DeepLink-org · reiase · Aug 6, 2026 · Jun 20, 2026 · Jun 20, 2026 · Jun 21, 2026
diff --git a/.gitignore b/.gitignore
@@ -19,7 +19,6 @@ probing.egg-info/
 .idea/
 app/dist/
 dist/
-python/probing/bundled_web/
 .python-version
 report.json
 pkg/
@@ -35,4 +34,6 @@ docs/site/
 .coverage
 .pytest_cache/
 web/target/
+probing/server/web-assets/
+/web/dist
 frontend/
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -130,11 +130,11 @@ pyo3 = { version = "0.29.0", default-features = false, features = [
 [build-dependencies]
 pyo3-build-config = "0.29.0"
 
-# Dev (`DEBUG=1 make develop`, `cargo check`): prioritize compile speed + lean intermediates.
-# debug=1 → line tables only (breakpoints/backtraces without full DWARF).
+# Dev (`DEBUG=1 make develop`, `cargo check`): favor incremental compile speed
+# without paying for split debug symbols. Opt in to symbols with
+# CARGO_PROFILE_DEV_DEBUG=1.
 [profile.dev]
-debug = 1
-split-debuginfo = "unpacked"
+debug = 0
 incremental = true
 codegen-units = 256
 

diff --git a/Makefile b/Makefile
@@ -1,7 +1,7 @@
 # Probing Makefile
 #
 #   develop          → maturin develop (Rust/Python daily loop)
-#   frontend         → dx bundle → python/probing/bundled_web/public (web/dist symlink)
+#   frontend         → dx bundle → probing/server/web-assets/public (web/dist symlink)
 #   wheel            → bundle skills + UI, then maturin build
 #   frontend wheel   → full release path
 #
@@ -27,7 +27,7 @@ else
 endif
 
 MATURIN_FLAGS := $(MATURIN_RELEASE) --features $(MATURIN_FEATURES)
-BUNDLED_WEB_PUBLIC := python/probing/bundled_web/public
+EMBEDDED_WEB_PUBLIC := probing/server/web-assets/public
 
 ifdef ZIG
 ifdef TARGET
@@ -85,8 +85,8 @@ help:
 	@echo "  develop / dev     Bootstrap: _core, CLI, pytest, site hook"
 	@echo "                    Tip: DEBUG=1 make develop → dev profile (faster link)"
 	@echo "  core              Rebuild probing._core after Rust edits"
-	@echo "  frontend          Build UI into python/probing/bundled_web (dx bundle)"
-	@echo "  wheel             Build dist/*.whl (needs bundled_web; bundles skills + UI)"
+	@echo "  frontend          Build UI for compile-time embedding into probing-server"
+	@echo "  wheel             Build dist/*.whl (UI is embedded in probing._core)"
 	@echo "  wheel-ci          alias for wheel (native build; PyPI uses maturin-action + zig)"
 	@echo "  install-wheel     pip install dist/probing-*.whl"
 	@echo "  venv              create/sync project .venv (from .python-version when set)"
@@ -206,23 +206,24 @@ soak-quick: check-dev
 	DURATION_SEC=60 MAX_STEPS=8 PYTHON=$(VENV_PYTHON) PROBING=1 ./examples/imagenet/run_soak.sh
 
