fix(search): honor sources.config.federated in unqualified local CLI search/query (#2561)

A source registered with `gbrain sources add --federated` was invisible to
an unqualified `gbrain search`/`gbrain query`: the local CLI always emitted
a scalar {sourceId} scope, and nothing on the read path ever consulted
sources.config.federated — contradicting docs/guides/multi-source-brains.md
('Source participates in unqualified gbrain search results').

Fix, at the trusted-local boundary only:
- src/cli.ts makeContext resolves the source WITH its tier and, when the
  tier is non-explicit (local_path / brain_default / sole_non_default /
  seed_default), computes ctx.localFederatedSourceIds = [resolved source,
  ...other config.federated=true sources] (archived excluded).
- New federatedSearchScope (operations.ts) delegates to
  resolveRequestedScope, then widens an unqualified trusted-local scalar
  scope to that set. Used by the search + query handlers only.
- Expansion NEVER applies when ctx.remote !== false (fail-closed source
  isolation), when a per-call source_id/__all__ is passed, when an OAuth
  grant (allowedSources) is present, or when --source/GBRAIN_SOURCE/dotfile
  named the source explicitly.

Deliberately NOT inside sourceScopeOpts: code-intel ops reject multi-source
scopes (resolveCodeIntelScope) and non-search reads keep their scalar
behavior. Cache contamination is already handled — cacheScopeKey folds
sourceIds sets into the query-cache key.

Fixes #2561

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/cli.ts

@@ -808,12 +808,20 @@ async function makeContext(engine: BrainEngine, params: Record<string, unknown>)
   // 'default'. Wrapped in try/catch so a doctor / single-source brain that
   // never set up sources still returns 'default' silently.
   let sourceId: string | undefined;
+  // #2561: when the source resolved via a NON-explicit tier (path-match /
+  // brain default / sole-non-default / seed default), unqualified search-shaped
+  // reads span every `config.federated = true` source. Computed here (the
+  // trusted local boundary) and consumed by federatedSearchScope in
+  // operations.ts, which additionally gates on ctx.remote === false.
+  let localFederated: string[] | undefined;
   try {
-    const { resolveSourceId } = await import('./core/source-resolver.ts');
+    const { resolveSourceWithTier, localFederatedSourceIds } = await import('./core/source-resolver.ts');
     // params.source is set when a CLI flag was parsed for the op (rare; most
     // CLI ops don't take --source). Falls through to env/dotfile/path-match.
     const explicit = (params.source as string | undefined) ?? null;
-    sourceId = await resolveSourceId(engine, explicit);
+    const resolved = await resolveSourceWithTier(engine, explicit);
+    sourceId = resolved.source_id;
+    localFederated = await localFederatedSourceIds(engine, resolved.source_id, resolved.tier);
   } catch {
     // Source resolution failed (e.g. sources table doesn't exist on a fresh
     // pre-init brain). Leave sourceId unset; engine read methods fall through
@@ -834,6 +842,7 @@ async function makeContext(engine: BrainEngine, params: Record<string, unknown>)
     // table). Matches dispatch.ts's auto-fill so the contract holds across
     // every transport.
     sourceId: sourceId ?? 'default',
+    ...(localFederated ? { localFederatedSourceIds: localFederated } : {}),
   };
 }
 

src/core/cycle/synthesize.ts

@@ -428,13 +428,8 @@ export async function runPhaseSynthesize(
 
     const queue = new MinionQueue(engine);
     const childIds: number[] = [];
-    /**
-     * Map child job_id → transcript metadata. Drives D6 orchestrator-side
-     * slug rewrite for chunked transcripts AND the deterministic frontmatter
-     * stampDreamProvenance merges into each written page. Populated for
-     * every child (single-chunk children carry chunkTotal=1).
-     */
-    const childMeta = new Map<number, ChildMeta>();
+    /** Map child job_id → chunk metadata for D6 orchestrator-side slug rewrite. */
+    const chunkInfo = new Map<number, { idx: number; hash6: string }>();
     /** Skip reasons for the cycle report (D5 cap hits, D8 legacy-key skips). */
     const skipReports: Array<{ filePath: string; reason: string }> = [];
 
@@ -518,14 +513,9 @@ export async function runPhaseSynthesize(
           { allowProtectedSubmit: true },
         );
         childIds.push(child.id);
-        childMeta.set(child.id, {
-          idx: i,
-          hash6,
-          chunkTotal: chunks.length,
-          transcriptSource: t.transcriptSource,
-          transcriptId: stripContentVersionSuffix(t.basename),
-          inferredDate: t.inferredDate,
-        });
+        if (isChunked) {
+          chunkInfo.set(child.id, { idx: i, hash6 });
+        }
       }
     }
 
@@ -554,14 +544,14 @@ export async function runPhaseSynthesize(
 
     // Collect slugs from put_page tool executions across the children
     // (codex finding #2: deterministic provenance, NOT pages.updated_at).
-    // D6 orchestrator slug rewrite: childMeta drives post-hoc rewrite of
+    // D6 orchestrator slug rewrite: chunkInfo drives post-hoc rewrite of
     // bare-hash slugs to `<hash6>-c<idx>` so chunked siblings can't collide
     // even if Sonnet drops the chunk suffix.
     // v0.32.8: refs carry source_id so reverseWriteRefs picks the correct
     // (source, slug) row. #1586: refs are stamped with the cycle's resolved
     // source (children write there via SubagentHandlerData.source_id).
     const cycleSourceId = opts.sourceId ?? 'default';
-    const writtenRefs = await collectChildPutPageSlugs(engine, childIds, childMeta, cycleSourceId);
+    const writtenRefs = await collectChildPutPageSlugs(engine, childIds, chunkInfo, cycleSourceId);
 
     const summaryDate = opts.date ?? today();
 
