v0.9.4

What's Changed

• docs(examples): Windows fleet-management MDM example (spelunk-oss^36) by @usercise in #555
• feat(server): fix the embedding model, drop the --embedding-model override (spelunk-oss^119) by @usercise in #554
• ADR-062: temporal / as-of semantic search — recommend drop (oss^69) by @usercise in #557
• Add Scoop managed-install channel for Windows by @usercise in #556
• CLI: default init project slug to derive_project_id (oss^121, ADR-063 §4) by @usercise in #558
• ci: drop unused ast-grep install step by @usercise in #560
• spelunk-oss^120: fix macOS MDM example to bind loopback (--host 127.0.0.1) by @usercise in #559
• feat(bench): harness matrix for SWE-bench rig (--harness none|opencode|claude-code) (spelunk-oss^84) by @usercise in #518
• feat(bench): telemetry aggregation script — per-cell token/cost table (spelunk-oss^88) by @usercise in #553
• ADR-067: fail-closed when no local project (no silent global memory store) by @usercise in #564
• ADR-066: native in-process HTTPS for spelunk-server (reverses ADR-058 Non-goal) by @usercise in #562
• fix(memory): fail closed when no local project (ADR-067, oss^131) [P0] by @usercise in #565
• fix(cli): point solo users at 'spelunk server start', not team server_url, when semantic inference needs a server (oss^133) by @usercise in #566
• fix(search): case-insensitive substring + literal match for zero-setup ast-grep search (oss^130) by @usercise in #567
• refactor(config)!: remove deprecated memory_server_url/memory_server_key aliases (oss^144) by @usercise in #568
• fix(context): compact default limits + --budget token cap + cap cross-project appends (oss^143) by @usercise in #569
• test(git-notes): deflake concurrent same-HEAD test — assert real concurrency contract (oss^150) by @usercise in #570
• docs: show how to inspect spelunk's git notes with plain git by @usercise in #571
• feat(server): native in-process HTTPS (--tls-cert/--tls-key) per ADR-066 by @usercise in #573
• fix(cli): don't read the global index from an un-init'd dir (graph/chunks/explore/check) by @usercise in #574
• fix(cli): context --budget keeps durable memory ahead of questions (spelunk-oss^149) by @usercise in #575
• refactor(cli): remove unreachable server_url branch from inference-required message (spelunk-oss^148) by @usercise in #576
• docs: retire the reverse-proxy team-server model for native HTTPS (ADR-066) by @usercise in #577
• ADR-068: keep zero-setup onboarding; add a git-notes memory fallback before init by @usercise in #572
• fix(init): stop writing an uninvited CLAUDE.md into the user's repo (spelunk-oss^141) by @usercise in #579
• fix(bench): portable timeout detection in setup_repos.sh (spelunk-oss^153) by @usercise in #581
• chore(deps): bump lopdf from 0.43.0 to 0.44.0 by @dependabot[bot] in #593
• chore(deps): bump regex from 1.12.4 to 1.13.0 by @dependabot[bot] in #592
• chore(deps): bump tree-sitter from 0.26.10 to 0.26.11 by @dependabot[bot] in #590
• chore(deps): bump ast-grep-language from 0.44.0 to 0.44.1 by @dependabot[bot] in #591
• chore(deps): bump uuid from 1.23.4 to 1.23.5 by @dependabot[bot] in #589
• chore(deps): bump ignore from 0.4.27 to 0.4.28 by @dependabot[bot] in #588
• feat(search): point --mode text empty-index error at zero-setup search modes by @usercise in #584
• chore(deps): bump rust from 1.96.1-slim to 1.97.0-slim by @dependabot[bot] in #586
• chore(deps): bump calamine from 0.35.0 to 0.36.0 by @dependabot[bot] in #587
• docs(adr): clarify ADR-059 D1 git-notes collision surface for the custom refs/notes/spelunk ref by @usercise in #583
• docs(adr): revise ADR-068 D3 to the git-notes write-through carrier model by @usercise in #594
• docs(skill): correct worktree index auto-resolution guidance + regression tests by @usercise in #585
• feat(graph): zero-result affordance for empty-dir vs no-match (spelunk-oss^127) by @usercise in #578
• feat(init): configure origin notes refspec so memory travels (spelunk-oss^126, ADR-068) by @usercise in #582
• feat(memory): git-notes fallback for add/list before init (ADR-068 D3, spelunk-oss^154) by @usercise in #580
• fix(graph): reword live-scan empty message and point at the full index by @usercise in #597
• feat(init): import git-notes memory into memory.db on init (spelunk-oss^155, ADR-068) by @usercise in #595
• docs(changelog): strip internal board ids from public CHANGELOG by @usercise in #596
• fix(server): reliable stop of wedged daemon, no port drift, single-instance guard by @usercise in #599
• chore(cli): drop pre-1.0 older-build/upgrade advice from embed messages by @usercise in #603
• fix(context): dedup convention records per (language, category) by @usercise in #600
• feat(cli): trust self-signed / internal-CA team-server certs via SPELUNK_SERVER_CA by @usercise in #601
