feat(graph): load-all — flacher Voll-Korpus-Seed + SPA-Button

GET /api/graph/all liefert JEDEN sichtbaren Block (kanonische
Visibility-Triple + Ego-Node-Filter) newest-first mit id-Tiebreak,
dazu induzierte Kanten beider Datenklassen und sichtbare Degrees.
Keine Traversal: das Node-Set ist prädikat-definiert, nicht
erreichbarkeits-definiert — verlinkungsfreie Blöcke und getrennte
Komponenten erscheinen mit, was der Ego-Pfad strukturell nie liefern
kann. Edges/Degrees laufen durch die GETEILTEN SQL-Stages
(egoSQLEdges = Q2/Q2s/Q3 wörtlich): keine zweite Visibility-Wahrheit.

Budgets: limit UND edge_limit defaulten auf ihre Decken (1500 bewiesen
per G39-Bench; 20000 = harte Client-Kante evict §6.6) — ein
4000-Edge-Default würde exakt den Korpus kappen, den der Button zeigen
soll (live heute ~3.8k Links). Ceilings bleiben 400, nie geklemmt; bei
Korpus > Decke bleibt der Endpoint eine budgetierte Sicht
(stats.truncated + budget_report), kein unbegrenzter Dump @1m.

Envelope = Ego-Envelope mit focus:"" (params.hops/per_node_cap echoen
0 = nicht anwendbar); mergeEgo toleriert den leeren Focus (Seed am
Ursprung). SPA: "load all"-Button in der Meta-Row — gleicher
Merge/Settle-Pfad wie expand, Kamera-Reset (Korpus-Sicht, keine
Nachbarschaft), disconnected Nodes lesen hop=Infinity und stehen damit
automatisch vorn in der evict-farthest-first-Ordnung.

Tests: FullGraph-Integrationssuite (Scope-Sichtbarkeit, Kanten nur
zwischen sichtbaren Endpunkten, deterministische newest-first-Kappung,
T07/T6 fail-closed), parseAllParams-Unit-Pins (Ceiling-Defaults,
keine Klemmung, GB5-Partition), fetchGraphAll-Serialisierungs-Pins.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: GottZ

docs/api.md

@@ -10,6 +10,7 @@ All endpoints under `/api/*`. Auth via `X-Context-Key` header or `Authorization:
 | `POST /api/store` | Upsert (embedding async via scheduler). Optional `sensitivity` (`credentials`\|`personal`\|`internal`\|`public`) classifies the block manually (`sensitivity_source='manual'`); absent ⇒ settings key `pool.default_block_sensitivity` (fail-closed `credentials`). On an upsert conflict an explicit value applies upgrade-only — downgrades go through `manage update` with `confirm_sensitivity_downgrade`. A credentials pattern in the content forces `credentials` upgrade-only regardless of the requested level (G40 detector, `sensitivity_source='pattern'`). Optional `type` validates against the registry and sets `type_source='manual'`. |
 | `POST /api/search` | Lightweight search (no LLM). Results carry the type axes (`type`/`lifecycle_state`/`type_source`). Optional `types` / `types_exclude` arrays are server-side opt-in type filters (bind parameters; `block_roles_exclude` = legacy alias, both ⇒ union). |
 | `GET /api/graph/ego` | Scope-filtered k-hop ego subgraph over dream links (read-only, no LLM — see [Graph API](#graph-api)). |
+| `GET /api/graph/all` | Flat load-all seed: every visible block up to the budget ceilings (newest-first, deterministic), induced edges of both data classes, degrees. Same envelope as ego with `focus:""`; no traversal params (see [Load-all](#load-all-flat-corpus-seed)). |
 | `GET /api/graph/overview` | Scope-pure Louvain cluster supergraph ("landkarte"); reads precomputed scope-partitioned aggregates, gated on `graph_overview.enabled` (off → 404). Read-only, no LLM. |
 | `POST /api/synthesize/daily` | Manual trigger of the daily synthesis (Tagesbericht) for the caller's `home_scope` — the same `GenerateDailyReport` path the 03:00 scheduler iteration runs (digest role, constant internal). Concurrency cap 1 per principal (429 fail-fast), dispatch-interactive (429 + `Retry-After` on capacity rejection). Optional `?date=YYYY-MM-DD` (M103) re-synthesizes the report titled that day over its historical window `[date-1 03:00 UTC, date 03:00 UTC)` — the backfill path; the `(category, title, scope)` upsert replaces the old report in place (same block id, embedding regenerates). A malformed date or a window that has not closed yet ⇒ 400. `{ok, block_id, scope[, date][, reason:"no_activity"]}`. |
 | `GET /api/whoami` | Calling key's identity: `label`, `home_scope`, `read_scopes`, the server-global `admin` tier flag, plus the Model-C tenant identity `tenant_id` + per-tenant `role` (`owner`/`admin`/`member`), and the feature-flag bag `capabilities` (`{workflow: true}` since v4.3.0 — switches the SPA's issues/board surface visible; the field is data, so a later per-tenant gate only changes the value, not the SPA). The SPA login gate probes it, derives its read-only degradation from `admin`, and tells server-admin from tenant-admin. |
@@ -214,6 +215,12 @@ Since the graph-budget wave the envelope also carries `budget_report` — the ty
 