@@ -569,12 +559,7 @@ export async function runPhaseSynthesize(
     // of every child-written page BEFORE reverse-rendering, so generated pages
     // are queryable (`frontmatter->>'dream_generated'`) and a later put_page
     // write-through (which re-renders from the DB row) can't erase the stamp.
-    // #2285: the stamp also carries the orchestrator-owned deterministic
-    // frontmatter (transcript_id, transcript_source, transcript_hash, date,
-    // chunk) derived from childMeta — subagent drift on those fields can't
-    // leak, and reverseWriteRefs below re-reads the row so the same fields
-    // land in the on-disk markdown.
-    await stampDreamProvenance(engine, writtenRefs, summaryDate, childMeta);
+    await stampDreamProvenance(engine, writtenRefs, summaryDate);
 
     // Dual-write: reverse-render each DB row → markdown file.
     const reverseWriteCount = await reverseWriteRefs(engine, opts.brainDir, writtenRefs, cycleSourceId);
@@ -1110,17 +1095,15 @@ function sanitizeForSlug(s: string): string {
  * fake"): we no longer need detection because the rewrite enforces
  * uniqueness at slug-write time.
  *
- * `childMeta` maps child job_id → per-child transcript metadata. Chunked
- * children (chunkTotal > 1) get the slug rewrite; single-chunk children
- * pass through unchanged. Each returned ref carries the job_id that wrote
- * it so stampDreamProvenance can pair the slug back to its childMeta entry.
+ * `chunkInfo` maps child job_id → { chunk_index, hash6 }. Single-chunk
+ * children are absent from the map and pass through unchanged.
  */
 async function collectChildPutPageSlugs(
   engine: BrainEngine,
   childIds: number[],
-  childMeta: Map<number, ChildMeta>,
+  chunkInfo: Map<number, { idx: number; hash6: string }>,
   sourceId = 'default',
-): Promise<Array<{ slug: string; source_id: string; jobId: number }>> {
+): Promise<Array<{ slug: string; source_id: string }>> {
   if (childIds.length === 0) return [];
   // Raw fetch — NO SELECT DISTINCT. Preserves per-child slug duplicates so
   // the orchestrator sees what each child wrote. COALESCE handles both
@@ -1139,73 +1122,16 @@ async function collectChildPutPageSlugs(
        FROM subagent_tool_executions
       WHERE job_id = ANY($1::int[])
         AND tool_name = 'brain_put_page'
-        AND status = 'complete'
-      ORDER BY id`,
+        AND status = 'complete'`,
     [childIds],
   );
-  const rewritten = new Map<string, number>();
+  const rewritten = new Set<string>();
   for (const r of rows) {
     if (typeof r.slug !== 'string' || r.slug.length === 0) continue;
-    const meta = childMeta.get(r.job_id);
-    const finalSlug = meta && meta.chunkTotal > 1
-      ? rewriteChunkedSlug(r.slug, meta.hash6, meta.idx)
-      : r.slug;
-    // Last writer wins, in execution-row order (ORDER BY id): if two children
-    // collide on a final slug, the pages row holds the LAST put_page write, so
-    // the stamp must attribute that child's transcript — not an arbitrary one.
-    rewritten.set(finalSlug, r.job_id);
+    const ci = chunkInfo.get(r.job_id);
+    rewritten.add(ci ? rewriteChunkedSlug(r.slug, ci.hash6, ci.idx) : r.slug);
   }
-  return [...rewritten.entries()]
-    .sort(([a], [b]) => a.localeCompare(b))
-    .map(([slug, jobId]) => ({ slug, source_id: sourceId, jobId }));
-}
-
-/**
- * Per-child orchestrator state. Drives D6 chunked-slug rewrite (idx + hash6)
- * AND the deterministic frontmatter stampDreamProvenance merges into each
- * written page. Populated for every child, not just chunked ones.
- */
-interface ChildMeta {
-  idx: number;
-  hash6: string;
-  chunkTotal: number;
-  transcriptSource: string | null;
-  transcriptId: string;
-  inferredDate: string | null;
-}
-
-/**
- * Strip the content-version suffix that claude-code-archive appends when a
- * conversation is edited (`<uuid>--<contentHash>.md`). The session UUID is
- * the stable transcript identifier; the suffix changes with content. Used to
- * populate `transcript_id` so edits of the same session collapse to one id.
- */
-function stripContentVersionSuffix(basename: string): string {
-  return basename.replace(/--[a-f0-9]+$/i, '');
-}
-
-/**
- * Deterministic frontmatter for one synthesized page (#2285). Every field
- * here is owned by the orchestrator — the subagent's value for any of these
- * is overwritten. The subagent retains authority over type / title / tags /
- * body. `date` feeds the effective-date precedence chain
- * (src/core/effective-date.ts) so re-imports keep the conversation date even
- * when sync tools re-stamp file mtimes.
- */
-function buildDeterministicFrontmatter(
-  meta: ChildMeta,
-  cycleDate: string,
-): Record<string, unknown> {
-  const overrides: Record<string, unknown> = {
-    dream_generated: true,
-    dream_cycle_date: cycleDate,
-    transcript_id: meta.transcriptId,
-    transcript_hash: meta.hash6,
-  };
-  if (meta.transcriptSource) overrides.transcript_source = meta.transcriptSource;
-  if (meta.chunkTotal > 1) overrides.chunk = `${meta.idx + 1}/${meta.chunkTotal}`;
-  if (meta.inferredDate) overrides.date = meta.inferredDate;
-  return overrides;
+  return Array.from(rewritten).sort().map(slug => ({ slug, source_id: sourceId }));
 }
 