• docs(adr): ADR-069 share spelunk memory on git push via an opt-in hook + tracking refspec by @usercise in #604
• fix(docker): repair the self-hosted Quick-Start build + compose path by @usercise in #602
• ADR-068 amendment: canonical content-addressed identity for memory entries by @usercise in #598
• docs: remove Docker and MDM recipes the CLI refuses; add CA trust guidance by @usercise in #607
• Pool convention confidence across .ts/.tsx instead of taking the max of splits by @usercise in #609
• fix(memory): serialize git notes read-modify-write with a common-dir lock (ADR-069 D6, #185) by @usercise in #605
• Derive the .deb Depends from the binaries so the installed spelunk actually starts by @usercise in #608
• chore: remove internal tracker ids from source comments by @usercise in #611
• Run index LLM summaries to completion instead of detaching a thread by @usercise in #610
• docs: drop dangling THREAT-MODEL req #9 citations from the auto-spawn path by @usercise in #612
• Bench: reach the spelunk condition from opencode and claude-code over a local MCP server by @usercise in #614
• fix(memory): set notes.rewriteRef so memory survives git commit --amend and git rebase by @usercise in #613
• Identify memory entries by content-addressed entity_id by @usercise in #606
• docs: remove internal tracker ids from the threat model by @usercise in #615
• fix(memory): tracking-ref fetch refspec + read-path notes merge (ADR-069 D4/D5/D2) by @usercise in #616
• docs(capability-tiers): replace refused http:// examples with verified output by @usercise in #619
• test: isolate ambient global git config in the temp-repo harnesses by @usercise in #620
• Fold duplicate memory entries by identity on the git-notes read path by @usercise in #622
• docs(adr): ADR-069 amendment: publish via a plumbing command, not shell by @usercise in #625
• docs(adr): mark ADR-002's lm_studio_url migration block superseded by @usercise in #623
• test: isolate spelunk-cli git tests from ambient global git config by @usercise in #629
• docs: remove dangling internal tracker refs from public docs by @usercise in #628
• docs(adr): ADR-069 D8: a notes writer that cannot take the lock fails, never proceeds unlocked by @usercise in #626
• fix(index): route detached background-phase diagnostics to a log the user is pointed at by @usercise in #624
• docs(adr): ADR-070: init embed lifecycle and the search warmup contract by @usercise in #627
• docs(adr): ADR-069 D9 - the notes lock's scope on the publish path by @usercise in #618
• feat(memory): publish git notes on push via a plumbing command and hook shim by @usercise in #630
• fix(memory): D8 writer lock policy + failed-note-read clobber guard (fixes the windows-latest entry loss) by @usercise in #632
• feat(server): memory batch push endpoint for CLI wire parity by @usercise in #635
• docs(adr): ADR-071: per-server scoping of the client bearer credential by @usercise in #633
• fix(server): dual-mode /memory/since so spelunk sync's pull half works against OSS by @usercise in #636
• feat(init): implement the ADR-070 embed lifecycle and search warmup contract by @usercise in #638
• fix(capability): name TLS certificate causes instead of flattening them to "unreachable" by @usercise in #639
• release: build Linux artifacts against glibc 2.31 in debian:11 container by @usercise in #634
• docs(capability-tiers): correct exit code and drop unshipped Plan capability by @usercise in #640
• fix: org switch now survives token refresh by @usercise in #641
• feat(index): built-in filter for generated/vendored/machine-data files by @usercise in #642
• feat(status): sync-mode visibility and truthful server-scoped hints by @usercise in #637
• Fix memory push/sync honesty: attempted count, remote_id stamping, and result reconciliation by @usercise in #643
• Fix panic in memory watch when only a loopback server is discovered by @usercise in #644
• Forward the parent's resolved config and index flags to detached child processes by @usercise in #645
• Remove dead read-conventions plumbing command and correct its over-claiming docs by @usercise in #646
• Cut redundant keychain reads that caused repeated macOS auth prompts by @usercise in #649
• Exit non-zero when a push/sync attempt fully fails (follow-up to #643) by @usercise in #648
• Resolve the hooks directory via git, honoring core.hooksPath by @usercise in #647
• release: 0.9.4 by @usercise in #650
• fix(ci): run Linux-container release steps under bash (set -o pipefail fails under dash) by @usercise in #651
• fix(ci): derive .deb Depends inside debian:11 (correct glibc floor) by @usercise in #652
• docs: drop fabricated init return-time estimate by @usercise in #655
• fix(ci): build the .deb with -Zxz (zstd members unreadable on the debian:11 floor) by @usercise in #654

Full Changelog: v0.9.3...v0.9.4