@cortexkit/opencode-magic-context 0.46.1 → 0.48.0

package/src/shared/sqlite.ts

@@ -41,6 +41,7 @@
 
 import { AsyncLocalStorage } from "node:async_hooks";
 import { statSync } from "node:fs";
+
 // Type import only — runtime is loaded dynamically below. @types/better-sqlite3
 // has the richest definitions and is a structural superset of the API surface
 // we use, so calls typed against BetterSqlite3 work under bun:sqlite and
@@ -169,13 +170,51 @@ export class SqliteRuntimeUnavailableError extends Error {
     }
 }
 
+// Node requests this warning during node:sqlite's module evaluation, although
+// warning delivery happens later. Intercept only the request while importing;
+// replacing warning listeners would not suppress the default stderr output.
+function isNodeSqliteExperimentalWarning(args: unknown[]): boolean {
+    const [warning, options] = args;
+    const message = warning instanceof Error ? warning.message : warning;
+    const type =
+        typeof options === "string"
+            ? options
+            : options && typeof options === "object"
+              ? (options as { type?: unknown }).type
+              : undefined;
+    return (
+        type === "ExperimentalWarning" &&
+        typeof message === "string" &&
+        message.startsWith("SQLite is an experimental feature")
+    );
+}
+
+async function importSqliteModuleForRuntime(
+    runtime: SqliteRuntime,
+    specifier: string,
+    importer: (specifier: string) => Promise<SqliteModule>,
+): Promise<SqliteModule> {
+    if (runtime !== "Node.js") return importer(specifier);
+
+    const originalEmitWarning = process.emitWarning;
+    process.emitWarning = function (this: unknown, ...args: unknown[]): void {
+        if (isNodeSqliteExperimentalWarning(args)) return;
+        Reflect.apply(originalEmitWarning, this, args);
+    } as typeof process.emitWarning;
+    try {
+        return await importer(specifier);
+    } finally {
+        process.emitWarning = originalEmitWarning;
+    }
+}
+
 export async function loadSqliteModule(
     runtime: SqliteRuntime = detectSqliteRuntime(),
     importer: (specifier: string) => Promise<SqliteModule> = importSqliteModule,
 ): Promise<SqliteModule> {
     const specifier = runtime === "Bun" ? bunSpec : nodeSpec;
     try {
-        return await importer(specifier);
+        return await importSqliteModuleForRuntime(runtime, specifier, importer);
     } catch (error) {
         if (isModuleNotFoundError(error, specifier)) {
             throw new SqliteRuntimeUnavailableError(runtime, specifier, error);
@@ -234,6 +273,110 @@ export interface SqliteMemoryStats {
 const trackedSqliteConnections = new Map<number, TrackedSqliteConnection>();
 let nextSqliteConnectionSequence = 1;
 