 frontend:
-	@test -n "$$SKIP_FRONTEND_CLEAN" || rm -rf python/probing/bundled_web
-	cd web && dx bundle --release
-	@test -f $(BUNDLED_WEB_PUBLIC)/index.html
-	@chmod +x scripts/prune-bundled-web.sh
-	@./scripts/prune-bundled-web.sh $(BUNDLED_WEB_PUBLIC)
-	@mkdir -p $(BUNDLED_WEB_PUBLIC)/assets
-	@cp -f web/assets/logo.svg $(BUNDLED_WEB_PUBLIC)/logo.svg 2>/dev/null || true
-	@cp -f web/assets/logo.svg $(BUNDLED_WEB_PUBLIC)/assets/logo.svg 2>/dev/null || true
-	@cp -f web/assets/tailwind.css $(BUNDLED_WEB_PUBLIC)/assets/tailwind.css
-	@$(PYTHON) scripts/verify_web_assets.py $(BUNDLED_WEB_PUBLIC)
+	@test -n "$$SKIP_FRONTEND_CLEAN" || rm -rf probing/server/web-assets
+	cd web && dx bundle --release --debug-symbols false
+	@test -f $(EMBEDDED_WEB_PUBLIC)/index.html
+	@chmod +x scripts/prune-web-assets.sh
+	@./scripts/prune-web-assets.sh $(EMBEDDED_WEB_PUBLIC)
+	@mkdir -p $(EMBEDDED_WEB_PUBLIC)/assets
+	@cp -f web/assets/logo.svg $(EMBEDDED_WEB_PUBLIC)/logo.svg 2>/dev/null || true
+	@cp -f web/assets/logo.svg $(EMBEDDED_WEB_PUBLIC)/assets/logo.svg 2>/dev/null || true
+	@cp -f web/assets/tailwind.css $(EMBEDDED_WEB_PUBLIC)/assets/tailwind.css
+	@printf '%s\n' '__PROBING_EMBEDDED_WEB_ASSETS_V1__' > $(EMBEDDED_WEB_PUBLIC)/embedded.manifest
+	@PROBING_CLI_MODE=1 $(PYTHON) scripts/verify_web_assets.py $(EMBEDDED_WEB_PUBLIC)
 	@rm -rf web/dist
-	@ln -sfn ../python/probing/bundled_web/public web/dist
-	@echo "$(BUNDLED_WEB_PUBLIC) ($$(du -sh $(BUNDLED_WEB_PUBLIC) | cut -f1))"
+	@ln -sfn ../probing/server/web-assets/public web/dist
+	@echo "$(EMBEDDED_WEB_PUBLIC) ($$(du -sh $(EMBEDDED_WEB_PUBLIC) | cut -f1))"
 
 wheel-bundle:
-	@test -f $(BUNDLED_WEB_PUBLIC)/index.html || { echo "error: run 'make frontend' first"; exit 1; }
-	@$(PYTHON) scripts/verify_web_assets.py $(BUNDLED_WEB_PUBLIC)
+	@test -f $(EMBEDDED_WEB_PUBLIC)/index.html || { echo "error: run 'make frontend' first"; exit 1; }
+	@PROBING_CLI_MODE=1 $(PYTHON) scripts/verify_web_assets.py $(EMBEDDED_WEB_PUBLIC)
 	@test -f python/probing/bundled_skills/catalog.yaml \
 		|| { echo "error: missing python/probing/bundled_skills/catalog.yaml"; exit 1; }
 
@@ -234,7 +235,7 @@ wheel-ci:
 	$(MAKE) wheel
 
 verify-wheel-contents:
-	@$(PYTHON) scripts/verify_wheel_contents.py
+	@PROBING_CLI_MODE=1 $(PYTHON) scripts/verify_wheel_contents.py
 
 install-wheel: verify-wheel-contents
 	@WH=$$(ls -1 dist/probing-*.whl 2>/dev/null | head -1); \
@@ -246,7 +247,7 @@ import importlib.util; \
 import probing; from probing import _core; from pathlib import Path; \
 root = Path(probing.__file__).resolve().parent; \
 assert (root / 'bundled_skills' / 'catalog.yaml').is_file(), f'missing bundled skills under {root}'; \
-assert (root / 'bundled_web' / 'public' / 'index.html').is_file() or (root / 'bundled_web' / 'index.html').is_file(), f'missing bundled web UI under {root}'; \
+assert not (root / 'bundled_web').exists(), f'legacy bundled_web must not be shipped under {root}'; \
 assert all(importlib.util.find_spec(m) for m in ('probing.skills.loader', 'probing.ext', 'probing.handlers')), 'missing probing.* modules in installed wheel'; \
 print('probing', probing.VERSION)"
 
@@ -393,7 +394,7 @@ docs-clean:
 	@cd docs && $(MAKE) clean
 
 clean:
-	rm -rf dist docs/site python/probing/bundled_web web/dist web/target
+	rm -rf dist docs/site probing/server/web-assets web/dist web/target
 	rm -rf python/probing/libs python/probing/shim/hccl
 	rm -rf .pytest_cache .coverage coverage.xml coverage.lcov
 	cargo clean

diff --git a/docs/src/contributing.md b/docs/src/contributing.md
@@ -180,7 +180,7 @@ See [examples/README.md](https://github.com/DeepLink-org/probing/blob/main/examp
 
 - **Authoring**: repo root `skills/` (`SKILL.md`, `steps.yaml`, `catalog.yaml`)
 - **Install to IDE agents**: `./skills/install.sh` or `probing skill install`
-- **Bundled in wheel**: `make wheel` copies skills into `python/probing/bundled_skills/` and UI into `python/probing/bundled_web/`
+- **Bundled in wheel**: `make wheel` copies skills into `python/probing/bundled_skills/`; `make frontend` builds ignored UI artifacts under `probing/server/web-assets/`, and the server build script embeds them into `probing._core` at compile time (plain Rust builds use a tracked fallback page)
 - **Docs**: `skills/README.md`, [Extensibility — Diagnostic skill](design/extensibility.md#path-2-diagnostic-skill)
 
