SIA v1.8.3 — redaction recovery and btrfs continuity

A redacted agent note no longer leaves the pending publication marker behind the durable redaction total. The accounting updates pending pulse and dream targets in the same memo write and refuses any attempted retraction. When a saved pending marker is invalid, the resident daemon stops visibly instead of retrying indefinitely; other failures retain their normal retry behavior. Recovery errors identify the disagreeing count.

An already-stranded installation needs the documented one-time recovery procedure before it can pass readiness. Installing this release alone does not repair that prior state. See CHANGELOG.md, Recovering a machine that is already stuck.

This release also includes the btrfs continuity change already merged in PR #26. Explicit enrollment permits device-only receipt readmission across a btrfs remount after checking the recorded filesystem, subvolume, directory, and adoption identity. It is disabled without enrollment, preserves audit records, and refuses other identity changes. See docs/MANUAL.md for enrollment, upgrade, and revocation. Readiness does not prove a recent backup.

Omarchy installation uses the existing repository command and an explicit guided first-light or update action. This release does not itself confer marketplace verification or remove the marketplace manual-installation override. Those require separate review of the final exact commit and the supported installation boundary.

Validation: all required jobs passed on final main commit 0ba83a00bad240aaa903f3b7598ebb39de2a42c4: https://github.com/AnubisQuantumCipher/sia/actions/runs/36872868744. The earlier interrupted local full-suite run is not cited as a pass.

SIA v1.8.2 — the agent-note lane moves out

A structural release with no change in behaviour: the agent-note lane moves out of the resident library so the library keeps headroom under the marketplace's per-file scan limit.

The agent-note lane moves out

The multi-writer agent-note lane — note materialization, exactly-once redaction accounting and post-commit acknowledgement — now lives in bin/sianotes.py. It moved verbatim, behind the same bind/invoke facade as siasenses and siagraph: sialib binds its namespace into the child and keeps every original name as a delegate, so each caller, and each test that patches one of those names, still reaches the same code.

Why now

sialib.py had 1,269 bytes left before the release guard's 95% headroom line on the marketplace's 524,288-byte per-file scan cap, so the next fix to the library would trip it. The guard names extraction as the repair, not a raised threshold. The library drops from 496,804 to 488,067 bytes.

Runtime rung

sianotes.py is its own sia-runtime-v17 rung rather than a new member of v16, so an installed v16 tree still hashes under v16 and the update stages the new member. The release contract pins the child's exact export set, as it does for every facade child.

This release carries nothing else, per the extraction rule in docs/ARCHITECTURE.md. The fix it makes room for ships as v1.8.3.

SIA v1.8.1 — reviewable commitments and a steadier cockpit

A commitment you can review, a cockpit that stops flickering, and a grading lane
that no longer reports a search it never ran.

Reviewable commitments

Commitments show their full task and calendar due date, explain that overdue is a
review reminder rather than a failure, and offer Review commitment…. The
terminal review reads the current open task through the resident CLI and requires
a written outcome plus explicit confirmation before closing anything. Cancelling
leaves it open, and stale or failed requests never claim completion.
sia intend --show <full-id> exposes the full open task as JSON without internal
storage paths. Review never holds a corpus lock while waiting on you, and never
executes task prose.

A steadier cockpit

Snapshot refresh and graph motion wait until arrival, and the graph image is
painted before presentation so a remap cannot expose uninitialized pixels. The
freshness glow and the root halo move off the main graph canvas onto a dedicated
lighter one driven by native Qt rings, so animating them no longer forces a full
graph repaint. Inspecting a settled node no longer keeps the layout simulation
running.

The graph no longer vanishes for ten seconds a minute. The brainstem republishes
graph.json up to four times a pulse and names the final one in status.json
about eleven seconds after the first write. The cockpit withdrew the graph the
moment the file changed and then refused the newer generation because no status
named it yet, so for roughly eleven seconds of every sixty there was nothing to
look at.

Grading

A claim the engine's CLI would read as a flag is no longer reported as a completed
corpus search. It never ran, so the recall now says so and the take stays open,
which is what GradingEvidenceUnavailable has always specified: only a completed
evidence read may be judged UNRESOLVABLE. Previously such a take was closed and
scored from the organ half of the evidence lane alone, while its published page
still said it had been judged against a signed evidence snapshot.

