The embedding stage: candle XLM-RoBERTa FP16 (CandleEmbedder) plus
the batch-oriented EmbedWorker that fills messages.vector /
messages.embedding_model (spec.md#search). One message produces one
vector - there is no chunking.
pond_sql_query: read-only DataFusion SQL over the three Lance tables
(sessions / messages / parts), registered as LanceTableProviders
(behind plan-time views that rename id to message_id / session_id)
on a fresh per-call SessionContext. Read-only is enforced in two layers - a
single-SELECT pre-parse and sql_with_options with DDL/DML/statements all
disabled - so no statement that mutates the corpus or touches the filesystem
(INSERT/UPDATE/DELETE/CREATE/DROP/COPY/CREATE EXTERNAL TABLE/SET) can run.
Results render inline (row-capped) or export to a parquet/ndjson file the
caller fetches via the pond-sql-export:// resource (src/transport.rs).
The HTTP+JSON and stdio-MCP transports: thin adapters over the shared wire
handlers. Both transports dispatch to the same handler functions - no
per-transport behavior divergence.