@retaw106/mmc-oc 2.2.1 → 2.4.0

package/src/shared/sqlite.ts

@@ -39,7 +39,7 @@
  * `run()` → {changes,lastInsertRowid}) is identical and was verified directly.
  */
 
-import { AsyncLocalStorage } from "node:async_hooks";
+import { AsyncLocalStorage, AsyncResource } from "node:async_hooks";
 import { statSync } from "node:fs";
 // Type import only — runtime is loaded dynamically below. @types/better-sqlite3
 // has the richest definitions and is a structural superset of the API surface
@@ -47,6 +47,16 @@ import { statSync } from "node:fs";
 // node:sqlite at runtime (both expose prepare/run/get/all/exec/close).
 import type BetterSqlite3 from "better-sqlite3";
 
+// Capture the root before creating request-local AsyncLocalStorage scopes.
+// Shared workers and timers must not inherit callbacks that reject stale
+// database writes: those callbacks can retain an obsolete request's inputs.
+const resourceRoot = new AsyncResource("magic-context:root");
+
+/** Create host-owned resources without inheriting request-local state. */
+export function inRootAsyncContext<T>(operation: () => T): T {
+    return resourceRoot.runInAsyncScope(operation);
+}
+
 /**
  * Slow-write reporting is injected rather than imported: this module is also
  * executed directly by Node (the `node:sqlite` smoke in CI, Pi, Desktop), and
@@ -71,14 +81,21 @@ export function registerSlowWriteReporter(reporter: SlowWriteReporter): void {
  */
 type SqliteDiagnosticSink = (message: string) => void;
 let sqliteDiagnosticSink: SqliteDiagnosticSink | undefined;
+let sqliteDiagnosticHost: () => string = () => "unknown";
 
-export function registerSqliteDiagnosticSink(sink: SqliteDiagnosticSink): void {
+export function registerSqliteDiagnosticSink(
+    sink: SqliteDiagnosticSink,
+    host?: () => string,
+): void {
     sqliteDiagnosticSink = sink;
+    if (host) sqliteDiagnosticHost = host;
 }
 
 function reportSqliteDiagnostic(message: string): void {
     try {
-        sqliteDiagnosticSink?.(`[magic-context] ${message}`);
+        sqliteDiagnosticSink?.(
+            `[magic-context] ${message} pid=${process.pid} host=${sqliteDiagnosticHost()}`,
+        );
     } catch {
         // Diagnostics must never change the outcome of the write they describe.
     }
@@ -169,13 +186,51 @@ export class SqliteRuntimeUnavailableError extends Error {
     }
 }
 
+// Node requests this warning during node:sqlite's module evaluation, although
+// warning delivery happens later. Intercept only the request while importing;
+// replacing warning listeners would not suppress the default stderr output.
+function isNodeSqliteExperimentalWarning(args: unknown[]): boolean {
+    const [warning, options] = args;
+    const message = warning instanceof Error ? warning.message : warning;
+    const type =
+        typeof options === "string"
+            ? options
+            : options && typeof options === "object"
+              ? (options as { type?: unknown }).type
+              : undefined;
+    return (
+        type === "ExperimentalWarning" &&
+        typeof message === "string" &&
+        message.startsWith("SQLite is an experimental feature")
+    );
+}
+
+async function importSqliteModuleForRuntime(
+    runtime: SqliteRuntime,
+    specifier: string,
+    importer: (specifier: string) => Promise<SqliteModule>,
+): Promise<SqliteModule> {
+    if (runtime !== "Node.js") return importer(specifier);
+
+    const originalEmitWarning = process.emitWarning;
+    process.emitWarning = function (this: unknown, ...args: unknown[]): void {
+        if (isNodeSqliteExperimentalWarning(args)) return;
+        Reflect.apply(originalEmitWarning, this, args);
+    } as typeof process.emitWarning;
+    try {
+        return await importer(specifier);
+    } finally {
+        process.emitWarning = originalEmitWarning;
+    }
+}
+
 export async function loadSqliteModule(
     runtime: SqliteRuntime = detectSqliteRuntime(),
     importer: (specifier: string) => Promise<SqliteModule> = importSqliteModule,
 ): Promise<SqliteModule> {
     const specifier = runtime === "Bun" ? bunSpec : nodeSpec;
     try {
-        return await importer(specifier);
+        return await importSqliteModuleForRuntime(runtime, specifier, importer);
     } catch (error) {
         if (isModuleNotFoundError(error, specifier)) {
             throw new SqliteRuntimeUnavailableError(runtime, specifier, error);
@@ -234,6 +289,110 @@ export interface SqliteMemoryStats {
 const trackedSqliteConnections = new Map<number, TrackedSqliteConnection>();
 let nextSqliteConnectionSequence = 1;
 