 /**
@@ -1251,19 +1177,12 @@ async function hasLegacySingleChunkCompletion(
  */
 async function stampDreamProvenance(
   engine: BrainEngine,
-  refs: Array<{ slug: string; source_id: string; jobId?: number }>,
+  refs: Array<{ slug: string; source_id: string }>,
   cycleDate: string,
-  childMeta?: Map<number, ChildMeta>,
 ): Promise<void> {
   if (refs.length === 0) return;
   const { executeRawJsonb } = await import('../sql-query.ts');
-  for (const { slug, source_id, jobId } of refs) {
-    // #2285: when the ref pairs back to a child, the stamp also carries the
-    // orchestrator-owned deterministic frontmatter for that transcript.
-    const meta = jobId !== undefined ? childMeta?.get(jobId) : undefined;
-    const stamp = meta
-      ? buildDeterministicFrontmatter(meta, cycleDate)
-      : { dream_generated: true, dream_cycle_date: cycleDate };
+  for (const { slug, source_id } of refs) {
     try {
       await executeRawJsonb(
         engine,
@@ -1271,7 +1190,7 @@ async function stampDreamProvenance(
             SET frontmatter = COALESCE(frontmatter, '{}'::jsonb) || $3::jsonb
           WHERE slug = $1 AND source_id = $2`,
         [slug, source_id],
-        [stamp],
+        [{ dream_generated: true, dream_cycle_date: cycleDate }],
       );
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e);

src/core/cycle/transcript-discovery.ts

@@ -10,7 +10,7 @@
  */
 
 import { readFileSync, readdirSync, statSync } from 'node:fs';
-import { join, basename, dirname } from 'node:path';
+import { join, basename } from 'node:path';
 import { createHash } from 'node:crypto';
 import { pruneDir } from '../sync.ts';
 
@@ -23,22 +23,8 @@ export interface DiscoveredTranscript {
   content: string;
   /** Filename basename without extension; used as a topic-slug seed. */
   basename: string;
-  /**
-   * Inferred conversation date (YYYY-MM-DD) or null. Precedence: the
-   * `| First message | <ISO> |` row in the transcript's `## Metadata`
-   * table (stable across mtime-restamping re-syncs) wins; a leading
-   * `YYYY-MM-DD` in the basename is the fallback.
-   */
+  /** Inferred date if the basename matches `YYYY-MM-DD...` (or null). */
   inferredDate: string | null;
-  /**
-   * Transcript source archive name, derived from the path's grandparent
-   * directory (the immediate parent of the date directory). For the
-   * canonical layout `<corpus>/<source>/<date>/<id>.md` this yields the
-   * source-name segment — e.g. `claude-code` for the claude-code-archive
-   * output, `meetings` for meeting recordings. Null when the file does
-   * not live under a `<source>/<date>/` pair (ad-hoc inputs).
-   */
-  transcriptSource: string | null;
 }
 
 export interface DiscoverOpts {
@@ -175,36 +161,6 @@ function matchesAnyExclude(text: string, patterns: RegExp[]): boolean {
   return false;
 }
 
-/**
- * Content-based conversation date: the `| First message | <ISO timestamp> |`
- * row claude-code-archive writes into the transcript's `## Metadata` table.
- * Stable across rsync/Dropbox/Syncthing/B2 re-syncs that re-stamp mtime,
- * unlike anything derived from file metadata. Returns YYYY-MM-DD or null.
- */
-const FIRST_MESSAGE_RE = /^\|\s*First message\s*\|\s*(\d{4}-\d{2}-\d{2})/im;
-
-export function inferContentDate(content: string): string | null {
-  const m = FIRST_MESSAGE_RE.exec(content);
-  return m ? m[1] : null;
-}
-
-/**
- * Derive the archive source name from a transcript path. Returns the basename
- * of the directory two levels above the file when the immediate parent is a
- * date directory and the grandparent looks like a source-name slug (lowercase
- * alphanumeric segments separated by hyphens); otherwise null. This pins the
- * canonical claude-code-archive layout `<corpus>/<source>/<date>/<id>.md`
- * without claiming a source for ad-hoc inputs that don't match.
- */
-export function deriveTranscriptSource(filePath: string): string | null {
-  const parentName = basename(dirname(filePath));
-  if (!/^\d{4}-\d{2}-\d{2}/.test(parentName)) return null;
-  const grandparentName = basename(dirname(dirname(filePath)));
-  if (!grandparentName) return null;
-  if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(grandparentName)) return null;
-  return grandparentName;
-}
-
 function listTextFiles(dir: string): string[] {
   // Recursive walk with descent-time pruning (closes codex C12/C13 spec gap).
   // Accepts BOTH .txt and .md per transcript-discovery's domain rules — does
@@ -269,11 +225,8 @@ export function discoverTranscripts(opts: DiscoverOpts): DiscoveredTranscript[]
       const ext = filePath.endsWith('.md') ? '.md' : '.txt';
       const baseName = basename(filePath, ext);
       const dateMatch = DATE_RE.exec(baseName);
-      const filenameDate = dateMatch ? dateMatch[1] : null;
-      // Fast path: date-named files outside the window skip before the read.
-      // ponytail: a date-named file whose content date differs is filtered on
-      // its filename date — acceptable; archive layouts use UUID basenames.
-      if (filenameDate && !isInDateRange(filenameDate, opts)) continue;
+      const inferredDate = dateMatch ? dateMatch[1] : null;
+      if (!isInDateRange(inferredDate, opts)) continue;
 
       let content: string;
       try {
@@ -288,17 +241,12 @@ export function discoverTranscripts(opts: DiscoverOpts): DiscoveredTranscript[]
       }
       if (matchesAnyExclude(content, excludeRes)) continue;
 