+/**
+ * Columns of Magic Context's `tags` table (context.db) that never decide which
+ * message a tag belongs to, its number, its type, or its reasoning token estimate.
+ */
+const TAG_COLUMNS_OUTSIDE_IDENTITY = new Set([
+    "status",
+    "drop_mode",
+    "byte_size",
+    "input_byte_size",
+    "reasoning_byte_size",
+    "token_count",
+    "input_token_count",
+    "caveman_depth",
+    "entry_fingerprint",
+    "tool_name",
+    "harness",
+]);
+
+let tagIdentityWriteGeneration = 0;
+
+/**
+ * Whether a write statement may change an existing `tags` row's identity
+ * (session, number, type, owner message, reasoning token count) or remove a
+ * row. Plain appends without an explicit `id`, and updates that assign only
+ * columns in {@link TAG_COLUMNS_OUTSIDE_IDENTITY}, cannot; everything else that
+ * names the table is treated as if it could, including DDL and multi-statement
+ * scripts. Erring towards true only costs a cache rebuild.
+ */
+export function mayChangeTagIdentity(sql: string): boolean {
+    if (!/\btags\b/i.test(sql) || /^\s*(?:SELECT|EXPLAIN|PRAGMA)\b/i.test(sql)) return false;
+    if (/^\s*WITH\b/i.test(sql) && !/\b(?:INSERT|UPDATE|DELETE|REPLACE)\b/i.test(sql)) return false;
+    // One statement only: a script can hide a DELETE behind a harmless first statement.
+    if (/;\s*\S/.test(sql) || /\bREPLACE\b/i.test(sql) || /\bON\s+CONFLICT\b/i.test(sql))
+        return true;
+    const insert = /^\s*INSERT\s+INTO\s+(?:main\.)?["`]?tags["`]?\s*\(([^)]*)\)/i.exec(sql);
+    if (insert) {
+        const columns = (insert[1] ?? "").split(",").map((column) =>
+            column
+                .trim()
+                .replace(/["`[\]]/g, "")
+                .toLowerCase(),
+        );
+        return columns.includes("id") || columns.includes("rowid");
+    }
+    const update = /^\s*UPDATE\s+(?:main\.)?["`]?tags["`]?\s+SET\s+([\s\S]*?)\bWHERE\b/i.exec(sql);
+    if (update && !/\bSELECT\b/i.test(sql)) {
+        // Provably identity-free only when every top-level assignment is a plain
+        // `column = ...` naming an allowed column. A tuple assignment such as
+        // `(tag_number, reasoning_token_count) = (...)`, or anything this cannot
+        // read, counts as an identity write.
+        const assignments = topLevelCommaSegments(update[1] ?? "");
+        if (!assignments) return true;
+        return !assignments.every((assignment) => {
+            const column = /^\s*["`]?(\w+)["`]?\s*=(?!=)/.exec(assignment)?.[1];
+            return column !== undefined && TAG_COLUMNS_OUTSIDE_IDENTITY.has(column.toLowerCase());
+        });
+    }
+    return true;
+}
+
+/**
+ * Split SQL text at commas outside parentheses and quotes. Returns null when
+ * the parentheses or quotes do not balance.
+ */
+function topLevelCommaSegments(text: string): string[] | null {
+    const segments: string[] = [];
+    let depth = 0;
+    let quote: string | null = null;
+    let start = 0;
+    for (let index = 0; index < text.length; index += 1) {
+        const char = text[index];
+        if (quote) {
+            // A doubled quote inside a quoted run is an escaped quote.
+            if (char === quote) {
+                if (text[index + 1] === quote) index += 1;
+                else quote = null;
+            }
+            continue;
+        }
+        if (char === "'" || char === '"' || char === "`") quote = char;
+        else if (char === "(") depth += 1;
+        else if (char === ")") {
+            depth -= 1;
+            if (depth < 0) return null;
+        } else if (char === "," && depth === 0) {
+            segments.push(text.slice(start, index));
+            start = index + 1;
+        }
+    }
+    if (quote || depth !== 0) return null;
