filesystem tree and pairing its attachment reader with the acquired snapshot.
+
+## Adoption
+
+Hosted compositions implement SnapshotReader on the runtime graph store, return configuration from the selected source, preserve branch/exact/causal selection and retain source availability independently of active leases. Cache loaded immutable graphs by project/revision and loader configuration, never by session; keep authorization separate. Released leases must not invalidate another reader.
+
+Local language and dependency configuration, including local overrides, keep their runtime precedence through explicit nil Config. Named-branch graph-directory lookup continues using the local configuration resolver. The local filesystem revision pins graph/attachment bytes, not committed repository configuration, and historical sources are not durable across process restart. No local configuration precedence change is introduced.
+
+The broader whole-graph CAS removal is not part of this delivery. Consumer write semantics, provider batching, publication identity and scheduling responsibilities remain unchanged.
+
+## Verification and status
+
+Implementation commit: `0701f288` on `codex/acquired-graph-views`.
+
+- `devbox run test`: passed root module and `examples/extendingsdd`.
+- `go vet ./...` through Devbox: passed.
+- `devbox run lint`: passed; only existing test-package convention warnings.
+- Focused `go test -race` for acquired reads, source configuration, concurrent attachment reads, workflow view reuse, local branch reads and interleaved captures: passed.
+- `devbox run build`: passed.
+- Fresh binary `sdd view --layout 'rank(by(date)):n(3):brief:as-list'`: passed.
+- `git diff --check`: passed.
+
+At completion preparation, the implementation is committed locally, not merged, pushed or released. The implementation procedure owns the subsequent landing status.

.sdd/graph/2026/09/07-104837-s-tac-jlh.md

@@ -0,0 +1,21 @@
+---
+type: signal
+layer: tactical
+kind: question
+refs:
+    - id: 20260906-234056-d-tac-bae
+      kind: surfaced-by
+    - id: 20260606-004059-d-tac-d21
+      kind: related
+participants:
+    - Christopher
+confidence: high
+topics:
+    - agent/ux
+    - portability/mcp
+summary: Question of whether local MCP attachment reads should retain filesystem paths alongside paged content, since direct file access lets agents extract information via scripts with potentially fewer tokens and tool turns. It surfaced from the branch-read review in 20260906-234056-d-tac-bae and relates to the CLI-owned attachment read surface split between local paths and remote paged content in 20260606-004059-d-tac-d21. Comparing representative extraction tasks could settle whether the benefit justifies the local-only behavior; reconsidering falls outside the acquired-read implementation.
+---
+
+Should local MCP attachment reads retain filesystem paths alongside paged content?
+
+The branch-read review of 20260906-234056-d-tac-bae raised this question about the local and remote read distinction in 20260606-004059-d-tac-d21. Direct files let agents extract information with scripts and programs, potentially using fewer tokens and tool turns than paged MCP reads. Comparing representative extraction tasks could establish whether that benefit warrants the local-only behavior. Reconsidering it is outside the acquired-read implementation.