 ## Development workflow
@@ -250,13 +250,11 @@ probing/                          # repo root
 ├── python/
 │   ├── probing/                  # Python PACKAGE (not Rust)
 │   │   ├── skills/               # skill loader/install CODE — see python/probing/skills/README.md
-│   │   ├── web_assets.py         # wheel _web/ + editable web/dist → PROBING_ASSETS_ROOT
-│   │   ├── bundled_skills/       # skill DATA bundled in wheel (author in repo-root skills/)
-│   │   └── bundled_web/          # UI bundled in wheel (make frontend)
+│   │   └── bundled_skills/       # skill DATA bundled in wheel (author in repo-root skills/)
 │   ├── probing_hook.py           # .pth → site hook
 │   └── probing.pth
 ├── src/lib.rs                    # PyO3 entry → probing._core (maturin)
-├── probing/                      # Rust WORKSPACE (core, server, cli, extensions)
+├── probing/                      # Rust WORKSPACE (server/web-assets is embedded in probing._core)
 ├── web/                          # Dioxus UI (`make frontend` → web/dist/)
 ├── tests/                        # see tests/README.md
 ├── examples/                     # optional torch/etc.

diff --git a/docs/src/contributing.zh.md b/docs/src/contributing.zh.md
@@ -176,7 +176,7 @@ PROBING=1 python examples/getting-started/tracing.py
 
 - **编写**：仓库根 `skills/`（`SKILL.md`、`steps.yaml`、`catalog.yaml`）
 - **安装到 IDE**：`./skills/install.sh` 或 `probing skill install`
-- **打进 wheel**：`make wheel` 自动复制到 `python/probing/bundled_skills/`、`python/probing/bundled_web/`
+- **打进 wheel**：`make wheel` 复制 Skill 到 `python/probing/bundled_skills/`；`make frontend` 将被忽略的 UI 产物构建到 `probing/server/web-assets/`，server build script 在编译时把它嵌入 `probing._core`（普通 Rust 构建使用受版本控制的 fallback 页面）
 - **说明**：`skills/README.md`、[扩展机制 — 诊断 skill](design/extensibility.zh.md#path-2-diagnostic-skill)
 
 ## 开发流程
@@ -245,13 +245,11 @@ probing/                          # 仓库根
 ├── python/
 │   ├── probing/                  # Python 包（不是 Rust）
 │   │   ├── skills/               # skill 加载/安装代码 — 见 python/probing/skills/README.md
-│   │   ├── web_assets.py         # wheel _web/ + editable web/dist → PROBING_ASSETS_ROOT
-│   │   ├── bundled_skills/       # wheel 打包的 skill 数据（编写在 repo-root skills/）
-│   │   └── bundled_web/          # wheel 打包的 UI（make frontend）
+│   │   └── bundled_skills/       # wheel 打包的 skill 数据（编写在 repo-root skills/）
 │   ├── probing_hook.py
 │   └── probing.pth
 ├── src/lib.rs                    # PyO3 → probing._core
-├── probing/                      # Rust workspace
+├── probing/                      # Rust workspace（server/web-assets 编译进 probing._core）
 ├── web/                          # Dioxus UI（`make frontend` → web/dist/）
 ├── tests/                        # 见 tests/README.md
 ├── examples/

diff --git a/docs/src/design/data-layer.md b/docs/src/design/data-layer.md
@@ -205,10 +205,12 @@ Each column is encoded independently (`ColEncoding`):
 
 ### Crash Recovery
 
-- A **sealed** segment is read via its footer page directory — O(1) location of every page.
-- An **unsealed or torn** segment is recovered by **forward scan**: walk blocks from the start,
-  verifying each block's header and payload checksum, stopping at the first bad block and dropping
-  the torn tail. Table-definition blocks are always scanned (cheap, and they precede pages).
+- A **sealed** segment is read via its footer page directory — O(1) location of every page. Footer,
+  block, payload, and page integrity failures reject the segment and fail the SQL scan; queries
+  never return a successful but incomplete cold result.
+- An **unsealed or torn** segment is recovered by **forward scan**. Only an incomplete final
+  header/payload is dropped as a crash tail; corruption of a complete checksummed block is an
+  error. Table-definition blocks are always scanned (cheap, and they precede pages).
 
 There is no heuristic that tries to repair a half-written record.
 