+/**
+ * Columns of Magic Context's `tags` table (context.db) that never decide which
+ * message a tag belongs to, its number, its type, or its reasoning token estimate.
+ */
+const TAG_COLUMNS_OUTSIDE_IDENTITY = new Set([
+    "status",
+    "drop_mode",
+    "byte_size",
+    "input_byte_size",
+    "reasoning_byte_size",
+    "token_count",
+    "input_token_count",
+    "caveman_depth",
+    "entry_fingerprint",
+    "tool_name",
+    "harness",
+]);
+
+let tagIdentityWriteGeneration = 0;
+
+/**
+ * Whether a write statement may change an existing `tags` row's identity
+ * (session, number, type, owner message, reasoning token count) or remove a
+ * row. Plain appends without an explicit `id`, and updates that assign only
+ * columns in {@link TAG_COLUMNS_OUTSIDE_IDENTITY}, cannot; everything else that
+ * names the table is treated as if it could, including DDL and multi-statement
+ * scripts. Erring towards true only costs a cache rebuild.
+ */
+export function mayChangeTagIdentity(sql: string): boolean {
+    if (!/\btags\b/i.test(sql) || /^\s*(?:SELECT|EXPLAIN|PRAGMA)\b/i.test(sql)) return false;
+    if (/^\s*WITH\b/i.test(sql) && !/\b(?:INSERT|UPDATE|DELETE|REPLACE)\b/i.test(sql)) return false;
+    // One statement only: a script can hide a DELETE behind a harmless first statement.
+    if (/;\s*\S/.test(sql) || /\bREPLACE\b/i.test(sql) || /\bON\s+CONFLICT\b/i.test(sql))
+        return true;
+    const insert = /^\s*INSERT\s+INTO\s+(?:main\.)?["`]?tags["`]?\s*\(([^)]*)\)/i.exec(sql);
+    if (insert) {
+        const columns = (insert[1] ?? "").split(",").map((column) =>
+            column
+                .trim()
+                .replace(/["`[\]]/g, "")
+                .toLowerCase(),
+        );
+        return columns.includes("id") || columns.includes("rowid");
+    }
+    const update = /^\s*UPDATE\s+(?:main\.)?["`]?tags["`]?\s+SET\s+([\s\S]*?)\bWHERE\b/i.exec(sql);
+    if (update && !/\bSELECT\b/i.test(sql)) {
+        // Provably identity-free only when every top-level assignment is a plain
+        // `column = ...` naming an allowed column. A tuple assignment such as
+        // `(tag_number, reasoning_token_count) = (...)`, or anything this cannot
+        // read, counts as an identity write.
+        const assignments = topLevelCommaSegments(update[1] ?? "");
+        if (!assignments) return true;
+        return !assignments.every((assignment) => {
+            const column = /^\s*["`]?(\w+)["`]?\s*=(?!=)/.exec(assignment)?.[1];
+            return column !== undefined && TAG_COLUMNS_OUTSIDE_IDENTITY.has(column.toLowerCase());
+        });
+    }
+    return true;
+}
+
+/**
+ * Split SQL text at commas outside parentheses and quotes. Returns null when
+ * the parentheses or quotes do not balance.
+ */
+function topLevelCommaSegments(text: string): string[] | null {
+    const segments: string[] = [];
+    let depth = 0;
+    let quote: string | null = null;
+    let start = 0;
+    for (let index = 0; index < text.length; index += 1) {
+        const char = text[index];
+        if (quote) {
+            // A doubled quote inside a quoted run is an escaped quote.
+            if (char === quote) {
+                if (text[index + 1] === quote) index += 1;
+                else quote = null;
+            }
+            continue;
+        }
+        if (char === "'" || char === '"' || char === "`") quote = char;
+        else if (char === "(") depth += 1;
+        else if (char === ")") {
+            depth -= 1;
+            if (depth < 0) return null;
+        } else if (char === "," && depth === 0) {
+            segments.push(text.slice(start, index));
+            start = index + 1;
+        }
+    }
+    if (quote || depth !== 0) return null;
+    segments.push(text.slice(start));
+    return segments;
+}
+
+/**
+ * Counts executions, on any connection this process opened, of statements for
+ * which {@link mayChangeTagIdentity} is true. A cache built from `tags` stays
+ * valid for this process's own writes while the count is unchanged; commits by