The guard is also narrower. It rejected every claim opening with a dash, which
silently removed the recall lane from legitimate takes like "-1 regressions will
land by March" that sia take -- … exists to let you register. Measured against
the shipped engine, those run as ordinary searches.

Configuration

mind is accepted as a top-level configuration section, which the shipped
config.example.json already carried.

SIA v1.8.0 — the receipts survive the move

Four reporters and one migrated maintainer machine hit this release where
1.7.8 had never been tested: a 2015 dual-core with no discrete GPU, an Arch
desktop with 1,130 packages, a btrfs box whose subvolume moved, a home
directory carried to a new VM by rsync, a GitHub Actions runner refusing
unprivileged namespaces, a corpus outrunning nine journal shards. Each fix
here is named against the value the report carried, and each refusal that
stays now says which value it refused.

First light and install

Issue #10 (Enor75) reported first light unable
to finish on a CPU-only 2015 Broadwell i5 with integrated Iris 6100: three
nested deadlines (60s per-embedding gbrain, 300s subprocess, the installer's
120s sia ready join) all sat below what a one-time backfill needs there,
surfacing only as an unattributed command exceeded its 120-second runtime deadline. The reporter's own workaround measurement — 52.4s CPU-only vs
22.5s with OLLAMA_IGPU_ENABLE=1 for four ~1500-word inputs — is roughly a
2.3x difference, by their own description, since Ollama silently drops the
integrated GPU unless told. First light now gets a finite, larger completion
ceiling separate from steady-state limits, CPU-only stages emit a
content-free progress heartbeat instead of going silent, and deadline labels
name the command that timed out. A maintainer install against a real
2,191-page corpus completed without being killed — not reproduction on the
reporter's own hardware.

The same issue's item 4 reported that the installer's exact-match
DropInPaths check on ollama.service left no way to set
OLLAMA_IGPU_ENABLE=1 without failing the install. One documented drop-in,
$SYSTEMD_USER_DIR/ollama.service.d/sia-operator.conf, is now accepted — a
regular, owned, 0644/0600, ≤4096-byte file of only
Environment=OLLAMA_<NAME>=<value> lines (OLLAMA_HOST/OLLAMA_MODELS
refused by name), which SIA itself never writes. A read-only notice reads
the unit's recent journal and warns when Ollama runs CPU-only, without
echoing journal content or touching hardware.

Issue #9 (Enor75) reported every fresh install
landing in state degraded: the shipped config.example.json carries a
_comment key inside retrieval, which the validator rejected — the
installer's own example failed its own loader. _comment is now accepted
there like other config blocks, with a regression loading the shipped
example through the real loader.

Issue #8 (joniler) reported omarchy plugin remove deleting uninstall.sh — the only documented teardown — while
sia-brainstem.service, ollama.service, and both backup timers kept
running; llama-server sat at ~172% CPU for hours on the reporting machine.
sia uninstall and sia uninstall --purge now survive checkout removal via
the stable launcher, and the brainstem checks the plugin manifest before
every pulse, taking its existing non-restart exit and pointing at
sia uninstall if registration is missing or unsafe.

An update whose gbrain overlay pin moved (this one) used to refuse every
existing install with "existing private gbrain tree lacks an exact current
release receipt; explicit replacement requires SIA_REPLACE_TOOLCHAIN=1". A
genuine SIA receipt for an earlier pin — the managed-by header and the
digest of exactly the binary beside it — is now an ordinary upgrade: the
installer says it is rebuilding for this release and retains the prior
tree. Unreceipted, foreign or torn trees still require the explicit
consent. When the installer cannot acquire its lifecycle lease it now lists
the processes still using the installed runtime (an hourly continuity run
finishes on its own; an agent's sia MCP connection must be closed).

Continuity

Issue #12 (m10ust) reported continuity failing
every hourly run on an 1,818-page corpus, none of its three stacked errors
naming the value that caused them. The capsule directory entry bound had
been aliased to a 1,024-record limit meant for tailing sources, not a
whole-corpus freeze — issue #7 (ArdonisLLC)
hit the same aliasing independently at 1,130 package pages. The bound is now
independent of source-tail sampling, still governed by capsule's own
record/depth/path/link envelopes. A shard-key defect inspecting only the
first digit of -part-N — rejecting part-10–part-19 and part-100+ —
is fixed across the parser, validator, and shard/benchmark readers. The
corpus receipt's device-number binding, also reported here, is addressed
under storage identity below.