+    segments.push(text.slice(start));
+    return segments;
+}
+
+/**
+ * Counts executions, on any connection this process opened, of statements for
+ * which {@link mayChangeTagIdentity} is true. A cache built from `tags` stays
+ * valid for this process's own writes while the count is unchanged; commits by
+ * other connections show up in `PRAGMA data_version` instead.
+ */
+export function getTagIdentityWriteGeneration(): number {
+    return tagIdentityWriteGeneration;
+}
+
 /** Route native Bun and Node transaction entry through the same acquisition retry.
  * Native Bun transaction wrappers execute BEGIN internally, bypassing an exec override,
  * so both runtimes use this small synchronous wrapper instead. Writable handles
@@ -245,6 +388,7 @@ function installTransactionRouting(db: BetterSqlite3.Database, readonly: boolean
         configurable: true,
         writable: true,
         value: (sql: string) => {
+            if (/^\s*(?:COMMIT|END)\b/i.test(sql)) assertTransformWrite();
             if (/^\s*BEGIN\s+(?:IMMEDIATE|EXCLUSIVE)(?:\s+TRANSACTION)?\s*;?\s*$/i.test(sql)) {
                 // A transaction that ended without passing through exec (for
                 // example an automatic rollback) must not be timed as this one.
@@ -256,8 +400,15 @@ function installTransactionRouting(db: BetterSqlite3.Database, readonly: boolean
             }
             if (WRITER_TRANSACTION_END.test(sql) && openWriterTransactions.has(db))
                 return endWriterTransaction(db, () => nativeExec(sql), sql);
-            if (!/^\s*(?:SELECT|EXPLAIN|PRAGMA|COMMIT|END|ROLLBACK|SAVEPOINT|RELEASE)\b/i.test(sql))
-                return withAutocommitTimeout(db, () => nativeExec(sql));
+            if (
+                !/^\s*(?:SELECT|EXPLAIN|PRAGMA|COMMIT|END|ROLLBACK|SAVEPOINT|RELEASE)\b/i.test(sql)
+            ) {
+                try {
+                    return withAutocommitTimeout(db, () => nativeExec(sql));
+                } finally {
+                    if (mayChangeTagIdentity(sql)) tagIdentityWriteGeneration += 1;
+                }
+            }
             return nativeExec(sql);
         },
     });
@@ -270,15 +421,22 @@ function installTransactionRouting(db: BetterSqlite3.Database, readonly: boolean
             // SELECT/EXPLAIN cannot acquire a writer. Treat CTEs conservatively:
             // WITH can introduce INSERT/UPDATE/DELETE as well as a read query.
             if (!readonly && !/^\s*(?:SELECT|EXPLAIN|PRAGMA)\b/i.test(sql)) {
+                const changesTagIdentity = mayChangeTagIdentity(sql);
                 for (const method of ["run", "get", "all"] as const) {
                     const execute = statement[method].bind(statement);
                     Object.defineProperty(statement, method, {
                         configurable: true,
                         // biome-ignore lint/suspicious/noExplicitAny: retain SQLite's native binding overloads.
-                        value: (...args: any[]) =>
-                            withAutocommitTimeout(db, () => execute(...args)),
+                        value: (...args: any[]) => {
+                            try {
+                                return withAutocommitTimeout(db, () => execute(...args));
+                            } finally {
+                                if (changesTagIdentity) tagIdentityWriteGeneration += 1;
+                            }
+                        },
                     });
                 }
+                if (changesTagIdentity) wrapRemainingTagWriteForms(statement);
             }
             return statement;
         },
@@ -329,6 +487,43 @@ function installTransactionRouting(db: BetterSqlite3.Database, readonly: boolean
     });
 }
 