+ * other connections show up in `PRAGMA data_version` instead.
+ */
+export function getTagIdentityWriteGeneration(): number {
+    return tagIdentityWriteGeneration;
+}
+
 /** Route native Bun and Node transaction entry through the same acquisition retry.
  * Native Bun transaction wrappers execute BEGIN internally, bypassing an exec override,
  * so both runtimes use this small synchronous wrapper instead. Writable handles
@@ -250,15 +409,33 @@ function installTransactionRouting(db: BetterSqlite3.Database, readonly: boolean
                 // A transaction that ended without passing through exec (for
                 // example an automatic rollback) must not be timed as this one.
                 openWriterTransactions.delete(db);
-                if (transformPassScope.getStore()?.active || backgroundWriterScope.getStore())
+                if (transformPassScope.getStore()?.active || backgroundWriterScope.getStore()) {
                     acquireShort(db, () => nativeExec(sql), sql.trim());
-                else nativeExec(sql);
+                } else {
+                    nativeExec(sql);
+                    openWriterTransactions.set(db, {
+                        site: sql.trim(),
+                        lane: "background",
+                        acquireMs: 0,
+                        attempts: 1,
+                        acquiredAt: performance.now(),
+                    });
+                }
                 return db;
             }
             if (WRITER_TRANSACTION_END.test(sql) && openWriterTransactions.has(db))
                 return endWriterTransaction(db, () => nativeExec(sql), sql);
-            if (!/^\s*(?:SELECT|EXPLAIN|PRAGMA|COMMIT|END|ROLLBACK|SAVEPOINT|RELEASE)\b/i.test(sql))
-                return withAutocommitTimeout(db, () => nativeExec(sql));
+            if (
+                !/^\s*(?:SELECT|EXPLAIN|PRAGMA|COMMIT|END|ROLLBACK|SAVEPOINT|RELEASE)\b/i.test(sql)
+            ) {
+                try {
+                    // exec can commit a script prefix before BUSY. Run it once;
+                    // only prepared statements are safe to probe and retry.
+                    return withAutocommitTimeout(db, () => nativeExec(sql), false);
+                } finally {
+                    if (mayChangeTagIdentity(sql)) tagIdentityWriteGeneration += 1;
+                }
+            }
             return nativeExec(sql);
         },
     });
@@ -271,15 +448,22 @@ function installTransactionRouting(db: BetterSqlite3.Database, readonly: boolean
             // SELECT/EXPLAIN cannot acquire a writer. Treat CTEs conservatively:
             // WITH can introduce INSERT/UPDATE/DELETE as well as a read query.
             if (!readonly && !/^\s*(?:SELECT|EXPLAIN|PRAGMA)\b/i.test(sql)) {
+                const changesTagIdentity = mayChangeTagIdentity(sql);
                 for (const method of ["run", "get", "all"] as const) {
                     const execute = statement[method].bind(statement);
                     Object.defineProperty(statement, method, {
                         configurable: true,
                         // biome-ignore lint/suspicious/noExplicitAny: retain SQLite's native binding overloads.
-                        value: (...args: any[]) =>
-                            withAutocommitTimeout(db, () => execute(...args)),
+                        value: (...args: any[]) => {
+                            try {
+                                return withAutocommitTimeout(db, () => execute(...args));
+                            } finally {
+                                if (changesTagIdentity) tagIdentityWriteGeneration += 1;
+                            }
+                        },
                     });
                 }
+                if (changesTagIdentity) wrapRemainingTagWriteForms(statement);
             }
             return statement;
         },
@@ -330,6 +514,43 @@ function installTransactionRouting(db: BetterSqlite3.Database, readonly: boolean
     });
 }
 
