fix: preserve search evidence and asynchronous job ownership

[morluto]

Summary

Make search results, related-work findings, and asynchronous tool results reflect the evidence actually available. This also removes duplicate owners for thread identity, relationship parsing, and ranking expressions, and repairs queued-job ownership across process loss.

This PR follows a repository audit and reproduced defects; no separate issue was supplied.

Problem and expected behavior

Thread search could bury title matches, lose merge-state facts, or apply cursors to a changed query. Evidence lookup also did work proportional to unrelated matches. Related-work checks could turn zero-signal neighbors into findings and report completeness despite missing thread coverage or a bounded candidate population.

Successful indexing could produce an invalid detailed MCP job response; source reads lost completeness metadata, and validation groups lacked readable attempt handoffs. An abandoned queued job remained queued indefinitely, while a running job marked failed by another process could continue executing.

Change and scope

• Preserve title-match relevance, merge knowledge, query-bound pagination, and shared bounded FTS evidence queries.
• Reuse canonical thread identity and relationship parsing; preserve tracking lookup errors and caller state on failure.
• Return truthful MCP artifact references, source completeness, unknown/truncated coverage, and readable validation-group attempts. Similarity findings remain inconclusive and exact zero-score findings are omitted.
• Persist queued jobs with their executor owner; reconcile abandoned queued/running work and stop workers whose durable state is terminal or whose owner is lost.

Review order follows the commits: search; evidence ownership; MCP and job lifecycle; then the requested Go MCP SDK prerelease update.

Contract and boundary impact

• Semantic owner and earliest changed stage: corpus search/evidence selection, canonical reference parsing, related-work evidence conversion, and durable job admission.
• GitHub acquisition, network, or process side effects: existing explicit capabilities remain; corpus reads gain no network or execution.
• Corpus, transaction, projection, pagination, or migration contract: no migration; queued jobs use the existing owner column, reconciliation retains its immediate transaction, and cursors preserve query/ranking identity.
• CLI, TUI, MCP, resource, or serialized schema contract: compact code-index references replace incomplete full artifacts; new validation-group resource; related-work contracts expose truncation and inconclusive similarity evidence.
• Job, retry, cancellation, or concurrency impact: abandoned queued work is terminally reconciled; owner replacement is rejected; cancellation and terminal state stop workers. No automatic replay.
• Security, privacy, credential, or no-execution impact: validation resources omit command/environment/host paths; no GitHub mutation or repository-controlled code execution was introduced into reads/indexing.

Evidence and regression coverage

• Tests added or updated: search ordering/pagination/merge state, bounded evidence lookup, reference parsing, tracking failure preservation, MCP output schemas/resource handoff, missing/bounded related-work coverage, queued ownership and worker cancellation.
• Base reproduction or other evidence: focused regressions failed before the corresponding corrections. A 201-thread case reproduced an empty result falsely claiming completeness after only 200 candidates were examined.
• User-visible CLI/MCP/resource output: all 73 source-build MCP tools were invoked externally in the initial audit, including partial and authentication-blocked outcomes. Rebuilt executable retests corrected the observed artifact and coverage failures. A separate multi-process workload verified running/queued cancellation, graceful shutdown, and reconciliation of four running plus two queued jobs after process loss.
• Remaining proof gaps: external probes used the pre-update SQLite dependency; final repository checks include the current base's SQLite update. No broad judged relevance benchmark, authenticated large-corpus stress test, or Windows process-termination test. Temporary binaries, corpora, and raw logs were removed as requested; reports and regression tests remain.

Validation performed

• make verify — passed with SDK v1.8.0-pre.2 on the current base, including uncached short tests, vet, full lint, module tidiness, generated outputs, and documentation checks.
• go test -race -short -p=1 -parallel=4 -count=1 -timeout 120s ./internal/app ./internal/corpus -run 'Test.*Job|Test.*Owner|Test.*Reconcil|TestRelatedWork|TestDuplicateAndCollision' — passed during the prior audit with SDK v1.7.0 on the updated SQLite base.
• go test -race -short -p=1 -parallel=4 -timeout 600s ./internal/app ./internal/corpus ./internal/mcpserver ./internal/workspace — all four packages passed; this broader audit run used SDK v1.7.0 and began before the upstream SQLite update.
• go test ./internal/mcpserver ./internal/mcpcontract ./internal/mcpadapter ./internal/app — passed with SDK v1.8.0-pre.2.
• go test -race ./internal/mcpserver -run 'TestToolCancellationReachesReader|TestStructuredCancellationIsNotRetryable' -count=1 — passed with SDK v1.8.0-pre.2.
• git diff --check — passed.

Compatibility and safety

• Breaking changes or migration steps: no storage migration. Consumers of embedded code-index manifest fields must read the returned resource; related-work evidence relations now accurately remain inconclusive.
• Storage and side-effect invariants: live owners are preserved; terminal job outcomes are not overwritten; interrupted operations are not replayed.
• Generated output or release impact: generated outputs are current. Official Go MCP SDK is updated to v1.8.0-pre.2; it provides cancellation, teardown, and input-bound hardening but no replacement task runtime/store.
• Performance or resource-budget impact: evidence queries are bounded before excerpt construction. Existing benchmark measurements and their limits are documented in docs/search-audit.md; no new global ranking-quality or concurrency-throughput claim is made.

Review checklist

• The PR has one focused outcome and the title follows type(scope): outcome.
• Related issue is linked, or the reason for not linking one is stated above.
• Tests cover changed observable behavior and meaningful failure paths.
• Documentation, ADRs, or generated contracts are updated where needed.
• Read-only operations do not gain implicit network or process side effects.
• I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T01:09:56.153509Z	7ebb1fc	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7ebb1fc3e1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Treat stale thread coverage as unknown

When stored.SourceUpdatedAt is newer than the completed threads coverage, this returns complete=true, so an empty duplicate or collision result is exposed as complete negative evidence even though the thread snapshot predates the latest repository observation. buildTUISyncStatus already classifies this exact timestamp relationship as stale; apply the same freshness check here before claiming complete coverage.

AGENTS.md reference: AGENTS.md:L12-L16

Useful? React with 👍 / 👎.