Release notes.

Codna design-partner correctness gates

The four pre-pilot correctness gaps identified with Codna, the first design partner, are closed and verified in the test suite:

• —Delta rows participate in off-key filters — columns are indexed by logical id across base and delta, and the scatter fallback is MVCC-aware: latest visible version, deletes excluded, correct across reopen.
• —Explicit duplicate-id semantics — add errors on an existing id; upsert writes a new visible version. Never two physical rows for one logical id.
• —The embedding-provider registry auto-attaches on open_collection by profile space id and rejects an incompatible space (model, version, dim, normalization, metric, tokenizer).
• —Composite partitioning is explicit via scope_key, with the constituent fields stored separately as filter columns for off-key filtering and explanation.

Signed runtime, offline activation

telys login runs the full chain in one command: OAuth device-code sign-in, API key, device registration, platform-signed license, runtime install and verify. telys runtime install --file installs a signed bundle with an offline license across an air gap; verification — RS256 manifest signature, SHA-256 per artifact, license check — is identical either way and always local. Install is the only step that may touch the network; query execution never does.

telys mcp — server and one-command install

telys mcp runs a stdio MCP memory server over the local engine — persistent, governed memory for agent clients with no cloud dependency. telys mcp install registers the server in Claude, Cursor, or Codex in one command (user or project scope); uninstall and status manage the registration.

Explain plans on every result

search(..., explain=True) reports the plan the engine executed: PartitionSliceExactF32 — one contiguous scan on the partition key, recall 1.0; PartitionIVFRerankF32 — IVF with exact rerank on oversized partitions; ScatterGatherExact — the off-key fallback, reported as such.

scope_key composite partitioning

scope_key(*parts) builds a canonical composite partition key — for example repo, service, language — so multi-field isolation resolves to a directory lookup and one contiguous-slice scan. The constituent fields are stored separately as filter columns, so off-key filtering and explain output still see them individually.

Partitioned engine with MVCC supersession

The engine owns the physical layout: on-key search is a directory lookup plus a sequential scan of one contiguous block. Writes run over MVCC — insert, upsert, delete, and snapshot with supersession chains and tombstones — alongside compaction, save and reopen, and recall-floor-calibrated IVF within oversized partitions.