-      // Content-metadata date wins (survives mtime restamps); filename next.
-      const inferredDate = inferContentDate(content) ?? filenameDate;
-      if (!isInDateRange(inferredDate, opts)) continue;
-
       results.push({
         filePath,
         contentHash: hashContent(content),
         content,
         basename: baseName,
         inferredDate,
-        transcriptSource: deriveTranscriptSource(filePath),
       });
     }
   }
@@ -342,7 +290,6 @@ export function readSingleTranscript(
     contentHash: hashContent(content),
     content,
     basename: baseName,
-    inferredDate: inferContentDate(content) ?? (dateMatch ? dateMatch[1] : null),
-    transcriptSource: deriveTranscriptSource(filePath),
+    inferredDate: dateMatch ? dateMatch[1] : null,
   };
 }

src/core/operations.ts

@@ -424,6 +424,23 @@ export interface OperationContext {
    * satisfied even on single-source brains.
    */
   sourceId: string;
+  /**
+   * #2561 — federated read scope for UNQUALIFIED local CLI reads.
+   *
+   * Set ONLY by the local CLI's context builder (src/cli.ts makeContext), and
+   * only when the source resolved via a non-explicit tier (local_path /
+   * brain_default / sole_non_default / seed_default — NOT --source, NOT
+   * GBRAIN_SOURCE, NOT a .gbrain-source dotfile). Contains the resolved
+   * source first, then every other `config.federated = true` source, so an
+   * unqualified `gbrain search "X"` spans federated sources as
+   * docs/guides/multi-source-brains.md promises.
+   *
+   * Consumed exclusively by `federatedSearchScope` and ONLY when
+   * `ctx.remote === false` — a remote caller's scope stays governed by
+   * `ctx.auth.allowedSources` / scalar `ctx.sourceId` (source-isolation
+   * invariant, fail-closed).
+   */
+  localFederatedSourceIds?: string[];
 }
 
 /**
@@ -539,6 +556,45 @@ export function resolveRequestedScope(
   return sourceScopeOpts(ctx);
 }
 
+/**
+ * #2561 — source scope for the search-shaped read ops (`search`, `query`).
+ *
+ * Delegates to `resolveRequestedScope` (the single trust+grant resolver), then
+ * widens an UNQUALIFIED trusted-local scalar scope to the CLI-computed
+ * federated set (`ctx.localFederatedSourceIds`, resolved source first). This is
+ * what makes `sources add --federated` mean something for local search: a
+ * federated source participates in unqualified `gbrain search "X"` results.
+ *
+ * The expansion NEVER applies when:
+ *   - the caller is not strictly trusted-local (`ctx.remote !== false`) —
+ *     remote scope stays grant-governed (fail-closed source isolation);
+ *   - a per-call `source_id` was passed (explicit wins, including `__all__`);
+ *   - the resolver already produced a federated array (OAuth grant);
+ *   - the CLI resolved the source from an explicit signal (--source / env /
+ *     dotfile) — makeContext leaves `localFederatedSourceIds` unset then.
+ *
+ * Deliberately NOT inside `sourceScopeOpts`: code-intel ops collapse a
+ * multi-element scope to an error (`resolveCodeIntelScope`), and non-search
+ * reads (get_page, get_links, …) keep their long-standing scalar behavior.
+ */
+export function federatedSearchScope(
+  ctx: OperationContext,
+  sourceIdParam?: string,
+): { sourceId?: string; sourceIds?: string[] } {
+  const scope = resolveRequestedScope(ctx, sourceIdParam);
+  if (
+    ctx.remote === false &&
+    sourceIdParam === undefined &&
+    scope.sourceId !== undefined &&
+    scope.sourceIds === undefined &&
+    ctx.localFederatedSourceIds !== undefined &&
+    ctx.localFederatedSourceIds.length > 1
+  ) {
+    return { sourceIds: ctx.localFederatedSourceIds };
+  }
+  return scope;
+}
+
 /**
  * Code-intel adapter for `resolveRequestedScope`. Graph traversal
  * (code_callers/code_callees/code_blast/code_flow) is single-source by design —
@@ -1448,7 +1504,8 @@ const search: Operation = {
     const queryText = p.query as string;
     const limit = (p.limit as number) || 20;
     const offset = (p.offset as number) || 0;
-    const scope = sourceScopeOpts(ctx);
+    // #2561: unqualified trusted-local search spans federated sources.
+    const scope = federatedSearchScope(ctx);
 
     // T4/D5 — per-call mode honored ONLY for trusted/local callers so a remote
     // OAuth client can't escalate to the costly tokenmax bundle. Local + unknown
@@ -1610,7 +1667,9 @@ const query: Operation = {
     // is spread into BOTH the image-similarity searchVector path and the text
     // hybridSearch path below, so both honor the same grant.
     const sourceIdParam = typeof p.source_id === 'string' ? p.source_id : undefined;
-    const querySourceScope = resolveRequestedScope(ctx, sourceIdParam);
+    // #2561: unqualified trusted-local query spans federated sources (per-call
+    // source_id / remote grants still resolve through resolveRequestedScope).
+    const querySourceScope = federatedSearchScope(ctx, sourceIdParam);
 