The resident pulse

Issue #13 (m10ust) reported the pulse loop
saturating a core: once a pulse's own work exceeds PULSE_SEC, the loop's
max(5.0, PULSE_SEC - elapsed) wait collapses toward a 5-second floor. The
reporter's own measurement — load average 2.44 and llama-server at 60.5%
CPU for hours at the 60s default, settling to 0.40 load and ~10% CPU at a
locally overridden 900s, for a derived per-pulse cost of roughly 145s
(their figure, derived rather than measured) — is why an overrun cycle now
waits the full configured interval, logging its own monotonic duration and
any overrun wait.

Two related fixes: the last pulse failure is retained in
~/.local/state/sia/pulse-failure.json (redacted, 240 characters) and
shown by sia status/sia ready — a pulse failing every four minutes for
a week was previously visible only in journalctl. Continuity details now
append a closed, named reason code for SIA's own capsule refusals
(corpus-receipt-root-mismatch, capsule-entry-bound, others) instead of
the unattributed message issue #12 described.

Storage identity after a move

Two receipts bind device and inode: the installer's corpus receipt and the
delivery epoch's adoption. A btrfs subvolume change, an rsync, or a
restore by copy changes those numbers — issue #12's exact case — after which
every pulse refused unattributed and reinstalling refused outright.
Refusals now name both identities and the remedy. sia readmit reports the
drift; sia readmit --yes (daemon stopped) rewrites the corpus receipt's
root and publishes a sealed readmission.json beside the unchanged
adoption. install.sh re-binds a moved v2 receipt through the existing CAS
journal only under explicit consent
(SIA_READMIT_MOVED_STORAGE=1 ./install.sh); without it, a drifted epoch
still fails with the remedy named. A tailed log with matching fingerprints
but a changed device/inode now continues at its saved offset instead of
replaying from byte zero.

Updating from 1.7.8: every gate the first light hit, named and fixed

The maintainer machine's update was run through the installer thirty-odd
times until first light completed, and each stop was a gate that would have
met every 1.7.8 user with a corpus older than a few weeks:

• A retained status.json from the previous release refused admission
  ("resident status cannot be admitted"); the integrity rule now admits an
  earlier canonical release and still refuses a newer one, and the
  live-publication rejoin and controller status admission rely on it.
• Weekly epochs written by 1.7.x declare a source manifest but no event-id
  roster; the completeness lookup refused every pulse on the first one.
  The roster is reconstructed from the exact retained sources by lineage
  digest (live page or corpus git history) and an unretained source
  refuses by name.
• The event page plan reserved raw bytes plus two base64 projections for
  every day page the cross-day occurrence scan read, exhausting the 16 MiB
  plan ceiling on an organ a few weeks old; scanned pages are bound by
  digest and their bytes released after use.
• The live policy admits 1 MiB of candidate content but a 64 KiB payload;
  one day page past ~60 KB refused every pulse. Such a candidate is now
  ineligible for a slot and the cycle proceeds.
• Capacity admission counted non-ASCII strings character by character in
  Python on every consistency check of a multi-megabyte retained batch,
  which left first light at 96% CPU for half an hour before it reached
  the engine; the count is now arithmetic over C-speed primitives with
  identical results, proven by a property test against the old loops.
• sia pulse and the brainstem rendered state and events_pulse from
  the cycle result; the compact lane returns the completed reader's view,
  so both raised KeyError('state') after memory was already published and
  first light was reported as failed. The compact completion is now
  rendered from the status it published. The live view's post-projection
  rejoin used the legacy reader on that lane and refused the checkpoint
  capture; it uses the checkpoint reader like the first read.
• The compact lane carried every predecessor status error forward forever:
  the maintainer machine stayed degraded on sense_skills and
  corpus_write strings from a 1.7.8 pulse ten days after every later
  capture had admitted that sense and every corpus stage had committed. A
  pulse now resolves exactly the errors it re-attempted (a declared source
  settles its sense_* error, a committed corpus stage settles
  corpus_write) and keeps the rest.
• The compact lane never ran the legacy prelude's provenance convergence,
  so after the filesystem move sia ready refused every memory surface
  with "legacy model-grade provenance migration is pending" and no pulse
  could ever clear it. A fresh compact capture now converges interrupted
  natural-history and grade transactions and legacy take/intent provenance
  first, never inside a captured package's window.
• The installer refused to replace an existing user-editable plugin tree
  only at step 8, after first light, and left the brainstem disabled. A
  read-only preflight names that gate (SIA_REPLACE_PLUGIN=1, or update
  through omarchy plugin update khephri.sia) before step 1.
• Th...