 **Security semantics.** The visibility triple (not archived, block type on the registry visibility allowlist, scope readable by the key) is applied inside every hop AND inside the per-node cap legs — a node reachable only through a foreign private bridge is never delivered, and invisible edges never consume cap slots. `degree` counts only visible neighbors (scan budget 1000 raw edges/direction). "Does not exist" and "not visible" answer with an identical `404` (no existence oracle); only successful calls write an access-log row (`action='graph'`, `block_id=NULL`).
 
+### Load-all (flat corpus seed)
+
+`GET /api/graph/all` returns the flat "load all" seed behind the SPA button of the same name: **every visible block** (canonical visibility triple + the ego node filters), newest-first with an id tiebreak so truncation is deterministic, plus the induced edges of both data classes and the visible degrees. Nothing is traversed — the node set is predicate-defined, not reachability-defined, so blocks without any link (and disconnected components) appear too.
+
+Params are the ego set MINUS `block`/`hops`/`per_node_cap`: `limit` (default **1500** = the ceiling — the button's whole point), `edge_limit` (default **20000** = the ceiling, matching the client's hard edge budget), `min_confidence`, `link_class` (same unified GB5 channel), `category`, `created_after`/`created_before`. Ceilings are still enforced, never clamped; the corpus growing past a ceiling reports as `stats.truncated` + `budget_report` limits (`node_limit_reached`/`edge_limit_reached`) — the endpoint stays a budgeted view at 1M+, never an unbounded dump. Response: the ego envelope verbatim with `focus:""` and `params.hops`/`params.per_node_cap` echoed as 0 (not applicable). Same auth, same `graph` rate-limit bucket; there is no focus, hence no 404 arm.
+
 ### Overview (cluster "landkarte")
 
 `GET /api/graph/overview` returns the cluster supergraph: a few hundred meta-nodes (precomputed Louvain communities over the dream-link graph) with `size`, `top_categories`, a representative block, and aggregated inter-cluster meta-edges. The Louvain rebuild runs offline in the scheduler (`internal/overview`, gonum); the endpoint only reads precomputed tables. Since WF T6 the node set is policy-cut: a block becomes a Louvain node only if its type is on the registry visibility allowlist AND carries `overview.include=true`.

go/cmd/ctxd/server.go

@@ -229,6 +229,8 @@ func NewRouter(ctx context.Context, pool *pgxpool.Pool, cfgStore *config.Store,
 		r.Post("/api/search", searchH.HandleSearch)
 		// Graph — scope-filtered k-hop ego subgraph (read-only, no LLM)
 		r.Get("/api/graph/ego", graphH.HandleEgo)
+		// Graph load-all — flat visible-corpus seed (SPA "load all" button)
+		r.Get("/api/graph/all", graphH.HandleAll)
 		// Graph overview — scope-pure Louvain cluster supergraph (F5-W6, gated)
 		r.Get("/api/graph/overview", overviewH.HandleOverview)
 		// Graph category-hue overrides (AM-2, U02-W5): GET is member-tier (the

go/internal/handler/graph.go

@@ -80,11 +80,11 @@ func (h *GraphHandler) egoCache(cfg *config.Config) store.EgoCache {
 
 // Parameter ceilings (out-of-range → 400, never silently clamped).
 const (
-	egoDefaultHops      = 1
-	egoMaxHops          = 3
-	egoDefaultCap       = 25
-	egoMaxCap           = 100
-	egoDefaultLimit     = 500
+	egoDefaultHops  = 1
+	egoMaxHops      = 3
+	egoDefaultCap   = 25
+	egoMaxCap       = 100
+	egoDefaultLimit = 500
 	// egoMaxLimit was lowered from 5000 to 1500 by the G39/F5-W5 1M-synthetic
 	// benchmark: at 5000 nodes the worst-case pipeline (hops=3/cap=100, a dense
 	// region with ≥5 degree-10^4 hubs) ran p95 ~850ms — dominated by Q3 (per-node
@@ -156,6 +156,65 @@ type egoStats struct {
 	ElapsedMs       int64 `json:"elapsed_ms"`
 }
 
