@ngockhoale/ukit 3.4.1 → 3.4.2

package/src/core/agentRuntime/supervisor.js

@@ -310,15 +310,30 @@ export function createSupervisor(opts = {}) {
       op.seq += 1;
       const event = makeEvent(op, 'operation.transition', { from, to, ...extra }, artifactRefs);
       await append(runtimeDir, event);
-      await writeOperationState(runtimeDir, op.id, {
-        state: to,
-        fencingEpoch,
-        ownerEpoch,
-      });
+      await writeOperationState(runtimeDir, op.id, stateRecord(op, to));
       return event;
     });
   }
 
+  /**
+   * Full-overwrite state-cache record (C92-E-03). recovery.js fences restart
+   * reconciliation on `pid`/`processStartTime`/`spawned`/`exitStatus` — every
+   * write must re-carry them or a later transition silently drops the launch
+   * metadata (writeOperationState overwrites wholesale). `undefined` fields
+   * are dropped by JSON.stringify, so pre-spawn records omit pid honestly.
+   */
+  function stateRecord(op, to) {
+    return {
+      state: to,
+      fencingEpoch,
+      ownerEpoch,
+      pid: op.pgid ?? undefined,
+      processStartTime: op.processStartTime ?? undefined,
+      spawned: op.proc != null,
+      exitStatus: Number.isInteger(op.exitInfo?.code) ? op.exitInfo.code : undefined,
+    };
+  }
+
   function emitObservation(op, cls) {
     if (op.observedClasses.has(cls)) return;
     op.observedClasses.add(cls);
@@ -340,6 +355,14 @@ export function createSupervisor(opts = {}) {
     if (op.exited || signal === 0) {
       return;
     }
+    // C92-E-01: target only a real owned process group. `-null` evaluates to
+    // -0, which process.kill accepts as group 0 — OUR OWN process group. A
+    // pre-spawn cancel or close() hits exactly that window (pgid set at
+    // spawn+assignment only), so a missing/invalid pgid must skip, never
+    // signal.
+    if (!Number.isInteger(op.pgid) || op.pgid <= 0) {
+      return;
+    }
     try {
       killImpl(signal, -op.pgid);
     } catch {
@@ -368,11 +391,7 @@ export function createSupervisor(opts = {}) {
             reason: op.cancelReason ?? 'killed',
           }, op.artifactRefs);
           await append(runtimeDir, event);
-          await writeOperationState(runtimeDir, op.id, {
-            state: 'cancelled',
-            fencingEpoch,
-            ownerEpoch,
-          });
+          await writeOperationState(runtimeDir, op.id, stateRecord(op, 'cancelled'));
           closeOpSpans(op, 'failed', {
             errorCode: reasonCodeForFailure({ cancelReason: op.cancelReason ?? 'cancel_requested' }),
             exitCode: op.exitInfo?.code,
@@ -484,7 +503,7 @@ export function createSupervisor(opts = {}) {
     op.seq += 1;
     const event = makeEvent(op, 'operation.transition', { from, to, ...extra }, op.artifactRefs);
     await append(runtimeDir, event);
-    await writeOperationState(runtimeDir, op.id, { state: to, fencingEpoch, ownerEpoch });
+    await writeOperationState(runtimeDir, op.id, stateRecord(op, to));
     // DF2-FR07: terminal transition committed — close tool + execution
     // spans with the same outcome. Cancelled is a failed run with a
     // USER_CANCELLED/TOOL_TIMEOUT code, never a silent open span.
@@ -576,6 +595,7 @@ export function createSupervisor(opts = {}) {
         chainError: null,
         proc: null,
         pgid: null,
+        processStartTime: null,
         exited: false,
         finalized: false,
         cancelRequested: false,
@@ -593,11 +613,24 @@ export function createSupervisor(opts = {}) {
       op.telemetryCtx = ctx;
       operations.set(op.id, op);
 
