Improve Alden knowledge, context and source-preserving retrieval

[twoimo]

Alden's graph and retrieval keep retained links, authored content and collection metadata distinct. URL-only records remain searchable references with unverified destination bodies. Numeric platform tails are folded apart from authored text without deleting source bytes, and overview labels prefer saved topics/content over generic video/channel metadata. A selected-node internal-ID fallback remains open.

Validated affinity neighbors are allocated to previously uncovered nodes before filling remaining ranked capacity, with the same endpoint degree limit as the renderer. On the retained real vector snapshot, effective incident nodes increased from 491 to 1,227 while all 1,024 selected pairs reached the engine. Mean cosine changed from 0.949075 to 0.931299; initial and incremental geometry results were mixed. Pair sampling, permissions, vector/content proofs and the 0.65 threshold remain explicit. These are layout links, not identity merges or independently validated semantic facts.

The standalone affinity endpoint in installed 117 hit the8-second CPU limit. Version 118 reuses a verified root descriptor and parsing only within one request. Every cancellation check still validates the current private root and opens, validates and reads the state file afresh; only identical raw bytes reuse a frozen parsed state. Root replacement, unsafe files and closed callbacks fail closed. Cancellation frequency and 8 CPU seconds / 20 wall seconds / 128 MiB limits are unchanged. Existing one-shot readers and writers retain their contract, with descriptor cleanup added for exceptional root validation.

Quality inspection retains its permissions, snapshot/order/sample contracts and 10-second limit. Graph rendering uses restrained backgrounds, bounded labels, one toolbar and mass/anchor damping for disconnected nodes. Owned native audits capture each click's exact navigation origin. Input/turn handling preserves the first owned model-attempt observation without restoring superseded replies or replacing terminal receipts. Product default remains Gemini 3.8 Flash/high/manual with conditional local-model admission.

Local runtime 118 source is 0fc0eb5101d82e8628dddc37c9a76d7338d6caf1. Related Python 322 and exact-source CI 38718493621 four jobs passed; canonical build took 77.962 seconds. Candidate native passed in 92.295 seconds, including actual 1,024 semantic pairs / drop 0, settling/idle and all three exact navigation restorations at default/compact sizes. Eight relevant candidate graph/source/quality/model-menu images were directly inspected; all 34 newly generated images are retained. Previous 117 full 68-image review remains historical, not 118 visual proof.

Source/candidate/installed standalone affinity calls returned the same 1,024 candidates, node proofs, binding, scope and coverage. Their CPU times were 6.323 / 4.042 / 7.618 seconds and wall times 11.522 / 6.609 / 12.273 seconds, n=1 each. Conditions were not classified cold/warm, installed CPU headroom is limited, and no request speedup/p95/whole-app claim follows. A separate private-reader ABBAABBA microbenchmark (20,000 calls per batch, four batches per variant) had median CPU 0.925797→0.604386 seconds. Original 117 CPU-budget failure and diagnostic profile remain retained.

Installed native passed in 113.590 seconds with the same actual affinity/rest/idle and exact navigation checks. Eight relevant installed graph/source/quality/model-menu captures were directly inspected (16 directly reviewed out of 68 newly generated candidate/installed images). After final native, the installed 76-file/mode manifest, strict deep ad-hoc signature, extracted ZIP, independent 117 recovery, settings, seven targets, policies, existing model listeners, selected collection/retrieval/voice-history tables and protected originals matched. The local arm64 ZIP is 12,988,418 bytes, SHA256 7864e6f23030a7c1a4be8c54e471e7f2689ec0240416e7358c12ffc30adb96c0. Documentation changes do not rebuild or reinstall runtime source 0fc0eb5.

The full 18-item goal remains active. Independent semantic/identity/time gold and calibration, physical primary/tray/voice/Retina interaction, representative CPU/GPU/RAM/battery/p95, broader host/MCP/acquisition, RAM-admitted multimodal models, DPO promotion and valid worker activation remain open. Astra/max review requests were used as requested; the current source review was blocked before inspection and is not a review verdict. Existing label-source reads also await retry approval. No valid DeveloperIDApplication identity is available: the local ad-hoc build is not a notarized/public/production release. Model catalog visibility does not attest all upstream inference.

Details: docs/architecture/alden-affinity-allocation-20261015.md, alden-abort-reader-20261015.md, quality/read-I/O, graph-rest and navigation-origin documents. Exact receipts and failures: task workspace outputs/affinity-allocation-20261015/, outputs/abort-reader-20261015/, outputs/input-races-20261014/. Full-scope progress remains in task outputs/TODOS.md and outputs/STATUS.md.