Publish citation sources added by document reads

[Maya-Kid]

Latest dev synchronization (2026-09-21)

Based on dev@474b904dc3e8014d42404a3c067af9906036a953; current head 4d8204e016d79f97de4c46b3f0b2f09749d73132.

Revalidated the combined integration tree 6cd976351b4d7cc7389730fce530526f4d197992 on isolated Linux PostgreSQL fixtures (all 675 tracked source files hash-matched):

• Rust fmt, strict workspace/all-target Clippy, workspace build: pass. Workspace tests: 1,015 passed, 0 failed, 5 ignored. The new upstream delivery tests were additionally run on an exclusive database as CONTRIBUTING requires: both parent delivery/process-kill tests and the busy-deferral unit test passed. The crash-child entry point ran through its parent, not directly; the existing public-network RSS test remains ignored.
• Combined frontend: 129 module tests, 27 browser subtests (29 including parent suites); build/typecheck/guard passed. Browser fixtures ran serially.
• Five browser scenarios against the actual Linux server and PostgreSQL passed: 65-conversation pagination, stale view ownership, citation preview/reattachment/reload, history-to-idle handoff, and actual assistant INSERT failure. Model replies were locally scripted; this is not a new paid-model accuracy evaluation.
• The single PostgreSQL Chat CI command, cargo test -p utopia-server api::chat::, listed and executed 47 tests. All 37 introduced tests were observed passing: Hand off exhausted tool runs to an evidence-only final answer #845 22, Keep older chat handles from unregistering newer generations #848 1, Publish citation sources added by document reads #849 2, Keep fallback retrieval failures distinct from empty results #850 4, Preserve exact chat outcomes across stream closure and reattachment #851 3, Do not report fallback chat completion when saving fails #852 3, and upstream Assert a chat turn ends in exactly one earned terminal #858 2. No test module was deleted during CI consolidation.
• Seven real filtered runs each omitted one group. Cargo returned green, but the independent execution-coverage checker returned exit 1 for every omission; the complete run returned exit 0. All four shared terminal-contract table rows executed without pending skips.

The evidence-only handoff core remains frozen. Earlier validation below belongs to its stated historical heads. Automated browser checks do not replace the maintainer's requested visual review.

---

get_document adds citation numbers to the same tool sink as search, but its document step did not trigger a sources event. A newly cited chunk was saved in history while live and reattached answers could not resolve its reference.

Publish the existing full sources frame whenever the append-only source list grows, independently of the UI step kind. Repeated document reads and graph-only tools do not publish duplicate lists. The sink lock is released before yielding.

Validation on Linux with an isolated migrated PostgreSQL database and a local gated HTTP model substitute:

• Both regressions fail on dev ea0557b: search A → read A+B leaves only A in the live snapshot; direct document reads leave no sources.
• Both pass after the fix. They exercise actual document/chunk creation, BM25 search, tool dispatch, chat, reattach, and history handlers. Repeated reads keep IDs/numbers stable; live sources, a pre-answer reattachment snapshot and stored sources agree.
• Formatting and strict workspace clippy pass; the Chat suite and 24 existing MCP tests pass with the database guard enabled, including document read and isolation coverage.

No change to retrieval ranking, citation UI, truncation budgets, wire schema, or model finalization policy. No paid model or business data was used. Browser verification is not claimed by these handler tests.

Additional integration validation: isolated tree f7bcd0878bf490d6efb122b71d6f13d379df4709 combines this change with #845 and the other scoped Chat fixes. Linux Rust fmt, strict workspace Clippy, workspace build and 1,013 tests pass (one pre-existing external-HTTPS RSS test ignored); frontend 129 module tests, 27 real-component browser subtests and build pass. Database/PDF test guards were enabled. This combined result is separate from the standalone checks above.

Chrome against the actual Linux backend and PostgreSQL also confirmed that live, reattached and reloaded citation [2] opens the ingested document preview; the pre-answer snapshot sources equal stored history. The tool-phase event-count assertion now stops before the final graph step, so it still rejects duplicate document publication while allowing #845's later persisted-source replay.