The embedding stage: candle XLM-RoBERTa FP16 (CandleEmbedder) plus
the batch-oriented EmbedWorker that fills messages.vector /
messages.embedding_model (spec.md#search). One message produces one
vector - there is no chunking.
Canonical text-transcript rendering for pond_search / pond_get
responses, shared by the MCP transport and the pond CLI so both surfaces
emit one identical readable format (spec.md#protocol). The structured
HTTP/JSON path renders nothing here; this is the plain-text view.
Memory-mapped, process-shareable per-message meta map keyed by stable
row_id. Resolves FTS/vector _rowids to (session_id, message_id) and
hydrates hit meta (role, project, source_agent, timestamp,
search_text) in memory, with a take_rows miss-fallback for rows appended
since the build. Also carries a session_id -> message count aggregate.
pond_sql_query: read-only DataFusion SQL over the three Lance tables
(sessions / messages / parts), registered as LanceTableProviders
(behind plan-time views that rename id to message_id / session_id)
on a fresh per-call SessionContext. Read-only is enforced in two layers - a
single-SELECT pre-parse and sql_with_options with DDL/DML/statements all
disabled - so no statement that mutates the corpus or touches the filesystem
(INSERT/UPDATE/DELETE/CREATE/DROP/COPY/CREATE EXTERNAL TABLE/SET) can run.
Results render inline (row-capped) or export to a parquet/ndjson file the
caller fetches via the pond-sql-export:// resource (src/transport.rs).
The HTTP+JSON and stdio-MCP transports: thin adapters over the shared wire
handlers. Both transports dispatch to the same handler functions - no
per-transport behavior divergence.