@@ -251,6 +253,12 @@ compactor a single lifecycle home:
   over time), drains each into the shared `ColdStore`, rolls by age, and enforces the budget;
 - on startup it calls `prime_from_cold()`; on stop it flushes (seals the open segment).
 
+Discovery, segment enumeration, write/roll, and retention I/O are fallible operations. The worker
+logs failures and records an observable `CompactorRuntimeStats` snapshot (`error_count` plus the
+operation-qualified `last_error`). Startup priming fails closed, because continuing without recovered
+watermarks could duplicate cold rows; retention never reports success after an unreadable directory
+or metadata failure.
+
 It is **opt-in** (off by default) to avoid spawning a compaction thread in every forked worker.
 Configuration is applied via the `MemTableProbeExtension` option surface or environment variables; the
 server calls `start_cold_compaction_from_env()` at engine init.

diff --git a/docs/src/design/data-layer.zh.md b/docs/src/design/data-layer.zh.md
@@ -181,9 +181,10 @@ MEMC v2 reader 会明确拒绝 v1 段，因为 v1 缺少实例身份，无法安
 
 ### 崩溃恢复
 
-- **已封存**段通过 footer 的 page 目录读取——O(1) 定位每个 page；
-- **未封存或撕裂**的段通过**前向扫描**恢复：从头遍历 block，校验每个 block 的头部和 payload
-  校验和，在第一个坏 block 处停止并丢弃撕裂的尾部。表定义 block 总会被扫描（开销小，且位于 page 之前）。
+- **已封存**段通过 footer 的 page 目录读取——O(1) 定位每个 page。footer、block、payload 或 page
+  的完整性校验一旦失败，整个段及 SQL 扫描都会报错，查询不会再成功返回不完整的冷层结果；
+- **未封存或撕裂**的段通过**前向扫描**恢复。只有不完整的最后一个头部或 payload 会被当作崩溃尾部
+  丢弃；完整 block 的校验和损坏仍会报错。表定义 block 总会被扫描（开销小，且位于 page 之前）。
 
 不存在任何试图修复半行记录的启发式逻辑。
 
@@ -218,6 +219,11 @@ MEMC v2 reader 会明确拒绝 v1 段，因为 v1 缺少实例身份，无法安
   `ColdStore`，按时长滚动，并执行预算约束；
 - 启动时调用 `prime_from_cold()`；停止时 flush（封存打开的段）。
 
+发现、段枚举、写入/滚动与 retention I/O 都是可失败操作。worker 会记录 warning，并通过
+`CompactorRuntimeStats` 暴露 `error_count` 和带操作上下文的 `last_error`。启动时的 watermark
+恢复失败会 fail-closed，因为继续运行可能重复写入冷层；目录或 metadata 读取失败时 retention 也不会
+再被当作成功。
+
 它**默认关闭**（opt-in），以避免在每个 fork 出来的 worker 中都启动一个压缩线程。配置通过
 `MemTableProbeExtension` 选项面或环境变量下发；server 在引擎初始化时调用
 `start_cold_compaction_from_env()`。

diff --git a/docs/src/design/distributed.md b/docs/src/design/distributed.md
@@ -116,6 +116,11 @@ See [Federated query engine](federation.md) for engine paths and acceptance test
 
 At wan scale, **`cluster query` defaults to [hierarchical fan-out](hierarchical-fanout.md)** (coordinator → per-machine local0 → on-node leaves). Set `PROBING_CLUSTER_FANOUT_HIERARCHICAL=0` or use CLI `--flat` for legacy flat fan-out.
 
+Raw `global.*` scans use the same topology: the coordinator reads its own partition, queries its
+local leaf ranks directly, and sends node-aggregate requests to remote local0 peers. Hierarchical
+execution requires `group_rank` and `local_rank` on every live registry entry; partial metadata is
+reported as an error instead of falling back to a potentially incomplete flat/partial scan.
+
 ## Synchronized Debugging
 
