GEODE v0.99.333

Added

• geode update now updates persistent uv installs without crossing a
  release series by default. The command detects uv ownership from its tool
  receipt, replaces the standard stored request with
  geode-agent~=CURRENT_VERSION, installs the newest compatible patch, verifies
  the CLI, and restarts a running daemon. --latest is the explicit opt-in for
  minor or major package upgrades. Editable installs still pull, sync, and
  refresh their CLI, but now resolve the GEODE checkout from PEP 610 metadata
  and project identity instead of treating an arbitrary current git repository
  as GEODE source. Registry resolution runs from an isolated temporary directory
  with uv config discovery disabled, so the caller's project configuration
  cannot redirect it. Non-default uv tool and executable directories are
  preserved from the receipt, and verification plus daemon restart use that
  recorded executable even when it is absent from PATH. Customized receipts
  and non-editable direct installs stop instead of silently dropping options or
  changing install mode; source-backed recovery guidance keeps the original
  source reference instead of redirecting the install to PyPI and identifies
  the receipt that holds every custom option. Metadata-free installs no longer
  fall back to the caller's Git checkout. A running daemon stays up until the uv
  replacement passes verification, then restart proceeds only after its old
  socket is confirmed closed and its new socket is confirmed ready.

Fixed

• Docs sidebar keeps its place across page navigation. The independently
  scrolling desktop navigation now restores its position when DocsShell
  remounts, so following a deep docs link no longer jumps the menu to the top.
• Wide docs tables stay inside the mobile viewport. Reference tables now
  scroll horizontally within the article instead of widening the whole page.
• Public release verification handles checksum manifests deterministically.
  The stable-release tail now calls a reusable standard-library verifier that
  strips line terminators before comparing SHA256SUMS, retries complete
  public snapshots, and checks the exact requested PyPI version against the
  annotated tag target and GitHub release assets. Repairing an older immutable
  release no longer depends on whichever package version is currently latest.

Changed

• Homebrew distribution is core-only. The former custom distribution
  repository has been deleted, and release automation, public docs, and the
  distribution skill now forbid recreating a qualified-tap fallback. The
  geode-agent Homebrew/core candidate defaults to Homebrew's current Python
  3.14 formula and must pass strict audit, source build, formula tests, official
  API discovery, and an unqualified clean-machine install before the brew
  command can return to the public installation surface.

• Slack transport rewritten — direct Web API, no MCP subprocess.
  Root cause of the dead Slack surface: the slack MCP server lost a
  startup race on every daemon boot (StdioMCPClient.connect waits at
  most 10s while a warm-cache npx @modelcontextprotocol/server-slack
  spawn measures 10.1s), so the poller's health gate silently disabled
  ALL inbound and outbound Slack while the bot token was valid the whole
  time. New core/messaging/slack_transport.py posts straight to the
  Web API over httpx (chat.postMessage with 39k chunking + threaded
  follow-ups, conversations.history, reactions.add with
  already-reacted tolerance, 429 Retry-After backoff, cached
  auth.test availability, token resolution falling back to the
  global ~/.geode/.env). SlackNotificationAdapter and
  SlackPoller now consume the transport (names and NotificationPort/
  ChannelManager contracts unchanged); the deprecated npm package, the
  10s race, and the MCP health-gate coupling are gone. Inbound stays
  polling — Socket Mode needs an app-level xapp- token the
  deployment does not have yet (documented follow-up).

• Gateway config has a root-level SoT. [gateway] (+ binding
  rules) now loads from the user-level ~/.geode/config.toml as the
  authoritative source with the project .geode/config.toml as an
  explicit overlay (scalar keys override, binding rules append), and the
  hot-reload watcher observes both files. Previously only the project
  file was read, so the daemon's entire Slack surface depended on its
  launchd WorkingDirectory. Boot logs now name the config sources used.

• Notification adapter survives daemon threads.
  get_notification() falls back to a process-wide last-set adapter
  (mirroring the gateway's module global) — send_notification and
  ask/reply publishes from poller/IPC threads previously read a
  thread-empty ContextVar and silently no-oped.

• geode doctor slack diagnoses instead of misreporting. Credential
  checks resolve os.environ THEN the global .env (a valid
  dotenv-stored token was reported "not set"); the stale
  pgrep server-slack process check is replaced by a live
  auth.test probe through the same transport the daemon uses.
  Deleted per the rewrite: MCP tool calls in the poller, the MCP-backed
  Slack adapter body, the legacy constructor shape, and the
  server-slack doctor check. Guards:
  tests/core/messaging/test_slack_transport.py (13),
  tests/core/wiring/test_gateway_config_sot.py (5), migrated
  tests/core/mcp/test_notification_adapters.py.