     // v0.27.1: image-similarity branch. Bypasses hybridSearch (which is
     // text-only); embeds the image via embedMultimodal and runs a direct

src/core/source-resolver.ts

@@ -353,6 +353,45 @@ export async function resolveSourceWithTier(
   return { source_id: 'default', tier: 'seed_default' };
 }
 
+/**
+ * #2561 — compute the federated read scope for an UNQUALIFIED local CLI call.
+ *
+ * `sources add --federated` promises that a `config.federated = true` source
+ * "participates in unqualified `gbrain search` results"
+ * (docs/guides/multi-source-brains.md). This helper turns that promise into a
+ * scope: given the resolved source and WHICH tier resolved it, return
+ * `[resolvedSource, ...other federated source ids]` — or `undefined` when the
+ * expansion must not apply:
+ *
+ *   - explicit tiers (`flag` / `env` / `dotfile`): the user named a source;
+ *     scalar scope stands (that IS the qualified case);
+ *   - no other federated source exists: keep the scalar fast path unchanged.
+ *
+ * Archived sources are excluded (same rationale as pickSoleNonDefaultSource);
+ * the archived column is v34+, so fall back to the un-archived query on older
+ * brains. Callers put the result on `OperationContext.localFederatedSourceIds`
+ * — consumed only by `federatedSearchScope` and only when `remote === false`.
+ */
+export async function localFederatedSourceIds(
+  engine: BrainEngine,
+  sourceId: string,
+  tier: SourceTier,
+): Promise<string[] | undefined> {
+  if (tier === 'flag' || tier === 'env' || tier === 'dotfile') return undefined;
+  let rows: Array<{ id: string }>;
+  try {
+    rows = await engine.executeRaw<{ id: string }>(
+      `SELECT id FROM sources WHERE config->>'federated' = 'true' AND archived = false ORDER BY id`,
+    );
+  } catch {
+    rows = await engine.executeRaw<{ id: string }>(
+      `SELECT id FROM sources WHERE config->>'federated' = 'true' ORDER BY id`,
+    );
+  }
+  const ids = [sourceId, ...rows.map((r) => r.id).filter((id) => id !== sourceId)];
+  return ids.length > 1 ? ids : undefined;
+}
+
 /** Exposed for tests. */
 export const __testing = {
   readDotfileWalk,

test/cycle-dream-output-root.test.ts

@@ -26,7 +26,6 @@ const transcript: DiscoveredTranscript = {
   content: 'User: hello world',
   contentHash: 'abcdef0123456789',
   inferredDate: '2026-07-17',
-  transcriptSource: null,
 } as DiscoveredTranscript;
 
 describe('#2415: buildSynthesisPrompt output root', () => {

test/cycle-synthesize-slug-collection.test.ts

@@ -152,94 +152,3 @@ describe('#2569: stampDreamProvenance persists the marker into DB frontmatter',
     await stampDreamProvenance(engine as any, refs, '2026-07-17'); // idempotent
   });
 });
-
-describe('#2285: orchestrator-owned deterministic transcript frontmatter', () => {
-  const meta = {
-    idx: 1,
-    hash6: 'abc123',
-    chunkTotal: 3,
-    transcriptSource: 'claude-code',
-    transcriptId: 'session-uuid',
-    inferredDate: '2026-05-15',
-  };
-
-  test('collectChildPutPageSlugs pairs each ref back to the writing job', async () => {
-    const refs = await collectChildPutPageSlugs(
-      engine as any, [1001], new Map([[1001, { ...meta, chunkTotal: 1 }]]), 'mybrain',
-    );
-    expect(refs.length).toBeGreaterThan(0);
-    for (const r of refs) {
-      expect(r.jobId).toBe(1001);
-      expect(r.source_id).toBe('mybrain'); // #1586: cycle source, never hardcoded 'default'
-    }
-  });
-
-  test('slug collision across children attributes the LAST writer (matches surviving putPage)', async () => {
-    const db = (engine as any).db;
-    // Jobs 1001 then 1002 write the same slug; the pages row would hold
-    // 1002's content (last put_page wins), so the ref must carry jobId 1002.
-    await db.query(
-      `INSERT INTO subagent_tool_executions (job_id, message_idx, tool_use_id, tool_name, status, input)
-       VALUES (1001, 9, 'tool_dup_a', 'brain_put_page', 'complete', $1::jsonb)`,
-      [JSON.stringify({ slug: 'wiki/agents/test/collision', body: 'first' })],
-    );
-    await db.query(
-      `INSERT INTO subagent_tool_executions (job_id, message_idx, tool_use_id, tool_name, status, input)
-       VALUES (1002, 9, 'tool_dup_b', 'brain_put_page', 'complete', $1::jsonb)`,
-      [JSON.stringify({ slug: 'wiki/agents/test/collision', body: 'second' })],
-    );
-    const refs = await collectChildPutPageSlugs(engine as any, [1001, 1002], new Map());
-    const hit = refs.find((r: { slug: string }) => r.slug === 'wiki/agents/test/collision');
-    expect(hit?.jobId).toBe(1002);
-  });
-
-  test('stampDreamProvenance merges the transcript metadata into DB frontmatter', async () => {
-    const slug = 'wiki/originals/ideas/2026-07-17-transcript-meta-abc123';
-    await engine.putPage(slug, {
-      type: 'note',
-      title: 'Meta stamp',
-      compiled_truth: 'body',
-      timeline: '',
-      frontmatter: { keep_me: 'yes', transcript_id: 'subagent-drift' },
-    });
-    await stampDreamProvenance(
-      engine as any,
-      [{ slug, source_id: 'default', jobId: 42 }],
-      '2026-07-17',
-      new Map([[42, meta]]),
-    );
-    const rows = await engine.executeRaw<{ fm: Record<string, unknown> }>(
-      `SELECT frontmatter AS fm FROM pages WHERE slug = $1`, [slug],
-    );
-    const fm = rows[0].fm as Record<string, unknown>;
-    expect(fm.dream_generated).toBe(true);
-    expect(fm.dream_cycle_date).toBe('2026-07-17');
-    expect(fm.transcript_id).toBe('session-uuid'); // orchestrator wins over subagent drift
-    expect(fm.transcript_hash).toBe('abc123');
-    expect(fm.transcript_source).toBe('claude-code');
-    expect(fm.chunk).toBe('2/3');
-    expect(fm.date).toBe('2026-05-15');
-    expect(fm.keep_me).toBe('yes'); // subagent-owned keys survive
-  });
-
-  test('single-chunk children with no inferredDate stamp only the applicable fields', async () => {
-    const slug = 'wiki/originals/ideas/2026-07-17-minimal-meta-abc123';
-    await engine.putPage(slug, {
-      type: 'note', title: 'Minimal', compiled_truth: 'b', timeline: '', frontmatter: {},
-    });
-    await stampDreamProvenance(
-      engine as any,
-      [{ slug, source_id: 'default', jobId: 43 }],
-      '2026-07-17',
-      new Map([[43, { ...meta, chunkTotal: 1, transcriptSource: null, inferredDate: null }]]),
-    );
-    const rows = await engine.executeRaw<{ fm: Record<string, unknown> }>(
-      `SELECT frontmatter AS fm FROM pages WHERE slug = $1`, [slug],
-    );
-    const fm = rows[0].fm as Record<string, unknown>;
-    expect(fm.transcript_id).toBe('session-uuid');
-    expect(fm.chunk).toBeUndefined();
-    expect(fm.transcript_source).toBeUndefined();
-    expect(fm.date).toBeUndefined();
-  });
-});