+      // C90-08: the 'starting' append is the durable start record — if the
+      // journal chain failed, the enqueue's catch has already swallowed the
+      // throw into op.chainError, so it must be checked HERE, before spawn
+      // releases a side effect with no proof-of-start on disk.
       await transition(op, 'starting', {
         attempt: spec.attempt,
         sideEffectClass: spec.sideEffectClass,
         ...(hostLane ? { host: hostLane.name } : {}),
       });
+      if (op.chainError) {
+        const startErr = op.chainError;
+        operations.delete(op.id);
+        endExecutionSpan(ctx, 'failed', {
+          operation: spec.operationId,
+          error_code: reasonCodeForFailure({ code: startErr?.code }),
+        });
+        throw startErr;
+      }
 
       let proc;
       // DF2-FR07: the owned child process IS this run's tool invocation —
@@ -621,8 +654,17 @@ export function createSupervisor(opts = {}) {
           cwd: spec.cwd,
         });
       } catch (err) {
-        await transition(op, 'failed', {
+        // C92-E-02: spawn threw while 'starting' → land terminal. The
+        // target edge is derived from op.state — never from
+        // cancelRequested, which close() sets on ANY non-terminal op:
+        // 'starting → cancelled' is illegal and silently strands the op.
+        // A cancel-claimed op is already 'cancel_pending' (performCancel
+        // and close() both take that edge first) → 'cancelled' is legal;
+        // anything else routes the throw through 'starting → failed'.
+        const to = op.state === 'cancel_pending' ? 'cancelled' : 'failed';
+        await transition(op, to, {
           error: { code: 'spawn_failed', message: String(err?.message ?? err) },
+          ...(to === 'cancelled' ? { reason: op.cancelReason ?? 'killed' } : {}),
         });
         if (telemetry) {
           const code = reasonCodeForFailure({ code: 'spawn_failed', errno: err?.code });
@@ -642,6 +684,7 @@ export function createSupervisor(opts = {}) {
 
       op.proc = proc;
       op.pgid = proc.pid;
+      op.processStartTime = nowMs();
       op.lastOutputAt = nowMs();
 
       // C80-23: attach exit/error listeners BEFORE any other work — a fast-
@@ -669,7 +712,16 @@ export function createSupervisor(opts = {}) {
         }
       }
 
-      await transition(op, 'running', { pid: proc.pid ?? null });
+      // C92-E-01: a cancel that landed before spawn (killGroup saw pgid
+      // null and skipped) must not leave the just-spawned child running —
+      // reap its group now that ownership is proven, and never commit the
+      // 'running' edge (cancel_pending → running is not a legal edge; the
+      // op resolves terminal via exit/backstop as 'cancelled').
+      if (op.cancelRequested) {
+        killGroup(op, SIGKILL);
+      } else {
+        await transition(op, 'running', { pid: proc.pid ?? null });
+      }
       if (!op.exited) scheduleTick(op);
 
       return {
@@ -752,6 +804,10 @@ export function createSupervisor(opts = {}) {
     /**
      * Reap in-flight owned children and drain journals with a bounded wait
      * on the REAL clock — the injected clock may never advance on its own.
+     * Every close-kill claims the op via the legal `cancel_pending` edge
+     * (R4.5 C92-E-02): without it a 'starting'/'running' op would need an
+     * illegal direct `→ cancelled` edge on exit, which `transition`/
+     * `finalizeExit` reject and strand the op non-terminal.
      */
     async close() {
       closed = true;
@@ -760,6 +816,8 @@ export function createSupervisor(opts = {}) {
         op.timers.clear();
         if (!op.exited && !isTerminal(op.state)) {
           op.cancelRequested = true;
+          op.cancelReason ??= 'supervisor_close';
+          transition(op, 'cancel_pending', { reason: op.cancelReason });
           killGroup(op, SIGKILL);
         }
       }

package/src/core/applyPlan.js

@@ -203,8 +203,18 @@ export async function applyDiffResults(diffResults, { backupRoot, projectRoot }
       }
       throw writeError;
     }
+    // W2-C8: the content write already committed (atomic rename / wx create), so a
+    // chmod failure here must NOT abort the install — the same error-tolerance
+    // policy as write-fallback warns. The file exists with correct content at
+    // default mode; skipping the entry would misreport a committed write.
     if (typeof entry.mode === 'number') {
-      await fs.chmod(entry.targetPath, entry.mode);
+      try {
+        await fs.chmod(entry.targetPath, entry.mode);
+      } catch (chmodError) {
+        console.warn(
+          `[UKit] Warning: chmod ${entry.mode.toString(8)} failed for ${entry.targetPath} — ${chmodError?.code ?? chmodError?.message ?? chmodError}. File content was written; adjust permissions manually if needed.`,
+        );
+      }
     }
     writes.push({
       id: entry.id,

package/src/core/codeintel/compiler.js

@@ -11,11 +11,13 @@ import { runDiagnostics } from './diagnostics.js';
 import { findAnalogies } from './analogy.js';
 import { summarizeFile } from './summaries.js';
 import { createEdge } from './providers.js';
+import { resolveProjectPathReal } from '../fileOps.js';
 import { loadRuntimeConfig } from '../runtimeConfig.js';
 