+// HandleAll processes GET /api/graph/all requests — the flat "load all" seed
+// (store.FullGraph): every visible block up to limit, induced edges, degrees.
+// Same auth/rate-limit/registry discipline as HandleEgo; no focus, so there is
+// no 404 arm and the access log carries an empty focus.
+func (h *GraphHandler) HandleAll(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	reqID := RequestIDFromContext(ctx)
+
+	authResult := AuthResultFromContext(ctx)
+	if authResult == nil || !authResult.IsValid {
+		writeJSON(w, http.StatusUnauthorized, map[string]any{"success": false, "error": "unauthorized"})
+		return
+	}
+
+	cfgSnap := h.cfg.SnapshotForRequest(ctx)
+
+	// Same "graph" action bucket as ego — a load-all IS a graph read.
+	if limit := cfgSnap.Query.RateLimitRead; limit > 0 {
+		readCount, err := store.CheckRateLimitByAction(ctx, h.pool, authResult.ApiKeyID, "graph")
+		if err != nil {
+			slog.Error("graph: read rate limit check error", "error", err, "request_id", reqID)
+			writeJSON(w, http.StatusInternalServerError, map[string]any{"success": false, "error": "Internal server error"})
+			return
+		}
+		if readCount >= limit {
+			writeJSON(w, http.StatusTooManyRequests, map[string]any{
+				"success": false,
+				"error":   fmt.Sprintf("Rate limit exceeded: max %d graph reads per 60 seconds", limit),
+			})
+			return
+		}
+	}
+
+	snap := h.blocktypes.SnapshotForRequest(ctx)
+	params, rawLinkClass, err := parseAllParams(r.URL.Query(), snap.StructuralClasses())
+	if err != nil {
+		writeJSON(w, http.StatusBadRequest, map[string]any{"success": false, "error": err.Error()})
+		return
+	}
+
+	start := time.Now()
+	// grantedBlockIDs nil — T40a parity with HandleEgo (grant resolution is a
+	// later wave); the type allowlist comes from the registry snapshot (T6).
+	result, err := store.FullGraph(ctx, h.pool, params, authResult.ReadScopes, nil, snap.VisibleTypes())
+	if err != nil {
+		slog.Error("graph: full query error", "error", err, "request_id", reqID)
+		writeJSON(w, http.StatusInternalServerError, map[string]any{"success": false, "error": "Internal server error"})
+		return
+	}
+	elapsedMs := time.Since(start).Milliseconds()
+
+	// Best effort, same bucket as ego (focus "" = load-all in the metadata).
+	if err := store.LogGraphAccess(ctx, h.pool, authResult.ApiKeyID, "", 0, params.Limit, len(result.Nodes), len(result.StructEdges)); err != nil {
+		slog.Error("graph: access log error", "error", err, "request_id", reqID)
+	}
+
+	writeJSON(w, http.StatusOK, buildEgoResponse(result, params, rawLinkClass, elapsedMs))
+}
+
 // HandleEgo processes GET /api/graph/ego requests.
 func (h *GraphHandler) HandleEgo(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
@@ -350,6 +409,42 @@ func parseEgoParams(q url.Values, structVocab []string) (store.EgoParams, []stri
 	return p, rawLinkClass, nil
 }
 
+// parseAllParams validates the /api/graph/all query: the ego params MINUS
+// block/hops/per_node_cap (no focus, no traversal). limit defaults to the
+// CEILING — "load all" wants everything the benchmark-proven envelope allows
+// (egoMaxLimit, G39); the truncation flag tells the client what was cut.
+// Same ceilings-not-clamps discipline and the same link_class partition.
+func parseAllParams(q url.Values, structVocab []string) (store.EgoParams, []string, error) {
+	p := store.EgoParams{}
+
+	var err error
+	if p.Limit, err = egoIntParam(q, "limit", egoMaxLimit, 1, egoMaxLimit); err != nil {
+		return p, nil, err
+	}
+	// edge_limit defaults to the CEILING too (not egoDefaultEdgeLimit): the
+	// max equals the client's hard edge budget (evict, design 05-§6.6), and a
+	// 4000-default would truncate the very corpus the button exists to show.
+	if p.EdgeLimit, err = egoIntParam(q, "edge_limit", egoMaxEdgeLimit, 1, egoMaxEdgeLimit); err != nil {
+		return p, nil, err
+	}
+	if p.MinConfidence, err = egoFloatParam(q, "min_confidence", 0, 0, 1); err != nil {
+		return p, nil, err
+	}
+	var rawLinkClass []string
+	if p.LinkClasses, p.StructClasses, rawLinkClass, err = egoLinkClassPartition(q.Get("link_class"), structVocab); err != nil {
+		return p, nil, err
+	}
+	p.Categories = egoCSV(q.Get("category"))
+	if p.CreatedAfter, err = egoTimeParam(q, "created_after"); err != nil {
+		return p, nil, err
+	}
+	if p.CreatedBefore, err = egoTimeParam(q, "created_before"); err != nil {
+		return p, nil, err
+	}
+
+	return p, rawLinkClass, nil
+}
+
 // egoIntParam parses an optional integer query parameter with inclusive
 // bounds. Absent or empty → def.
 func egoIntParam(q url.Values, name string, def, minVal, maxVal int) (int, error) {