+/**
+ * Count tag identity writes made through the statement forms the transaction
+ * routing does not wrap. `iterate()` runs the statement while its result is
+ * consumed, so the generation moves both when iteration starts and when it
+ * ends: a summary read in between is then rebuilt on its next read.
+ */
+// biome-ignore lint/suspicious/noExplicitAny: statements from both backends share these method names.
+function wrapRemainingTagWriteForms(statement: any): void {
+    if (typeof statement.iterate === "function") {
+        const iterate = statement.iterate.bind(statement);
+        Object.defineProperty(statement, "iterate", {
+            configurable: true,
+            value: function* (...args: unknown[]) {
+                tagIdentityWriteGeneration += 1;
+                try {
+                    yield* iterate(...args);
+                } finally {
+                    tagIdentityWriteGeneration += 1;
+                }
+            },
+        });
+    }
+    if (typeof statement.values === "function") {
+        const values = statement.values.bind(statement);
+        Object.defineProperty(statement, "values", {
+            configurable: true,
+            value: (...args: unknown[]) => {
+                try {
+                    return values(...args);
+                } finally {
+                    tagIdentityWriteGeneration += 1;
+                }
+            },
+        });
+    }
+}
+
 function trackSqliteConnection(
     db: BetterSqlite3.Database,
     filename: unknown,
@@ -430,6 +625,23 @@ function buildNodeSqliteDatabaseClass(DatabaseSync: any): typeof BetterSqlite3 {
 
 export const Database: typeof BetterSqlite3 = TrackedDatabase;
 