 // Context Compiler v1 (SPEC §5–§8) — the peek→expand→read detail ladder.
 //
-// Pipeline: routeTask (unless mode forced) → guardLevel (L0 freshness guard)
+// Pipeline: routeTask (unless mode forced) → guardLevel (freshness guard —
+// reports the real repair level, repairs nothing itself)
 // → retrieve → budget-fitted evidence selection (lowest-confidence first out,
 // drops recorded in `omitted`) → validatePacket.
 //
@@ -89,8 +91,15 @@ function fitToBudget({ evidence, anchors, relations }, budgetTokens, dropped) {
 }
 
 async function readExcerpt(rootDir, relPath) {
+  // C92-F-03 (+symlink follow-up): containment guard identical to
+  // summaries.js readHead — absolute paths, `..` escapes, and entries that
+  // resolve outside the realpath'd root through a symlink must never reach
+  // fs.readFile. The resolved path is opened so the read hits exactly what
+  // was containment-checked.
+  const abs = await resolveProjectPathReal(rootDir, relPath);
+  if (!abs) return null;
   try {
-    const content = await fs.readFile(path.join(rootDir, relPath), 'utf8');
+    const content = await fs.readFile(abs, 'utf8');
     const lines = content.split('\n').slice(0, EXCERPT_MAX_LINES);
     return lines.join('\n').slice(0, EXCERPT_MAX_CHARS);
   } catch {
@@ -145,10 +154,14 @@ export async function compileContext(projectRoot, task, options = {}) {
   // `read` step of the ladder: L2 excerpts when routed depth >= 2 or --read.
   const wantRead = opts.read === true || routed.depth >= 2;
 
-  // L0 freshness guard — never throws; staleness is reported, not repaired here.
+  // Freshness guard — never throws; staleness is reported, never repaired
+  // here. C92-F-02: maxLevel 'L4' so recommendedLevel is the REAL repair level
+  // (same call-site contract as indexTools.js doctor) — the old 'L0' clamp made
+  // clampLevel rewrite an L4 verdict to 'L0', yielding the impossible
+  // {stale:true, level:'L0'} pair and a "repair level L0" next_action.
   let guard = null;
   try {
-    guard = await guardLevel(rootDir, { maxLevel: 'L0' });
+    guard = await guardLevel(rootDir, { maxLevel: 'L4' });
   } catch {
     guard = null;
   }
@@ -169,7 +182,7 @@ export async function compileContext(projectRoot, task, options = {}) {
     stale,
   };
   if (stale) {
-    packet.next_actions.push(`ukit index refresh — snapshot stale (repair level ${guard?.recommendedLevel ?? 'L2'})`);
+    packet.next_actions.push(`ukit index refresh — snapshot stale (repair level ${guard.recommendedLevel})`);
   }
 
   // `none` mode: valid packet, empty evidence, reason recorded — never fabricate.
@@ -313,16 +326,40 @@ export async function compileContext(projectRoot, task, options = {}) {
     }
   }
 
-  // L2 read lane: attach excerpts to the top candidates only.
+  // Selection bookkeeping: `dropped` collects every packet-visible omission —
+  // read-lane refusals (out-of-tree paths), budget drops, and lane-suppressed
+  // anchors/relations. It lands verbatim in `packet.omitted` below.
+  const dropped = [];
+
+  // L2 read lane: attach excerpts to the top candidates only — reads are
+  // budget-gated so a candidate that cannot survive fitToBudget is never
+  // opened (C92-F-11). `reserved` mirrors the evidence budget: the item's own
+  // token cost when it can be carried bare, plus the excerpt once read. A
+  // dropped candidate's cost does NOT accumulate, matching fit()'s kept-only
+  // accounting. Read bound = (items that fit bare, in order) + one overflow
+  // probe — never the full candidate list.
   if (wantRead && level !== 'L0') {
+    let reserved = 0;
     for (const item of candidates) {
-      if (!item.path) continue;
+      // Defence in depth behind the retriever (C92-F-03): every escaping
+      // path is refused AND accounted for, even when the budget is spent —
+      // post-realpath, so symlinked evidence entries cannot slip through.
+      if (item.path && !(await resolveProjectPathReal(rootDir, item.path))) {
+        dropped.push({ what: item.path, why: 'out-of-tree' });
+        continue;
+      }
+      const bare = estimateTokens(item);
+      if (reserved + bare > requested) continue; // cannot fit even bare — fit drops it
+      if (!item.path) {
+        reserved += bare;
+        continue;
+      }
       const excerpt = await readExcerpt(rootDir, item.path);
       if (excerpt) item.excerpt = excerpt;
+      reserved += estimateTokens(item);
     }
   }
 