go/internal/handler/graph_test.go

@@ -260,3 +260,60 @@ func TestEgoResponse_EmptyCollectionsAreArrays(t *testing.T) {
 		}
 	}
 }
+
+// parseAllParams (load-all): no block/hops/per_node_cap; limit AND edge_limit
+// default to their ceilings (the button's whole point is "everything the
+// proven envelope allows"); the shared filter/partition pieces behave exactly
+// like ego.
+func TestParseAllParams(t *testing.T) {
+	t.Run("Defaults", func(t *testing.T) {
+		p, raw, err := parseAllParams(egoQuery(t, ""), nil)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if p.Limit != egoMaxLimit || p.EdgeLimit != egoMaxEdgeLimit {
+			t.Errorf("defaults wrong: limit=%d edge_limit=%d (want ceilings %d/%d)", p.Limit, p.EdgeLimit, egoMaxLimit, egoMaxEdgeLimit)
+		}
+		if p.Focus != "" || p.Hops != 0 || p.PerNodeCap != 0 {
+			t.Errorf("traversal params must stay zero: %+v", p)
+		}
+		if raw != nil || p.LinkClasses != nil || p.Categories != nil {
+			t.Error("optional filters must default to nil")
+		}
+	})
+
+	t.Run("CeilingsNotClamped", func(t *testing.T) {
+		bad := []string{
+			"limit=0", "limit=1501",
+			"edge_limit=0", "edge_limit=20001",
+			"min_confidence=1.5",
+			"link_class=topical,unknown",
+			"created_after=gestern",
+		}
+		for _, raw := range bad {
+			if _, _, err := parseAllParams(egoQuery(t, raw), nil); err == nil {
+				t.Errorf("query %q: expected error, got nil", raw)
+			}
+		}
+	})
+
+	t.Run("SharedFilterPieces", func(t *testing.T) {
+		p, raw, err := parseAllParams(
+			egoQuery(t, "limit=10&min_confidence=0.5&link_class=topical,references&category=infra"),
+			[]string{"references"},
+		)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if p.Limit != 10 || p.MinConfidence != 0.5 {
+			t.Errorf("scalars wrong: %+v", p)
+		}
+		if len(p.LinkClasses) != 1 || p.LinkClasses[0] != "topical" ||
+			len(p.StructClasses) != 1 || p.StructClasses[0] != "references" {
+			t.Errorf("link_class partition wrong: dream=%v struct=%v", p.LinkClasses, p.StructClasses)
+		}
+		if len(raw) != 2 || len(p.Categories) != 1 || p.Categories[0] != "infra" {
+			t.Errorf("raw echo / category wrong: raw=%v cat=%v", raw, p.Categories)
+		}
+	})
+}