test/cycle-synthesize.test.ts

@@ -302,7 +302,6 @@ describe('judgeSignificance', () => {
       content: 'A short conversation about something interesting.',
       basename: 'x',
       inferredDate: null,
-      transcriptSource: null,
     };
   }
 
@@ -416,7 +415,6 @@ describe('judgeSignificance — UTF-16 safety (v0.41.13)', () => {
       content,
       basename: 'long',
       inferredDate: null,
-      transcriptSource: null,
     };
   }
 

test/cycle/synthesize-gateway-adapter.test.ts

@@ -45,7 +45,6 @@ const FIXTURE_TRANSCRIPT: DiscoveredTranscript = {
   content: 'Synthetic transcript content for gateway-adapter parity tests.',
   contentHash: 'sha-fixture-1',
   inferredDate: '2026-05-24',
-  transcriptSource: null,
 };
 
 describe('makeJudgeClient — construction-time provider probe', () => {

test/cycle/transcript-discovery-metadata.test.ts

@@ -1,109 +0,0 @@
-/**
- * #2285 — transcript metadata discovery.
- *
- * Pins the two discovery-side additions:
- *   1. `transcriptSource` — derived from the `<source>/<date>/<file>` path
- *      layout; null for ad-hoc inputs that don't match.
- *   2. Content-based date inference — the `| First message | <ISO> |` row in
- *      the transcript's `## Metadata` table wins over the filename-regex
- *      date (stable across mtime-restamping re-syncs); filename is the
- *      fallback.
- *
- * Pure filesystem; no engine, no LLM.
- */
-
-import { describe, test, expect, beforeEach, afterEach } from 'bun:test';
-import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join, dirname } from 'node:path';
-import {
-  discoverTranscripts,
-  readSingleTranscript,
-  deriveTranscriptSource,
-  inferContentDate,
-} from '../../src/core/cycle/transcript-discovery.ts';
-
-let tmpDir: string;
-
-beforeEach(() => {
-  tmpDir = mkdtempSync(join(tmpdir(), 'gbrain-transcript-meta-'));
-});
-
-afterEach(() => {
-  rmSync(tmpDir, { recursive: true, force: true });
-});
-
-function write(relPath: string, body: string): string {
-  const full = join(tmpDir, relPath);
-  mkdirSync(dirname(full), { recursive: true });
-  writeFileSync(full, body);
-  return full;
-}
-
-const FILLER = 'User: hello world. '.repeat(200);
-const METADATA_BLOCK =
-  '## Metadata\n\n| Key | Value |\n| --- | --- |\n| First message | 2026-05-15T03:51:11.584Z |\n\n';
-
-describe('deriveTranscriptSource', () => {
-  test('extracts the source slug from <source>/<date>/<file> layout', () => {
-    expect(deriveTranscriptSource('/corpus/claude-code/2026-06-12/abc.md')).toBe('claude-code');
-    expect(deriveTranscriptSource('/corpus/voice-notes/2026-06-12/xyz.md')).toBe('voice-notes');
-  });
-
-  test('null when the parent dir is not a date dir or grandparent is not a slug', () => {
-    expect(deriveTranscriptSource('/corpus/flat-file.md')).toBeNull();
-    expect(deriveTranscriptSource('/corpus/claude-code/not-a-date/abc.md')).toBeNull();
-    expect(deriveTranscriptSource('/corpus/Not A Slug/2026-06-12/abc.md')).toBeNull();
-  });
-});
-
-describe('inferContentDate', () => {
-  test('parses the | First message | row', () => {
-    expect(inferContentDate(METADATA_BLOCK)).toBe('2026-05-15');
-  });
-  test('null when absent', () => {
-    expect(inferContentDate(FILLER)).toBeNull();
-  });
-});
-
-describe('discoverTranscripts — transcriptSource + date cascade', () => {
-  test('populates transcriptSource per file; null for flat files', () => {
-    write('claude-code/2026-06-12/aaaa.md', FILLER);
-    write('2026-06-12-flat.md', FILLER);
-    const out = discoverTranscripts({ corpusDir: tmpDir, minChars: 100 });
-    const byBase = new Map(out.map(t => [t.basename, t.transcriptSource]));
-    expect(byBase.get('aaaa')).toBe('claude-code');
-    expect(byBase.get('2026-06-12-flat')).toBeNull();
-  });
-
-  test('content First-message date wins over the filename date', () => {
-    write('2026-01-01-named.md', METADATA_BLOCK + FILLER);
-    const out = discoverTranscripts({ corpusDir: tmpDir, minChars: 100 });
-    expect(out).toHaveLength(1);
-    expect(out[0].inferredDate).toBe('2026-05-15');
-  });
-
-  test('filename date remains the fallback when content has no metadata row', () => {
-    write('2026-01-01-named.md', FILLER);
-    const out = discoverTranscripts({ corpusDir: tmpDir, minChars: 100 });
-    expect(out[0].inferredDate).toBe('2026-01-01');
-  });
-
-  test('date filter matches on the content date for UUID-named transcripts', () => {
-    write('claude-code/2026-05-15/uuid-basename.md', METADATA_BLOCK + FILLER);
-    const hit = discoverTranscripts({ corpusDir: tmpDir, minChars: 100, date: '2026-05-15' });
-    expect(hit).toHaveLength(1);
-    const miss = discoverTranscripts({ corpusDir: tmpDir, minChars: 100, date: '2026-05-16' });
-    expect(miss).toHaveLength(0);
-  });
-});
-
-describe('readSingleTranscript — same metadata surface', () => {
-  test('carries transcriptSource and prefers the content date', () => {
-    const p = write('claude-code/2026-05-15/2026-01-01-single.md', METADATA_BLOCK + FILLER);
-    const t = readSingleTranscript(p, { minChars: 100 });
-    expect(t).not.toBeNull();
-    expect(t!.transcriptSource).toBe('claude-code');
-    expect(t!.inferredDate).toBe('2026-05-15');
-  });
-});