-  const dropped = [];
   const expandLanes = level !== 'L0';
   const fitted = fitToBudget(
     {
@@ -341,6 +378,12 @@ export async function compileContext(projectRoot, task, options = {}) {
     }
   }
   if (!expandLanes) {
+    // C92-F-07: peek suppresses BOTH lanes — anchors get the same `omitted`
+    // bookkeeping relations already had, so a peek packet is distinguishable
+    // from "the retriever found no anchors".
+    for (const anchor of result.anchors ?? []) {
+      dropped.push({ what: anchor?.path ?? 'anchor', why: 'budget' });
+    }
     for (const rel of result.relations ?? []) {
       dropped.push({ what: `${rel.from}→${rel.to}`, why: 'budget' });
     }

package/src/core/codeintel/diagnostics.js

@@ -1,15 +1,33 @@
-import { spawnSync } from 'node:child_process';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
 import fs from 'node:fs/promises';
 import path from 'node:path';
+import { resolveProjectPathReal } from '../fileOps.js';
 
 // Post-edit diagnostics (SPEC §7 — CI-206). Cheap checks over dirty paths:
 // `node --check` for .js/.mjs/.cjs, `JSON.parse` for .json. Everything else is
 // skipped silently. Never throws: missing files, spawn failures and timeouts
 // degrade to a `severity:'warning'` entry or are skipped — the caller always
 // gets a (possibly empty) normalized diagnostics list.
+//
+// Dirty-set entries are untrusted input (dirty.json can be tampered with):
+// any entry that escapes the project root ('../x', absolute, or a symlink /
+// symlinked directory resolving outside the realpath'd root) is refused with
+// the resolveProjectPathReal guard, and the refusal is reported
+// {source:'guard'} rather than silently dropped.
+//
+// C92-F-06: `timeoutMs` is a TOTAL deadline for the run, not a per-file budget.
+// Checks run on async execFile (spawnSync blocked the event loop for the whole
+// run, so no caller-side timer could fire). A file whose check loses the
+// deadline race is reported {source:'deadline'}, as is a checkable file the
+// deadline never let start — a silently short run is the same class of bug as
+// the old clamp.
 
 const SYNTAX_EXTENSIONS = new Set(['.js', '.mjs', '.cjs']);
 const MAX_DIAGNOSTICS = 50;
+const TIMED_OUT = Symbol('timed-out');
+
+const execFileAsync = promisify(execFile);
 
 function parseCheckLine(stderr) {
   const lines = String(stderr ?? '')
@@ -27,10 +45,10 @@ function parseCheckLine(stderr) {
   };
 }
 
-async function checkJson(rootDir, relPath) {
+async function checkJson(absPath, relPath) {
   let content;
   try {
-    content = await fs.readFile(path.join(rootDir, relPath), 'utf8');
+    content = await fs.readFile(absPath, 'utf8');
   } catch {
     return null; // missing file → skip
   }
@@ -50,66 +68,139 @@ async function checkJson(rootDir, relPath) {
   }
 }
 
