# v0.48.3.0: verify access rules and temporary search behavior

This release applies access rules consistently and improves remote-call and
verification behavior. It requires no database schema migration or new service.

1. Verify the installed version and brain health:

   ```bash
   gbrain --version
   gbrain doctor
   gbrain search modes
   gbrain cache stats
   ```

2. Explain the temporary semantic result-cache change to the operator. Searches
   use fresh retrieval even when caching is configured. Cache statistics report
   `enabled: false`; stored rows and maintenance commands remain available.
   Repeated searches may take longer and use more provider tokens. Do not change
   provider credentials or promise that a cache setting can restore caching.

3. Stored contradiction reports are temporarily available only to trusted local
   callers without a source filter. Remote and source-scoped requests receive an
   availability note. Do not broaden a caller's source permissions to work around
   that response.

4. Explain any changed remote salience scores using the caller's permitted active
   takes. Restricted scores omit stored emotional weight and use page updates for
   recent inclusion. Existing trusted local callers without holder restrictions
   retain their formulas.

5. Existing chunks are withheld from chunk-based remote retrieval until rebuilt
   with the corrected indexer. This applies to public pages too. Direct page reads remain
   available under the connection's access rules. Preview the existing rebuild:

   ```bash
   gbrain reindex --markdown --dry-run --no-embed
   ```

   For a rebuild without embedding-provider calls:

   ```bash
   gbrain reindex --markdown --no-embed
   ```

   This replaces processed pages' chunks and clears their previous vectors.
   Keyword retrieval becomes available after rebuilding; semantic retrieval
   needs fresh embeddings. Use the normal `gbrain reindex --markdown` path when
   embedding is authorized, or restore vectors later with `gbrain embed --stale`.
   Explain provider usage before running either embedding path. Preserve the
   existing post-upgrade cost confirmation. Do not manually change chunker
   version fields to suppress pending work.

   Code pages use the existing `gbrain reindex-code --force --no-embed` path;
   add `--dry-run` to preview it. Image pages need their original files
   reimported so OCR and visual indexing are rebuilt together. Explain any OCR
   or embedding-provider usage before that import. Images with protected OCR
   sections remain unavailable to remote chunk retrieval; update the source
   image before reimporting it. Direct page access still follows normal policy.

6. Code-inspection operations (`code_def`, `code_refs`, `code_callers`,
   `code_callees`, `code_blast`, `code_flow`) are temporarily available only to
   trusted local callers. Remote callers receive an explicit availability
   error. Rebuilding chunks does not lift this separate restriction. Remote
   search omits optional code-graph expansion; ordinary authorized text search
   remains available after the index rebuild. Use the trusted local CLI when
   local access is available, without widening a remote token's permissions.

No new scheduled job or host configuration is required. Follow the exact
remediation printed by `gbrain doctor` if it finds an independent setup issue.