+/**
+ * Count tag identity writes made through the statement forms the transaction
+ * routing does not wrap. `iterate()` runs the statement while its result is
+ * consumed, so the generation moves both when iteration starts and when it
+ * ends: a summary read in between is then rebuilt on its next read.
+ */
+// biome-ignore lint/suspicious/noExplicitAny: statements from both backends share these method names.
+function wrapRemainingTagWriteForms(statement: any): void {
+    if (typeof statement.iterate === "function") {
+        const iterate = statement.iterate.bind(statement);
+        Object.defineProperty(statement, "iterate", {
+            configurable: true,
+            value: function* (...args: unknown[]) {
+                tagIdentityWriteGeneration += 1;
+                try {
+                    yield* iterate(...args);
+                } finally {
+                    tagIdentityWriteGeneration += 1;
+                }
+            },
+        });
+    }
+    if (typeof statement.values === "function") {
+        const values = statement.values.bind(statement);
+        Object.defineProperty(statement, "values", {
+            configurable: true,
+            value: (...args: unknown[]) => {
+                try {
+                    return values(...args);
+                } finally {
+                    tagIdentityWriteGeneration += 1;
+                }
+            },
+        });
+    }
+}
+
 function trackSqliteConnection(
     db: BetterSqlite3.Database,
     filename: unknown,
@@ -377,7 +598,9 @@ function trackSqliteConnection(
 