-async function checkSyntax(rootDir, relPath, timeoutMs, spawn) {
-  const absPath = path.join(rootDir, relPath);
+async function checkSyntax(absPath, relPath, timeoutMs, exec) {
   try {
     await fs.access(absPath);
   } catch {
     return null; // missing file → skip
   }
-  let result;
   try {
-    result = spawn(process.execPath, ['--check', absPath], {
+    await exec(process.execPath, ['--check', absPath], {
       timeout: timeoutMs,
       encoding: 'utf8',
       maxBuffer: 1024 * 1024,
     });
+    return null; // exit 0 → clean
   } catch (error) {
-    return { file: relPath, severity: 'warning', message: `spawn failed: ${error?.message ?? error}`, source: 'syntax' };
-  }
-  if (!result || typeof result !== 'object') {
-    return { file: relPath, severity: 'warning', message: 'spawn failed: no result', source: 'syntax' };
-  }
-  const timedOut = result.signal === 'SIGTERM' || result.error?.code === 'ETIMEDOUT';
-  if (timedOut) {
-    return { file: relPath, severity: 'warning', message: `syntax check timed out after ${timeoutMs}ms`, source: 'syntax' };
-  }
-  if (result.error) {
-    return { file: relPath, severity: 'warning', message: `spawn failed: ${result.error.message}`, source: 'syntax' };
+    if (!error || typeof error !== 'object') {
+      return { file: relPath, severity: 'warning', message: 'spawn failed: no result', source: 'syntax' };
+    }
+    // maxBuffer overflow is a spawn failure, not a timeout — execFile kills
+    // with SIGTERM for both, so check the buffer code first.
+    const hitBuffer = error.code === 'ERR_CHILD_PROCESS_STDIO_MAXBUFFER' || error.code === 'ENOBUFS';
+    const timedOut = !hitBuffer && (error.killed === true || error.signal === 'SIGTERM' || error.code === 'ETIMEDOUT');
+    if (timedOut) {
+      return { file: relPath, severity: 'warning', message: `syntax check timed out after ${timeoutMs}ms`, source: 'syntax' };
+    }
+    if (typeof error.code !== 'number') {
+      // spawn failure (ENOENT, EACCES, …) — no syntax verdict.
+      return { file: relPath, severity: 'warning', message: `spawn failed: ${error.message ?? String(error)}`, source: 'syntax' };
+    }
+    const { message, line } = parseCheckLine(error.stderr || error.stdout);
+    const diag = { file: relPath, severity: 'error', message, source: 'syntax' };
+    if (line !== null) diag.line = line;
+    return diag;
   }
-  if (result.status === 0) return null;
-  const { message, line } = parseCheckLine(result.stderr || result.stdout);
-  const diag = { file: relPath, severity: 'error', message, source: 'syntax' };
-  if (line !== null) diag.line = line;
-  return diag;
+}
+
+function delay(ms) {
+  return new Promise((resolve) => {
+    const t = setTimeout(resolve, ms);
+    // Never pin the process if the race resolves first.
+    t.unref?.();
+  });
+}
+
+function checkable(relPath) {
+  const ext = path.posix.extname(relPath.replace(/\\/g, '/')).toLowerCase();
+  return ext === '.json' || SYNTAX_EXTENSIONS.has(ext) ? ext : null;
 }
 
 /**
- * runDiagnostics(projectRoot, relPaths, { timeoutMs?, maxFiles? })
- *   → [{ file, severity:'error'|'warning', message, line?, source:'syntax'|'json' }]
+ * runDiagnostics(projectRoot, relPaths, { timeoutMs?, maxFiles?, _exec? })
+ *   → [{ file, severity:'error'|'warning', message, line?,
+ *        source:'syntax'|'json'|'deadline'|'guard' }]
  *
- * Deterministic order (input order preserved); capped at `maxFiles` inputs and
- * MAX_DIAGNOSTICS total entries. `_spawn` is a test seam for timeout injection.
+ * `timeoutMs` bounds the WHOLE run as a total deadline (C92-F-06), never
+ * per-file — worst case is timeoutMs plus one in-flight check, not
+ * maxFiles × timeoutMs. Files the deadline never let start are reported
+ * {source:'deadline'} so a truncated run is visible, and a check that loses
+ * its deadline race reports the same. Deterministic order (input order
+ * preserved); capped at `maxFiles` inputs and MAX_DIAGNOSTICS entries.
+ * `_exec` is a test seam: promisified execFile shape — (file, args, opts) →
+ * Promise<{stdout, stderr}> — and must honor opts.timeout.
  */
 export async function runDiagnostics(projectRoot, relPaths, {
   timeoutMs = 8000,
   maxFiles = 50,
-  _spawn = spawnSync,
+  _exec = execFileAsync,
 } = {}) {
   const rootDir = path.resolve(projectRoot ?? process.cwd());
   const diagnostics = [];
   const inputs = (Array.isArray(relPaths) ? relPaths : [])
     .filter((p) => typeof p === 'string' && p.length > 0)
     .slice(0, Math.max(0, maxFiles));
+  const deadline = Date.now() + Math.max(0, timeoutMs);
 