SIA v1.7.3 — continuity explains itself

Continuity now explains its automatic protection directly in the cockpit.

• Shows whether the authenticated automatic schedule is on.
• Shows hourly and weekly last/next timer starts.
• Makes clear that hourly backup needs no button press.
• Explains no-wake sleep behavior and persistent catch-up.
• Renames the manual action to an optional extra copy with immediate deep verification.
• Authenticates both timers and both target services before making a green automatic-backup claim.
• Adds the read-only sia backup schedule interface and explicit WakeSystem=false policy.

Verified by the complete 876-test suite, live v1.7.3 installation, exact loaded-release attestation, and visual inspection of both Continuity surfaces.

SIA v1.7.2 — steady first light

The cockpit and bar now keep the last validated healthy generation visible during routine status refreshes, eliminating the transient installation-check flash.

First-light safety remains fail-closed. Install and update now restart the Omarchy shell while the gate is still closed, require the live cockpit to attest the exact source release, revalidate the installed tree, and only then publish ready.

Validation: QML lint, Omarchy plugin validation, the complete 864-test suite, and a live all-frame cockpit/status-publication check.

SIA v1.7.1 — the memory graph gets its whole sky

SIA’s cockpit graph now holds the cortex at the center and gives semantic branches deterministic room across the whole canvas. Replay truly reseeds memories beside their organs and grows them outward by time, while collision-aware labels stop words from piling over one another. This release also namespaces Qt Quick controls so the cockpit survives a clean Omarchy shell restart.

Verified locally with the complete 862-test suite, QML lint, a clean-shell live install, and visible start/midpoint/completion replay captures. GitHub CI and the pinned real-gbrain contract both pass.

SIA v1.7.0 — clean MCP tool names

SIA now advertises bare MCP tool names, so clients show the clean public surface sia.ask, sia.search, sia.recall, sia.status, sia.think, sia.note, sia.propose_take, and sia.calibration instead of sia.sia_*.

Legacy raw sia_* names remain accepted as hidden inbound aliases for existing sessions, but they are never advertised. Restart or reconnect MCP clients after updating so cached discovery refreshes. The README, Field Manual, agent skill, and release metadata all carry the migration.

Verified by the observed 859-test suite, a successful live v1.7.0 install, sia ready, and a direct resident tools/list response containing only the clean names.

SIA v1.6.0 — the exports lane leaves the monolith

First module extraction (roadmap Phase 2). No behavior change: ~1,000 lines of graph projection, two-lane domain-edge inference, corpus_edges, and export_graph move from bin/sialib.py into the new bin/siagraph.py via the same bind/invoke façade siasenses uses. sialib.py drops from 517 KB to 477 KB (98.6% → ~91% of the 512 KB marketplace scan cap).

Chosen by measurement, not guess: four parallel extraction maps ran before any cut, and the exports lane scored decisively cleanest, so it led rather than the originally-listed thought-recovery cluster. A sia-runtime-v5 member set was added to all four runtime-digest routines and the installer file lists so a partial tree cannot validate as an older complete one. Verified by the 857-test suite and a façade-identity smoke (the GraphProjectionPending exception is one shared class across the module boundary). See docs/ARCHITECTURE.md for the revised extraction order and CHANGELOG for the full record.

SIA v1.5.2 — the instruments spoke, the policy moved

The first execution of the roadmap's self-study phase. The nightly tripwire warning was investigated with a full three-system decomposition; the probe set grew from 13 to 22 organ-gated probes; and on the extended set the associative rerank measured uniformly below plain dense retrieval — so, per the hypothesis-lane freeze rule, it now ships default-off behind retrieval.associative_rerank, with the numbers and the re-promotion condition recorded in WHITEPAPER §4.3. The rehearsal-efficacy instrument (sia memory --efficacy) ships with its first datapoint, the calibration lane is unblocked (the configured codex judge was refused by design; claude is now configured and the first live grading pass ran, honestly UNRESOLVABLE), and sia take --help no longer registers a take. See CHANGELOG for the full record.