 const TrackedDatabase = new Proxy(DatabaseImpl, {
     construct(target, args) {
-        const db = Reflect.construct(target, args, target) as BetterSqlite3.Database;
+        const db = inRootAsyncContext(
+            () => Reflect.construct(target, args, target) as BetterSqlite3.Database,
+        );
         return trackSqliteConnection(db, args[0], args[1]);
     },
 }) as typeof BetterSqlite3;
@@ -431,6 +654,23 @@ function buildNodeSqliteDatabaseClass(DatabaseSync: any): typeof BetterSqlite3 {
 
 export const Database: typeof BetterSqlite3 = TrackedDatabase;
 
+/** The constructor path, without querying SQLite on the prompt thread. */
+export function getSqliteDatabasePath(db: Database): string | null {
+    for (const connection of trackedSqliteConnections.values()) {
+        if (connection.reference.deref() === db) {
+            return connection.filename === ":memory:" || connection.filename === "<buffer>"
+                ? null
+                : connection.filename;
+        }
+    }
+    // Native Bun/better-sqlite3 handles can reach readers without our constructor
+    // wrapper. Their filename is still available without a SQLite query.
+    const native = db as unknown as { filename?: unknown; name?: unknown };
+    const path = native.filename ?? native.name;
+    if (typeof path === "string" && path !== ":memory:" && path !== "") return path;
+    return null;
+}
+
 function pragmaValue(db: BetterSqlite3.Database, name: string): unknown {
     const row = db.prepare(`PRAGMA ${name}`).get() as Record<string, unknown> | undefined;
     if (!row) return undefined;
@@ -665,22 +905,31 @@ export function withSqliteBackgroundWriter<T>(operation: () => T): T {
 export function withSqliteTransformPass<T>(operation: () => T): T {
     const existing = transformPassScope.getStore();
     if (existing?.active) return operation();
-    const lease = { active: true, remainingWaitMs: FOREGROUND_IN_PASS_BUSY_TIMEOUT_MS };
-    return transformPassScope.run(lease, () => {
-        try {
-            const result = operation();
-            if (result && typeof (result as { then?: unknown }).then === "function") {
-                return Promise.resolve(result).finally(() => {
-                    lease.active = false;
-                }) as T;
+    const reservation = reserveForegroundSqliteTurn();
+    const run = (release: () => void): T => {
+        const lease = { active: true, remainingWaitMs: FOREGROUND_IN_PASS_BUSY_TIMEOUT_MS };
+        return transformPassScope.run(lease, () => {
+            try {
+                const result = operation();
+                if (result && typeof (result as { then?: unknown }).then === "function") {
+                    return Promise.resolve(result).finally(() => {
+                        lease.active = false;
+                        release();
+                    }) as T;
+                }
+                lease.active = false;
+                release();
+                return result;
+            } catch (error) {
+                lease.active = false;
+                release();
+                throw error;
             }
-            lease.active = false;
-            return result;
-        } catch (error) {
-            lease.active = false;
-            throw error;
-        }
-    });
+        });
+    };
+    // Foreground callers racing maintenance are awaited transforms. Idle
+    // synchronous callers keep the existing immediate return/throw behavior.
+    return typeof reservation === "function" ? run(reservation) : (reservation.then(run) as T);
 }
 
 /** Start detached maintenance work without borrowing a foreground pass's budget. */
@@ -720,10 +969,10 @@ export class SqliteAcquisitionBusyError extends Error {
 }
 
 const SHORT_BUSY_TIMEOUT_MS = 25;
-const FOREGROUND_IN_PASS_BUSY_TIMEOUT_MS = 250;
+const FOREGROUND_IN_PASS_BUSY_TIMEOUT_MS = 2_000;
 const FOREGROUND_ACQUISITION_BUDGET_MS = 16_500;
 /** Waiting this long for the writer lock, or holding it this long, is logged. */
-const SLOW_WRITER_LOG_MS = 250;
+const SLOW_WRITER_LOG_MS = 100;
 const WRITER_TRANSACTION_END = /^\s*(?:COMMIT|END|ROLLBACK)(?:\s+TRANSACTION)?\s*;?\s*$/i;
 
 type WriterLane = "foreground" | "background";
@@ -764,32 +1013,67 @@ function foregroundWaitLease() {
         : undefined;
 }
 