+/** The constructor path, without querying SQLite on the prompt thread. */
+export function getSqliteDatabasePath(db: Database): string | null {
+    for (const connection of trackedSqliteConnections.values()) {
+        if (connection.reference.deref() === db) {
+            return connection.filename === ":memory:" || connection.filename === "<buffer>"
+                ? null
+                : connection.filename;
+        }
+    }
+    // Native Bun/better-sqlite3 handles can reach readers without our constructor
+    // wrapper. Their filename is still available without a SQLite query.
+    const native = db as unknown as { filename?: unknown; name?: unknown };
+    const path = native.filename ?? native.name;
+    if (typeof path === "string" && path !== ":memory:" && path !== "") return path;
+    return null;
+}
+
 function pragmaValue(db: BetterSqlite3.Database, name: string): unknown {
     const row = db.prepare(`PRAGMA ${name}`).get() as Record<string, unknown> | undefined;
     if (!row) return undefined;
@@ -556,6 +768,33 @@ interface StatementOwner {
 const statementOwners = new WeakMap<Database, StatementOwner>();
 const FIRST_PRUNE_AT = 256;
 
+/**
+ * Bun's default close (`sqlite3_close_v2`) only releases the native connection
+ * once every statement created by prepare() is finalized. The close override
+ * in ownPreparedStatement can finalize only statements that are still
+ * reachable. Once the garbage collector
+ * has marked a one-shot statement dead, its weak reference is already cleared,
+ * but the statement is finalized only when its memory is later swept. Until
+ * then the closed connection keeps the database, WAL and shared-memory files
+ * open, for an unbounded time.
+ *
+ * `close(true)` finalizes every outstanding statement, reachable or not, and
+ * releases the connection immediately. When the caller did not ask for errors
+ * and that close fails, fall back to the caller's own close so a teardown path
+ * never starts throwing; the fallback can defer the release as before.
+ */
+function closeReleasingStatements(
+    close: (...args: unknown[]) => unknown,
+    args: unknown[],
+): unknown {
+    if (args[0] === true) return close(true);
+    try {
+        return close(true);
+    } catch {
+        return close(...args);
+    }
+}
+
 function ownPreparedStatement(db: Database, statement: Statement): Statement {
     const finalizable = statement as FinalizableStatement;
     // Node finalizes its statements on close and exposes no finalize() method.
@@ -579,7 +818,7 @@ function ownPreparedStatement(db: Database, statement: Statement): Statement {
                     }
                 }
                 references.clear();
-                const result = close(...args);
+                const result = closeReleasingStatements(close, args);
                 if (failure) throw failure;
                 return result;
             },
@@ -617,7 +856,12 @@ export function prepareCachedStatement(db: Database, sql: string): Statement {
 
 const privilegeDepth = new WeakMap<Database, number>();
 const transformPassScope = new AsyncLocalStorage<
-    { active: boolean; remainingWaitMs: number } | undefined
+    | {
+          active: boolean;
+          remainingWaitMs: number;
+          guard?: { assert(): void; remainingMs(): number };
+      }
+    | undefined
 >();
 const admissionScope = new AsyncLocalStorage<boolean>();
 const backgroundWriterScope = new AsyncLocalStorage<boolean>();
@@ -632,22 +876,31 @@ export function withSqliteBackgroundWriter<T>(operation: () => T): T {
 export function withSqliteTransformPass<T>(operation: () => T): T {
     const existing = transformPassScope.getStore();
     if (existing?.active) return operation();
-    const lease = { active: true, remainingWaitMs: FOREGROUND_IN_PASS_BUSY_TIMEOUT_MS };
-    return transformPassScope.run(lease, () => {
-        try {
-            const result = operation();
-            if (result && typeof (result as { then?: unknown }).then === "function") {
-                return Promise.resolve(result).finally(() => {
-                    lease.active = false;
-                }) as T;
+    const reservation = reserveForegroundSqliteTurn();
+    const run = (release: () => void): T => {
+        const lease = { active: true, remainingWaitMs: FOREGROUND_IN_PASS_BUSY_TIMEOUT_MS };
+        return transformPassScope.run(lease, () => {
+            try {
+                const result = operation();
+                if (result && typeof (result as { then?: unknown }).then === "function") {
+                    return Promise.resolve(result).finally(() => {
+                        lease.active = false;
+                        release();
+                    }) as T;
+                }
+                lease.active = false;
+                release();
+                return result;
+            } catch (error) {
+                lease.active = false;
+                release();
+                throw error;
             }
-            lease.active = false;
-            return result;
-        } catch (error) {
-            lease.active = false;
-            throw error;
-        }
-    });
+        });
+    };
+    // Foreground callers racing maintenance are awaited transforms. Idle
+    // synchronous callers keep the existing immediate return/throw behavior.
+    return typeof reservation === "function" ? run(reservation) : (reservation.then(run) as T);
 }
 