go/internal/store/graph_all.go

@@ -0,0 +1,127 @@
+// FullGraph — the flat "load all" seed behind GET /api/graph/all (SPA
+// load-all button). NO traversal: the node set is simply every visible block
+// (canonical visibility triple + the ego node filters), newest-first with an
+// id tiebreak so truncation is deterministic. Edges and degrees then run
+// through the SHARED SQL stages (egoSQLEdges = Q2/Q2s/Q3 verbatim) — scope
+// safety holds by the Q2 invariant (both endpoints passed the triple), and a
+// second copy of any visibility check would be a second truth; there is none.
+//
+// The bridge-leak / cap-starvation machinery of EgoGraph does not apply here:
+// nothing is traversed THROUGH, no per-node cap slot is granted — the node set
+// is predicate-defined, not reachability-defined. Deliberately SQL-only: the
+// W05.5 cache arm answers frontier walks, a flat listing gains nothing from it.
+package store
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/GottZ/ctx/internal/graphcache"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// FullGraph returns up to p.Limit visible blocks (created_at DESC, id) plus
+// the induced edges of both data classes and the visible degrees. p.Focus,
+// p.Hops and p.PerNodeCap are ignored — EgoResult.Focus is "" (no focus
+// exists). Truncated reports node OR edge budget exhaustion, exactly like
+// EgoGraph.
+func FullGraph(ctx context.Context, pool *pgxpool.Pool, p EgoParams, readScopes, grantedBlockIDs, visibleTypes []string) (*EgoResult, error) {
+	if err := RequireScopes(readScopes); err != nil { // T07 fail-closed (design/01 §5.4)
+		return nil, err
+	}
+	if len(visibleTypes) == 0 {
+		return nil, errors.New("store: empty visible-types allowlist (block-type registry not wired?)")
+	}
+	if grantedBlockIDs == nil {
+		grantedBlockIDs = []string{} // deterministic '{}'::uuid[], never NULL
+	}
+	normalizeClassFilters(&p)
+
+	// Flat seed: the ego NODE filters (category, created window) apply; edge
+	// filters (min_confidence, link_class) belong to the edge stages below.
+	// LIMIT reads one row beyond the budget so the truncation flag is exact.
+	q := fmt.Sprintf(
+		`SELECT b.id::text, left(b.title, 120), b.category, b.scope::text, b.created_at
+		 FROM context_blocks b
+		 WHERE %s
+		   AND ($5::text[] IS NULL OR b.category = ANY($5))
+		   AND ($6::timestamptz IS NULL OR b.created_at >= $6)
+		   AND ($7::timestamptz IS NULL OR b.created_at <  $7)
+		 ORDER BY b.created_at DESC, b.id
+		 LIMIT $4`,
+		VisibilityPredicate("b", "$3", "$1", "$2"),
+	)
+	rows, err := pool.Query(ctx, q,
+		readScopes,               // $1
+		grantedBlockIDs,          // $2 block-grant OR-arm (T40a; nil-wired like ego)
+		visibleTypes,             // $3 registry type allowlist (T6)
+		p.Limit+1,                // $4 one extra row → exact truncation flag
+		nilIfEmpty(p.Categories), // $5
+		p.CreatedAfter,           // $6
+		p.CreatedBefore,          // $7
+	)
+	if err != nil {
+		return nil, fmt.Errorf("store: graph full seed query: %w", err)
+	}
+	defer rows.Close()
+
+	var nodes []GraphNode
+	for rows.Next() {
+		// Hop 1 for every node: there is no hop-0 focus, and the client seeds
+		// new nodes on a hop-scaled ring — hop 0 would stack the whole corpus
+		// on one point before the layout worker untangles it.
+		n := GraphNode{Hop: 1}
+		if err := rows.Scan(&n.ID, &n.Title, &n.Category, &n.Scope, &n.CreatedAt); err != nil {
+			return nil, fmt.Errorf("store: graph full seed scan: %w", err)
+		}
+		nodes = append(nodes, n)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("store: graph full seed rows: %w", err)
+	}
+
+	budget := graphcache.NewBudgetReport(graphcache.SourceSQL)
+	truncated := false
+	if len(nodes) > p.Limit {
+		nodes = nodes[:p.Limit]
+		truncated = true
+		budget.Add(graphcache.TravNodeLimitReached)
+	}
+
+	ids := make([]string, len(nodes))
+	index := make(map[string]int, len(nodes))
+	for i := range nodes {
+		ids[i] = nodes[i].ID
+		index[nodes[i].ID] = i
+	}
+
+	sql := &egoSQLEdges{pool: pool, p: p, readScopes: readScopes, grantedBlockIDs: grantedBlockIDs, visibleTypes: visibleTypes}
+	es, err := sql.edges(ctx, ids, index)
+	if err != nil {
+		return nil, err
+	}
+	if es.DreamTrunc {
+		truncated = true
+		budget.Add(graphcache.TravEdgeLimitReached)
+	}
+	if es.StructTrunc {
+		truncated = true
+		budget.Add(graphcache.TravEdgeLimitReached)
+	}
+	if err := sql.degrees(ctx, ids, nodes); err != nil {
+		return nil, err
+	}
+
+	return &EgoResult{
+		Focus:       "",
+		Rels:        GraphRels,
+		StructRels:  es.StructRels,
+		Origins:     es.Origins,
+		Nodes:       nodes,
+		Edges:       es.Dream,
+		StructEdges: es.Struct,
+		Truncated:   truncated,
+		Budget:      budget,
+	}, nil
+}