test/local-federated-search-scope.test.ts

@@ -0,0 +1,154 @@
+/**
+ * #2561 — sources.config.federated participates in UNQUALIFIED local CLI
+ * search/query.
+ *
+ * Pre-fix: the local CLI always emitted a scalar `{sourceId}` scope (required
+ * field, auto-filled 'default'), so a source registered with
+ * `gbrain sources add --federated` was invisible to an unqualified
+ * `gbrain search "X"` — contradicting docs/guides/multi-source-brains.md
+ * ("Source participates in unqualified `gbrain search` results").
+ *
+ * Fix: the CLI context builder computes `ctx.localFederatedSourceIds`
+ * (resolved source + every other federated source) whenever the source
+ * resolved via a NON-explicit tier; `federatedSearchScope` widens the scalar
+ * scope to that set for the `search` / `query` ops — trusted-local only
+ * (`ctx.remote === false`), never for remote callers, never when a per-call
+ * `source_id` or an explicit --source/env/dotfile was given.
+ */
+import { describe, test, expect, beforeAll, afterAll } from 'bun:test';
+import { PGLiteEngine } from '../src/core/pglite-engine.ts';
+import { localFederatedSourceIds } from '../src/core/source-resolver.ts';
+import {
+  federatedSearchScope,
+  operations,
+  type OperationContext,
+} from '../src/core/operations.ts';
+
+let engine: PGLiteEngine;
+const search = operations.find((o) => o.name === 'search')!;
+
+function ctxOf(overrides: Partial<OperationContext> = {}): OperationContext {
+  return {
+    engine: engine as any,
+    config: {} as any,
+    logger: console as any,
+    dryRun: false,
+    remote: false,
+    sourceId: 'default',
+    ...overrides,
+  };
+}
+
+beforeAll(async () => {
+  engine = new PGLiteEngine();
+  await engine.connect({});
+  await engine.initSchema();
+  // Seeded 'default' source is federated=true. Add:
+  //   wiki    — federated (must join unqualified search)
+  //   private — NOT federated (must stay invisible unless explicitly named)
+  //   oldnews — federated but archived (must stay excluded)
+  await engine.executeRaw(
+    `INSERT INTO sources (id, name, local_path, config) VALUES ('wiki', 'wiki', '/tmp/wiki', '{"federated": true}'::jsonb)`,
+  );
+  await engine.executeRaw(
+    `INSERT INTO sources (id, name, local_path, config) VALUES ('private', 'private', '/tmp/private', '{}'::jsonb)`,
+  );
+  await engine.executeRaw(
+    `INSERT INTO sources (id, name, local_path, config, archived) VALUES ('oldnews', 'oldnews', '/tmp/oldnews', '{"federated": true}'::jsonb, true)`,
+  );
+  const pages: Array<[slug: string, sourceId: string, where: string]> = [
+    ['notes/home', 'default', 'default'],
+    ['wiki/topic', 'wiki', 'wiki'],
+    ['private/topic', 'private', 'private'],
+    ['old/topic', 'oldnews', 'oldnews'],
+  ];
+  for (const [slug, sourceId, where] of pages) {
+    await engine.putPage(slug, {
+      type: 'note', title: `Topic in ${where}`, compiled_truth: `the zebra telescope in ${where}`, frontmatter: {},
+    }, { sourceId });
+    await engine.upsertChunks(slug, [
+      { chunk_index: 0, chunk_text: `the zebra telescope in ${where}`, chunk_source: 'compiled_truth' },
+    ], { sourceId });
+  }
+  // Keyword-only search path: no embedding provider needed in tests.
+  await engine.setConfig('search.mcp_keyword_only', 'true');
+}, 60_000);
+
+afterAll(async () => {
+  if (engine) await engine.disconnect();
+}, 60_000);
+
+describe('localFederatedSourceIds — CLI-side scope computation', () => {
+  test('non-explicit tier: resolved source first, then other federated, archived excluded', async () => {
+    expect(await localFederatedSourceIds(engine, 'default', 'seed_default')).toEqual(['default', 'wiki']);
+  });
+
+  test('non-federated resolved source still joins its own scope', async () => {
+    expect(await localFederatedSourceIds(engine, 'private', 'brain_default')).toEqual(['private', 'default', 'wiki']);
+  });
+
+  test('explicit tiers (--source / env / dotfile) never expand', async () => {
+    expect(await localFederatedSourceIds(engine, 'default', 'flag')).toBeUndefined();
+    expect(await localFederatedSourceIds(engine, 'default', 'env')).toBeUndefined();
+    expect(await localFederatedSourceIds(engine, 'default', 'dotfile')).toBeUndefined();