 /** Start detached maintenance work without borrowing a foreground pass's budget. */
@@ -655,6 +908,17 @@ export function withoutSqliteTransformPass<T>(operation: () => T): T {
     return transformPassScope.run(undefined, operation);
 }
 
+/** Attach the adapter's existing generation/cancellation/deadline guard to writes. */
+export function guardSqliteTransformPass(guard: { assert(): void; remainingMs(): number }): void {
+    const lease = transformPassScope.getStore();
+    if (lease) lease.guard = guard;
+}
+
+/** Check the attached generation/cancellation/deadline guard before SQL or cache publication. */
+export function assertTransformWrite(): void {
+    if (!backgroundWriterScope.getStore()) transformPassScope.getStore()?.guard?.assert();
+}
+
 /** Bun names SQLite codes; node:sqlite exposes the numeric (possibly extended) errcode. */
 export function isTransientSqliteError(error: unknown): boolean {
     if (!error || typeof error !== "object") return false;
@@ -698,6 +962,7 @@ interface WriterAcquisition {
     startedAt: number;
     attempts: number;
     claimed: boolean;
+    remainingMs?: () => number;
 }
 
 /** A write transaction whose BEGIN went through `acquireShort` and has not ended yet. */
@@ -724,6 +989,7 @@ function foregroundWaitLease() {
  * native API cannot separate lock waiting from statement execution. Exhaustion
  * switches to zero-wait acquisition, not a refusal when the writer is free. */
 function withAutocommitTimeout<T>(db: Database, operation: () => T): T {
+    assertTransformWrite();
     const lease = foregroundWaitLease();
     if (isInTransaction(db) || (!lease && !backgroundWriterScope.getStore())) return operation();
     const previous = pragmaNumber(db, "busy_timeout");
@@ -749,6 +1015,7 @@ function withAutocommitTimeout<T>(db: Database, operation: () => T): T {
 
 /** The connection is never handed back to another caller with a shortened timeout. */
 function acquireShort(db: Database, acquire: () => unknown, site: string): void {
+    assertTransformWrite();
     const started = performance.now();
     const previous = pragmaNumber(db, "busy_timeout");
     const outer = writerAcquisitionScope.getStore();
@@ -763,7 +1030,12 @@ function acquireShort(db: Database, acquire: () => unknown, site: string): void
         // stays short. An ordinary BEGIN inside a transform pass cannot yield;
         // give that single attempt enough time for a brief writer to finish.
         const lease = foregroundWaitLease();
-        const timeout = lease ? Math.floor(lease.remainingWaitMs) : SHORT_BUSY_TIMEOUT_MS;
+        const timeout = Math.floor(
+            Math.min(
+                lease ? lease.remainingWaitMs : SHORT_BUSY_TIMEOUT_MS,
+                owner?.remainingMs?.() ?? lease?.guard?.remainingMs() ?? Infinity,
+            ),
+        );
         db.exec(`PRAGMA busy_timeout=${timeout}`);
         acquire();
         acquiredAt = performance.now();
@@ -799,16 +1071,20 @@ function acquireShort(db: Database, acquire: () => unknown, site: string): void
  * `acquireShort`, then report how long the writer waited for the lock
  * (`acquire_ms`) and how long it then held it (`hold_ms`) when either crosses
  * the threshold. A long hold blocks every other process's writer, so it is
- * worth seeing even when the lock itself came quickly.
+ * worth seeing even when the lock itself came quickly. The native end statement's
+ * `end_ms` is reported separately, so a slow FTS merge or checkpoint at COMMIT
+ * is not mistaken for acquisition time.
  */
 function endWriterTransaction(db: Database, end: () => unknown, sql: string): unknown {
     let ended = false;
+    const endStarted = performance.now();
     try {
         const result = end();
         ended = true;
         return result;
     } finally {
         const open = openWriterTransactions.get(db);
+        const endMs = performance.now() - endStarted;
         // A COMMIT that failed with the transaction still open has not ended it.
         if (open && !isInTransaction(db)) {
             openWriterTransactions.delete(db);
@@ -820,7 +1096,7 @@ function endWriterTransaction(db: Database, end: () => unknown, sql: string): un
                       ? "committed"
                       : "failed";
                 reportSqliteDiagnostic(
-                    `sqlite writer site=${open.site} lane=${open.lane} acquire_ms=${Math.round(open.acquireMs)} hold_ms=${Math.round(holdMs)} attempts=${open.attempts} outcome=${outcome}`,
+                    `sqlite writer site=${open.site} lane=${open.lane} acquire_ms=${Math.round(open.acquireMs)} hold_ms=${Math.round(holdMs)} end_ms=${Math.round(endMs)} attempts=${open.attempts} outcome=${outcome}`,
                 );
             }
         }
@@ -871,11 +1147,28 @@ export async function beginSqliteWriterAsync(db: Database, site: string): Promis
 }
 