 ### Capture All Stacks
@@ -244,6 +249,10 @@ PROBING_AUTH_TOKEN=secret python train.py
 probing -t host:8080 --token secret query "..."
 ```
 
+Use the same token on every peer. Probing applies the configured credential to internal
+node discovery, heartbeat, flat federation queries, and hierarchical fan-out requests;
+load-balancer health endpoints remain public.
+
 ## Best Practices
 
 ### Consistent environment

diff --git a/docs/src/design/distributed.zh.md b/docs/src/design/distributed.zh.md
@@ -111,6 +111,10 @@ ORDER BY avg_ms DESC"
 
 万卡场景下 `cluster query` 默认走 **[分层 fan-out](hierarchical-fanout.zh.md)**（coordinator 仅联系各机 local0，local0 再聚合本机 leaf rank），可用 `PROBING_CLUSTER_FANOUT_HIERARCHICAL=0` 或 CLI `--flat` 恢复扁平 fan-out。
 
+普通 `global.*` 扫描采用同一拓扑：coordinator 读取自身分区、直接查询本机 leaf ranks，并向异机
+local0 发送节点聚合请求。层级执行要求每个存活注册节点都具有 `group_rank` 与 `local_rank`；元数据
+只要部分缺失就会明确报错，不再降级为可能漏数的 flat/partial 扫描。
+
 ## 同步调试
 
 ### 捕获所有堆栈
@@ -239,6 +243,9 @@ PROBING_AUTH_TOKEN=secret python train.py
 probing -t host:8080 --token secret query "..."
 ```
 
+所有 peer 必须使用相同令牌。Probing 会把已配置的凭据附加到内部节点发现、心跳、
+普通联邦查询和层级 fan-out 请求；负载均衡器使用的健康检查端点仍保持公开。
+
 ## 最佳实践
 
 ### 一致的环境变量

diff --git a/docs/src/reference/skill-format.md b/docs/src/reference/skill-format.md
@@ -110,8 +110,10 @@ parameters:
     description: "Number of recent steps to analyze"
 ```
 
-Types: `integer`, `boolean`, `string`. Parameter values are referenced in SQL as
-`{param_name}`.
+Types: `integer`, `number`, `boolean`, `string`. Parameter values are referenced in SQL as
+`{param_name}`. Overrides are validated and normalized before planning or execution;
+unknown parameters are rejected. String parameters represent SQL literal contents and
+single quotes are escaped during template expansion.
 
 ### Requires
 
@@ -158,6 +160,8 @@ Step fields:
 - `cluster`: If `true`, uses federation fan-out (`POST /apis/cluster/query`).
 - `when`: Optional condition. `"always"` or `"{use_global}"` (runs only when the
   boolean variable is true).
+- `platform`: Optional execution platform: `linux`, `macos`, or `windows`. A step for a
+  different platform is reported as skipped without issuing its SQL/API request.
 
 **`api`** — Call an HTTP API on the probing endpoint.
 
@@ -236,6 +240,7 @@ interpretation:
 | Row count | `rows == 0`, `rows >= 1` |
 | Column predicate | `column:<name> \| <tail>` — pairs with the tail on the right |
 | Numeric compare | `value == 0`, `value > 10`, `max > 1e6`, `avg > 5` |
+| Text equality | `value = propagated_victim` — exact match on the first row |
 | Spread | `max/min(ratio) > 1.5` |
 | Ratio of columns | `ratio(num_col/den_col) > 0.3` |
 | Text search | `any_contains('dead', 'stale')` — case-insensitive substring |
@@ -341,5 +346,8 @@ python -m probing.skills validate my_skill
 python -m probing.skills validate --all
 ```
 
-The validator checks: missing steps, duplicate step IDs, read-only SQL compliance
-(all statements must start with SELECT/WITH/SHOW/DESCRIBE), and missing SKILL.md.
+The validator compiles every catalog skill through the Rust execution schema. It rejects
+unknown YAML fields, mismatched parameter defaults/overrides, unsupported platforms and
+interpretation grammar, duplicate IDs, unresolved templates, and missing required step
+fields. SQL is parsed as an AST; every statement and nested CTE must be read-only, so a
+read followed by a trailing write is rejected. It also checks that `SKILL.md` exists.
diff --git a/probing/cli/src/cli/bench/runners/mixed.rs b/probing/cli/src/cli/bench/runners/mixed.rs
@@ -89,7 +89,7 @@ pub fn run(args: &MixedArgs, json: bool, seed: u64) -> Result<()> {
             ttl: args.ttl_secs.map(Duration::from_secs),
         };
         let handle = attach.open()?;
-        Some(Compactor::new(store, config).spawn(vec![("bench".to_string(), handle)]))
+        Some(Compactor::new(store, config).spawn(vec![("bench".to_string(), handle)])?)
     };
 
     let mut threads = Vec::new();

diff --git a/probing/core/Cargo.toml b/probing/core/Cargo.toml
@@ -49,7 +49,6 @@ thiserror = { workspace = true }
 async-trait = "0.1.83"
 datafusion = { workspace = true }
 futures = "0.3.31"
-ureq = { workspace = true }
 sled = "0.34.7"
 bincode = "1.3.3"
 uuid = { version = "1.0", features = ["v4", "serde"] }