…ob patterns

add now symlinks a source into the documents dir instead of copying it. A
prepared corpus already lives on local disk, so linking it in place removes the
single-threaded byte copy and the doubled disk footprint that a large ingest
paid before the GPUs got any work. Discovery follows these top-level links,
keying each linked source under its label so every downstream consumer stays
documents_dir-relative; the symlink-escape guard is relaxed only for these
self-describing linked roots, and a nested link that points outside them is
still skipped.

remove no longer deletes files on disk. Source bytes are the user's, and a
linked-in corpus must never be removed, so the delete_files parameter and the
--delete flag are gone from every surface (store, CLI, MCP, HTTP, the Python
API, and the skill docs). Removal is index-only plus a durable skip-marker;
removing a top-level linked root instead unlinks that symlink. Matching now
expands beyond an exact name: a folder removes every source indexed beneath it
(whole-segment boundary), and a glob (a name with * ? or []) removes every
fnmatch. The CLI confirms before a multi-document removal.

Tighten _walk_into's ignore_dirs annotation to frozenset[str], note why the
cgroup CPU quota is read by hand (os.process_cpu_count is 3.13+, floor is 3.11),
and update the usage/tutorial docs for symlink-based add and folder/glob remove.

…ingesting

Moving indexed files used to cost a full re-ingest: the old paths were removed
and the new paths embedded from scratch, even though the content was identical.

Sync now hash-indexes the sources whose files just disappeared and matches them
against the new files in the same pass. A match is a move, so the source is
re-keyed in place (chunks, page texts, concepts, entities, and citations all
repoint to the new name, the sources row keeps its hash and vectors) rather than
deleted and re-embedded. Pairing is one-to-one and deterministic when hashes
collide. The result carries a `relocated` count across the CLI, TUI, HTTP, and
MCP surfaces.

add stops demanding --force when a source moved: a dangling link (its old target
gone) auto-relinks to the new path, and the TUI reports "already indexed,
location changed" instead of treating it as new.

…cleanup

Two cleanup paths matched links with is_symlink() and rmtree'd anything else that
was a directory. A Windows junction is not a symlink but is a directory, so both
would have recursed through it and deleted the real linked-in corpus: the
knowledge-base reset (app.reset._clear_dir) and the /add cancel/failure cleanup
(remove_linked_sources).

Both now detect a link with is_link() (symlink or junction) and detach it with
remove_link() (rmdir for a junction, unlink for a symlink), never following it to
the target. The detach primitive moves next to is_link in core.system so every
consumer shares one junction-aware implementation.

…anups

Parallel planning now cancels queued-but-unstarted work when cancel trips
mid-pass, restoring the prompt cancellation the serial path had; the docstring no
longer overclaims the plan is identical under cancel. relocate_sources opens each
table once instead of per move (LanceDB's update SQL has no CASE, so a single
batched statement is not available, and a delete+re-add across the vector tables
is not worth its risk for a rare mass relabel).

Smaller fixes: the remove confirmation counts only names that actually exist; the
CLI expands remove targets once and passes them through; expand_remove_targets
and remove_documents_durably take the pre-read known set / targets to avoid a
second sources read; --max-cpus is available on sync and rebuild, not just add;
the relocated count now shows in the background/auto-sync summary line;
get_services moves to app.ingest's module top (AGENTS forbids lazy-importing it);
a stale copy_result name and a narrating discovery comment are cleaned up; and the
relocate test now covers page_texts and citations so dropping a re-keyed table
fails.

Register external source roots in config (label -> absolute path) and index
their files where they live: no copy, no symlink, no junction. discover_files
walks documents_dir plus each registered root; resolve_source_path maps a stored
key back to its file for every consumer (search, citations, wiki, HTTP serve,
durable remove).

A vanished file is no longer removed on sync: its chunks stay searchable and the
dead path surfaces only when something tries to open it. Move detection is
preserved, now pairing a reappeared identical file to an absent source and
relocating it in place. remove un-registers a root instead of unlinking; the TUI
add-cancel path un-registers too.

Deletes the whole symlink/junction/hardlink/copy shim (symlinks_supported,
_place_source, _create_junction, _hardlink, is_link, remove_link) and the
discovery symlink-escape guard; cross-platform reduces to abspaths + os.walk.

…lver

A crafted citation key that climbs out of every allowed root is rejected before
any file is read; registered roots (legitimately outside documents_dir) pass.
Fix the format-source test to inject the resolver failure at its new site.

Registration records a root instead of copying into documents_dir, so the tests
assert the registry (linked_roots) and exercise root-vs-root collision. Set
data_root in the fixture so the registry persists to a temp config.toml.

- Reject registering a root that nests under/over an existing root or is an
  ancestor of documents_dir, which would index the same file under two keys.
- Never let a registered label shadow an owned documents_dir entry, even under
  --force, so resolve_source_path can't diverge from how discovery keyed it.
- Make register/unregister an atomic read-modify-write of the persisted registry
  under the config lock (settings.mutate_value), so two processes registering
  roots concurrently can't lose each other's entry.
- Replace a tautological reindex test with one asserting the store's recorded
  hash reflects the edit; add nesting/ancestor/owned-shadow/merge coverage.
- Fix stale symlink-era wording in api.py and docs, and fold function-local
  app.ingest re-imports into the existing top-level import.

…t in its fixture

Force now re-points a registered root instead of overwriting an owned
documents_dir file (a label never shadows an owned entry). Also set data_root in
the server test fixture so registration persists to a temp config.toml, not the
real one.

…to documents_dir

…owned subtree

…aken, empty no-ops, remove confirm

…nder, cgroup-v2 malformed, TUI relocated notify

Brings in the shared-engine work (#547), the raised single-machine fleet ceilings and off-daemon crawl conversion (#583), the orphaned-engine cleanup (#589), and the deterministic vision-dispatch tests (#591).

Conflict resolutions:
- settings_map.py: additive; keep ingest_workers alongside main's new mcp_tool_threads and crawl_convert_workers.
- provider.py routing helpers: additive; keep the dispatch reserve (_ROUTE_LOCK / _reserve_least_in_flight) beside main's shared-engine ladder helpers.
- provider.py _warm_ttl_seconds: adopt main's decoupling (keep_engine_warm now controls bind_lifetime, not the idle timer) and layer only the ingest-warmth override on top, so an active ingest still forces ttl 0 while a merely-warm idle engine unloads on the normal window.
- test_fleet_provider._FakeReplica: additive; keep reserve/release beside main's close.
- test_ingest_warmth: update the keep_engine_warm case to main's semantics (governs lifetime, not ttl).