 /** Retry admission before any turn work, yielding between short lock attempts. */
-export async function withAsyncPrivilegedWriter<T>(db: Database, operation: () => T): Promise<T> {
+export async function withAsyncPrivilegedWriter<T>(
+    db: Database,
+    operation: () => T,
+    options: {
+        signal?: AbortSignal;
+        beforeRetry?: (error: SqliteAcquisitionBusyError) => void;
+        jitter?: boolean;
+        budgetMs?: number;
+        assertCurrentPass?: () => void;
+    } = {},
+): Promise<T> {
     const started = performance.now();
+    const budgetMs = Math.max(
+        0,
+        Math.min(FOREGROUND_ACQUISITION_BUDGET_MS, options.budgetMs ?? Infinity),
+    );
     let attempts = 0;
     for (;;) {
+        options.signal?.throwIfAborted();
+        options.assertCurrentPass?.();
         attempts++;
+        let entered = false;
         try {
             const acquisition: WriterAcquisition = {
                 site: "privileged_writer",
@@ -883,35 +1176,51 @@ export async function withAsyncPrivilegedWriter<T>(db: Database, operation: () =
                 startedAt: started,
                 attempts,
                 claimed: false,
+                remainingMs: () => Math.max(0, budgetMs - (performance.now() - started)),
             };
             // The acquisition and hold of this transaction are reported when it
             // commits or rolls back (see endWriterTransaction).
             return admissionScope.run(true, () =>
                 withSqliteTransformPass(() =>
                     writerAcquisitionScope.run(acquisition, () =>
-                        withPrivilegedWriter(db, operation),
+                        withPrivilegedWriter(db, () => {
+                            entered = true;
+                            return operation();
+                        }),
                     ),
                 ),
             );
         } catch (error) {
             // A callback failure can occur after writes; only retry a failed BEGIN.
-            if (!(error instanceof SqliteAcquisitionBusyError)) throw error;
+            if (entered || !(error instanceof SqliteAcquisitionBusyError)) throw error;
+            // Adapters may serve a validated saved request instead of waiting.
+            // This runs only after a failed BEGIN, never after callback writes.
+            options.beforeRetry?.(error);
             const elapsed = performance.now() - started;
-            if (elapsed >= FOREGROUND_ACQUISITION_BUDGET_MS) {
+            if (elapsed >= budgetMs) {
                 reportSqliteDiagnostic(
                     `sqlite writer site=privileged_writer lane=foreground acquire_ms=${Math.round(elapsed)} attempts=${attempts} outcome=busy`,
                 );
                 throw error;
             }
-            await new Promise<void>((resolve) =>
-                setTimeout(
-                    resolve,
-                    Math.min(
-                        attempts === 1 ? 500 : 1000,
-                        FOREGROUND_ACQUISITION_BUDGET_MS - elapsed,
-                    ),
-                ),
+            const backoff = attempts === 1 ? 500 : 1000;
+            const delay = Math.min(
+                options.jitter ? backoff * (0.8 + Math.random() * 0.4) : backoff,
+                budgetMs - elapsed,
             );
+            await new Promise<void>((resolve, reject) => {
+                const abort = () => {
+                    clearTimeout(timer);
+                    options.signal?.removeEventListener("abort", abort);
+                    reject(options.signal?.reason ?? new Error("Writer wait aborted"));
+                };
+                const timer = setTimeout(() => {
+                    options.signal?.removeEventListener("abort", abort);
+                    resolve();
+                }, delay);
+                options.signal?.addEventListener("abort", abort, { once: true });
+                if (options.signal?.aborted) abort();
+            });
         }
     }
 }
@@ -986,3 +1295,80 @@ export function withPrivilegedWriter<T>(db: Database, operation: () => T): T {
         throw error;
     }
 }
+
+// Process-local admission only; SQLite remains the cross-process writer arbiter.
+const indexCoordinationKey = Symbol.for("magic-context.index-foreground-coordination.v1");
+const indexCoordinationHeap = globalThis as unknown as Record<
+    symbol,
+    SharedArrayBuffer | undefined
+>;
+const indexCoordinationBuffer =
+    indexCoordinationHeap[indexCoordinationKey] ??
+    new SharedArrayBuffer(3 * Int32Array.BYTES_PER_ELEMENT);
+indexCoordinationHeap[indexCoordinationKey] = indexCoordinationBuffer;
+const indexCoordinationState = new Int32Array(indexCoordinationBuffer);
+// Slots: foreground interest, current maintenance owner, next owner token.
+
+export function indexCoordinationInput(): {
+    indexCoordination: SharedArrayBuffer;
+    indexOwner: number;
+} {
+    return {
+        indexCoordination: indexCoordinationBuffer,
+        indexOwner: Atomics.add(indexCoordinationState, 2, 1) + 1,
+    };
+}
+
+const yieldIndexTurn = () => new Promise<void>((resolve) => setTimeout(resolve, 1));
+
+/** Announce interest before waiting, so no maintenance chunk overtakes a foreground turn. */
+function reserveForegroundSqliteTurn(): (() => void) | Promise<() => void> {
+    Atomics.add(indexCoordinationState, 0, 1);
+    const release = () => {
+        Atomics.sub(indexCoordinationState, 0, 1);
+        Atomics.notify(indexCoordinationState, 0);
+    };
+    if (Atomics.load(indexCoordinationState, 1) === 0) return release;
+    return (async () => {
+        while (Atomics.load(indexCoordinationState, 1) !== 0) await yieldIndexTurn();
+        return release;
+    })();
+}
+
+export function releaseIndexOwner(input: {
+    indexCoordination?: SharedArrayBuffer;
+    indexOwner?: number;
+}): void {
+    if (!input.indexCoordination || !input.indexOwner) return;
+    const shared = new Int32Array(input.indexCoordination);
+    Atomics.compareExchange(shared, 1, input.indexOwner, 0);
+    Atomics.notify(shared, 1);
+}
+
+/** One synchronous transaction per permit; release the permit before yielding. */
+export async function withIndexChunk<T>(
+    input: { indexCoordination?: SharedArrayBuffer; indexOwner?: number },
+    operation: () => T,
+): Promise<T> {
+    if (!input.indexCoordination || !input.indexOwner) return operation();
+    const shared = new Int32Array(input.indexCoordination);
+    for (;;) {
+        if (
+            Atomics.load(shared, 0) === 0 &&
+            Atomics.compareExchange(shared, 1, 0, input.indexOwner) === 0
+        ) {
+            if (Atomics.load(shared, 0) === 0) break;
+            releaseIndexOwner(input);
+        }
+        await yieldIndexTurn();
+    }
+    try {
+        return await operation();
+    } finally {
+        releaseIndexOwner(input);
+    }
+}
+
+export async function yieldIndexChunk(): Promise<void> {
+    await yieldIndexTurn();
+}