+  });
+
+  test('single federated source (the resolved one) keeps the scalar fast path', async () => {
+    const solo = { executeRaw: async () => [{ id: 'default' }] } as any;
+    expect(await localFederatedSourceIds(solo, 'default', 'seed_default')).toBeUndefined();
+  });
+});
+
+describe('federatedSearchScope — trust + explicitness matrix', () => {
+  test('trusted local + unqualified widens to the federated set', () => {
+    const ctx = ctxOf({ localFederatedSourceIds: ['default', 'wiki'] });
+    expect(federatedSearchScope(ctx)).toEqual({ sourceIds: ['default', 'wiki'] });
+  });
+
+  test('remote caller NEVER widens (fail-closed), even if the field is set', () => {
+    const ctx = ctxOf({ remote: true, localFederatedSourceIds: ['default', 'wiki'] });
+    expect(federatedSearchScope(ctx)).toEqual({ sourceId: 'default' });
+  });
+
+  test('per-call source_id wins over the federated set', () => {
+    const ctx = ctxOf({ localFederatedSourceIds: ['default', 'wiki'] });
+    expect(federatedSearchScope(ctx, 'wiki')).toEqual({ sourceId: 'wiki' });
+  });
+
+  test('per-call __all__ keeps the whole-brain semantics for trusted local', () => {
+    const ctx = ctxOf({ localFederatedSourceIds: ['default', 'wiki'] });
+    expect(federatedSearchScope(ctx, '__all__')).toEqual({});
+  });
+
+  test('a federated OAuth grant wins over the local set', () => {
+    const ctx = ctxOf({
+      localFederatedSourceIds: ['default', 'wiki'],
+      auth: { allowedSources: ['a', 'b'] } as OperationContext['auth'],
+    });
+    expect(federatedSearchScope(ctx)).toEqual({ sourceIds: ['a', 'b'] });
+  });
+
+  test('no local federated set → unchanged scalar scope', () => {
+    expect(federatedSearchScope(ctxOf())).toEqual({ sourceId: 'default' });
+  });
+});
+
+describe('search op — unqualified local search spans federated sources', () => {
+  test('federated source results appear; non-federated + archived stay invisible', async () => {
+    const ctx = ctxOf({
+      localFederatedSourceIds: await localFederatedSourceIds(engine, 'default', 'seed_default'),
+    });
+    const results = (await search.handler(ctx, { query: 'zebra telescope' })) as Array<{ slug: string }>;
+    const slugs = results.map((r) => r.slug);
+    expect(slugs).toContain('notes/home');
+    expect(slugs).toContain('wiki/topic'); // pre-#2561 this was missing
+    expect(slugs).not.toContain('private/topic');
+    expect(slugs).not.toContain('old/topic');
+  });
+
+  test('explicit source resolution (no federated set on ctx) stays single-source', async () => {
+    const results = (await search.handler(ctxOf(), { query: 'zebra telescope' })) as Array<{ slug: string }>;
+    const slugs = results.map((r) => r.slug);
+    expect(slugs).toEqual(['notes/home']);
+  });
+});

test/progress.test.ts

@@ -216,21 +216,17 @@ describe('progress reporter', () => {
   });
 
   test('only one process-level signal handler installed across many reporters', () => {
-    // Baseline: one handler already installed by prior tests in this file, and
-    // possibly live reporters from OTHER test files sharing this bun process
-    // (shard composition is not this test's invariant — assert the delta, not
-    // an absolute zero, or shard reshuffles make this fail spuriously).
+    // Baseline: one handler already installed by prior tests in this file.
     const installedBefore = __signalHandlerInstalledForTest();
-    const liveBefore = __liveReporterCountForTest();
     const { stream } = sink(false);
     for (let i = 0; i < 50; i++) {
       const p = createProgress({ mode: 'json', stream, minIntervalMs: 0, minItems: 1 });
       p.start(`phase_${i}`, 1);
       p.finish();
     }
-    // After 50 reporter lifecycles, still exactly one handler and zero NET leaked live entries.
+    // After 50 reporter lifecycles, still exactly one handler and zero leaked live entries.
     expect(__signalHandlerInstalledForTest()).toBe(installedBefore || true);
-    expect(__liveReporterCountForTest()).toBe(liveBefore);
+    expect(__liveReporterCountForTest()).toBe(0);
   });
 
   test('startHeartbeat() fires heartbeats and stop() clears', async () => {