   for (const relPath of inputs) {
     if (diagnostics.length >= MAX_DIAGNOSTICS) break;
-    const ext = path.posix.extname(relPath.replace(/\\/g, '/')).toLowerCase();
-    let diag = null;
+    const ext = checkable(relPath);
+    if (!ext) continue; // unchecked extensions stay silent — no entry at all
+    // Resolve containment post-realpath: a dirty entry that is a symlink (or
+    // resolves through a symlinked directory) to outside content passes the
+    // lexical check yet reads out-of-tree bytes — refuse it here.
+    const resolved = await resolveProjectPathReal(rootDir, relPath);
+    if (!resolved) {
+      // Tampered dirty.json entry ('../x.json', '/abs', symlink escape) —
+      // never read outside the project root, and report the refusal so a
+      // hostile/dirty entry is visible rather than silently dropped.
+      diagnostics.push({
+        file: relPath,
+        severity: 'warning',
+        message: 'refused: path escapes project root',
+        source: 'guard',
+      });
+      continue;
+    }
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) {
+      diagnostics.push({
+        file: relPath,
+        severity: 'warning',
+        message: 'skipped: total diagnostics budget exhausted',
+        source: 'deadline',
+      });
+      continue;
+    }
+    let check;
     if (ext === '.json') {
-      diag = await checkJson(rootDir, relPath);
-    } else if (SYNTAX_EXTENSIONS.has(ext)) {
-      diag = await checkSyntax(rootDir, relPath, timeoutMs, _spawn);
+      check = checkJson(resolved, relPath);
+    } else {
+      // The slice of the total budget left for this file — the last file in
+      // a nearly-spent budget cannot overrun the deadline on its own.
+      check = checkSyntax(resolved, relPath, remaining, _exec);
+    }
+    check.catch(() => {}); // late rejection after a lost race must never be unhandled
+    let diag;
+    try {
+      diag = await Promise.race([check, delay(remaining).then(() => TIMED_OUT)]);
+    } catch (error) {
+      // Contract: never throws — an internal check failure degrades to a
+      // warning entry rather than propagating.
+      diag = {
+        file: relPath,
+        severity: 'warning',
+        message: `check failed: ${error?.message ?? String(error)}`,
+        source: ext === '.json' ? 'json' : 'syntax',
+      };
+    }
+    if (diag === TIMED_OUT) {
+      diag = {
+        file: relPath,
+        severity: 'warning',
+        message: 'check cut off at total diagnostics deadline',
+        source: 'deadline',
+      };
     }
     if (diag) diagnostics.push(diag);
   }

package/src/core/codeintel/freshness.js

@@ -6,7 +6,10 @@ import { getIndexDir, INDEX_ARTIFACTS, INDEX_SCHEMA_VERSION } from '../../index/
 import { loadRuntimeConfig } from '../runtimeConfig.js';
 
 const GIT_TIMEOUT_MS = 3000;
-const NON_GIT_MANIFEST_CAP = 2000;
+// In-flight fs.stat bound for the non-git manifest overlay: coverage is the
+// whole manifest (every indexed path contributes to identity), but stat calls
+// run in bounded batches so in-flight I/O never scales with tree size.
+const MANIFEST_STAT_BATCH = 64;
 const LEVELS = ['L0', 'L1', 'L2', 'L3', 'L4'];
 const SNAPSHOT_FILE = 'freshness.json';
 const DIRTY_FILE = 'dirty.json';
@@ -113,9 +116,13 @@ async function overlayEntriesGit(rootDir, statusOutput, extraPaths = []) {
   return entries;
 }
 
-// Non-git fallback: hash LIVE mtimes for index-covered files (files.json),
-// capped at NON_GIT_MANIFEST_CAP entries. Stored mtimeMs from files.json is
-// stale by definition — only live fs.stat detects post-index edits.
+// Non-git fallback: hash LIVE mtimes for every index-covered path in
+// files.json. Stored mtimeMs from files.json is stale by definition — only a
+// live fs.stat detects post-index edits, and there is no cheaper signal
+// (directory mtimes do not propagate on content writes), so coverage cannot
+// be capped without losing tail edits. Work is bounded by the manifest itself
+// — an index-built artifact — and stat batches are capped at
+// MANIFEST_STAT_BATCH in-flight calls.
 // Incremental mode: only when dirty-set tracking is active (dirty.json exists,
 // not saturated) AND a prior snapshot carries overlayEntries — reuse stored
 // entries for paths proven unchanged by the dirty set; live-stat dirty,
@@ -131,7 +138,7 @@ async function overlayEntriesManifest(rootDir, { incremental, snapshot, dirty }
   }
   const manifestPaths = [];
   const seen = new Set();
-  for (const item of items.slice(0, NON_GIT_MANIFEST_CAP)) {
+  for (const item of items) {
     const rel = typeof item?.filePath === 'string' ? item.filePath : null;
     if (!rel || seen.has(rel)) continue;
     seen.add(rel);
@@ -145,14 +152,20 @@ async function overlayEntriesManifest(rootDir, { incremental, snapshot, dirty }
   const canReuse = incremental === true && stored !== null && dirtyPaths !== null;
 
   const entries = {};
-  for (const rel of manifestPaths) {
-    // Reuse only when dirty tracking proves the path unchanged and a stored
-    // entry exists; otherwise stat live (never trust files.json mtimeMs).
-    if (canReuse && !dirtyPaths.has(rel) && typeof stored[rel] === 'string') {
-      entries[rel] = stored[rel];
-      continue;
+  // Bounded-batch live stat: every manifest path contributes to the hash.
+  for (let i = 0; i < manifestPaths.length; i += MANIFEST_STAT_BATCH) {
+    const batch = manifestPaths.slice(i, i + MANIFEST_STAT_BATCH);
+    const values = await Promise.all(batch.map(async (rel) => {
+      // Reuse only when dirty tracking proves the path unchanged and a stored
+      // entry exists; otherwise stat live (never trust files.json mtimeMs).
+      if (canReuse && !dirtyPaths.has(rel) && typeof stored[rel] === 'string') {
+        return stored[rel];
+      }
+      return statEntry(rootDir, rel);
+    }));
+    for (let j = 0; j < batch.length; j += 1) {
+      entries[batch[j]] = values[j];
     }
-    entries[rel] = await statEntry(rootDir, rel);
   }
   // Dirty paths outside the manifest still affect identity (stat live);
   // index-internal artifacts are skipped.

package/src/core/codeintel/invalidation.js

@@ -94,7 +94,10 @@ export async function notifyEdit(projectRoot, relPaths) {
     const current = await readDirtyData(projectRoot);
     const merged = new Set(current.paths);
     for (const p of incoming) merged.add(p);
-    const saturated = merged.size > DIRTY_MAX_PATHS;
+    // `saturated` is latched: the truncated tail was already discarded, so a
+    // merge that lands back under DIRTY_MAX_PATHS is still incomplete. The
+    // marker clears only when a full rebuild rewrites the record.
+    const saturated = current.saturated || merged.size > DIRTY_MAX_PATHS;
     const paths = [...merged].sort().slice(0, DIRTY_MAX_PATHS);
     await writeDirtyData(projectRoot, paths, saturated);
     return paths;
@@ -141,14 +144,19 @@ export async function readDirty(projectRoot) {
 /**
  * Return the accumulated dirty set and clear the file (index-refresh lane).
  * `saturated` is surfaced so callers can treat a saturated set as full
- * invalidation — a saturated drain with few/no paths is NOT a clean state.
+ * invalidation — a saturated drain with few/no paths is NOT a clean state,
+ * and the marker stays latched on disk until a full rebuild clears it.
  * @returns {Promise<{ paths: string[], saturated: boolean }>}
  */
 export async function drainDirty(projectRoot) {
   const { paths, saturated } = await readDirtyData(projectRoot);
   if (paths.length === 0 && !saturated) return { paths: [], saturated: false };
   try {
-    await writeDirtyData(projectRoot, [], false);
+    // Preserve the saturated marker on disk: the consumer (`readDirtySet` in
+    // freshness.js) must keep seeing "this set is incomplete" — laundered to
+    // saturated:false it would justify reusing entries for dropped paths. Only
+    // a full rebuild rewrites the record as clean.
+    await writeDirtyData(projectRoot, [], saturated);
   } catch {
     // never throw — drained set is still returned
   }