-/** Bound implicit writer admission too, including prepared INSERT OR IGNORE and
- * writes with RETURNING. Charge successful execution time conservatively: the
- * native API cannot separate lock waiting from statement execution. Exhaustion
- * switches to zero-wait acquisition, not a refusal when the writer is free. */
-function withAutocommitTimeout<T>(db: Database, operation: () => T): T {
+/** Probe a prepared statement's writer lock without charging uncontended work
+ * against the foreground lock-wait budget. An exec script may commit some of
+ * its statements before failing, so it cannot be retried without duplicating
+ * writes; conservatively charge its single attempt's full execution time. */
+function withAutocommitTimeout<T>(db: Database, operation: () => T, singleStatement = true): T {
     assertTransformWrite();
     const lease = foregroundWaitLease();
-    if (isInTransaction(db) || (!lease && !backgroundWriterScope.getStore())) return operation();
-    const previous = pragmaNumber(db, "busy_timeout");
-    db.exec(
-        `PRAGMA busy_timeout=${lease ? Math.floor(lease.remainingWaitMs) : SHORT_BUSY_TIMEOUT_MS}`,
-    );
+    if (isInTransaction(db)) return operation();
+    const scoped = lease || backgroundWriterScope.getStore();
+    const previous = scoped ? pragmaNumber(db, "busy_timeout") : null;
     const started = performance.now();
+    let completed = false;
+    const execute = () => {
+        const result = operation();
+        completed = true;
+        return result;
+    };
     try {
-        return operation();
+        if (!scoped) return execute();
+        if (singleStatement) {
+            db.exec("PRAGMA busy_timeout=0");
+            try {
+                return execute();
+            } catch (error) {
+                if (!isTransientSqliteError(error) || isInTransaction(db)) throw error;
+            }
+            assertTransformWrite();
+        }
+        const timeout = Math.floor(
+            Math.min(
+                lease?.remainingWaitMs ?? SHORT_BUSY_TIMEOUT_MS,
+                lease?.guard?.remainingMs() ?? Infinity,
+            ),
+        );
+        db.exec(`PRAGMA busy_timeout=${timeout}`);
+        const waitStarted = performance.now();
+        try {
+            return execute();
+        } finally {
+            // Deduct the prepared statement's contended retry or the exec
+            // script's execution from the remaining foreground wait budget;
+            // the native API cannot separate lock waiting from execution.
+            if (lease)
+                lease.remainingWaitMs = Math.max(
+                    0,
+                    lease.remainingWaitMs - (performance.now() - waitStarted),
+                );
+        }
     } catch (error) {
         if (lease && isTransientSqliteError(error))
             throw new SqliteAcquisitionBusyError(error, "autocommit");
         throw error;
     } finally {
-        if (lease)
-            lease.remainingWaitMs = Math.max(
-                0,
-                lease.remainingWaitMs - (performance.now() - started),
-            );
+        const elapsed = performance.now() - started;
         if (previous !== null) db.exec(`PRAGMA busy_timeout=${previous}`);
+        // Native autocommit does not expose the instant its lock was acquired.
+        // Label the upper bound so a waiting statement is not blamed as a holder.
+        if (elapsed >= SLOW_WRITER_LOG_MS)
+            reportSqliteDiagnostic(
+                `sqlite writer site=autocommit lane=${lease ? "foreground" : "background"} elapsed_ms=${Math.round(elapsed)} timing=statement_including_acquisition outcome=${completed ? "completed" : "failed"} caller=${writerCaller()}`,
+            );
     }
 }
 
@@ -851,7 +1135,9 @@ function acquireShort(db: Database, acquire: () => unknown, site: string): void
  * `acquireShort`, then report how long the writer waited for the lock
  * (`acquire_ms`) and how long it then held it (`hold_ms`) when either crosses
  * the threshold. A long hold blocks every other process's writer, so it is
- * worth seeing even when the lock itself came quickly.
+ * worth seeing even when the lock itself came quickly. This interval includes
+ * COMMIT: an automatic PASSIVE checkpoint can run after writer-lock release,
+ * so hold_ms is a conservative upper bound, not proof of continuous ownership.
  */
 function endWriterTransaction(db: Database, end: () => unknown, sql: string): unknown {
     let ended = false;
@@ -872,13 +1158,32 @@ function endWriterTransaction(db: Database, end: () => unknown, sql: string): un
                       ? "committed"
                       : "failed";
                 reportSqliteDiagnostic(
-                    `sqlite writer site=${open.site} lane=${open.lane} acquire_ms=${Math.round(open.acquireMs)} hold_ms=${Math.round(holdMs)} attempts=${open.attempts} outcome=${outcome}`,
+                    `sqlite writer site=${open.site} lane=${open.lane} acquire_ms=${Math.round(open.acquireMs)} hold_ms=${Math.round(holdMs)} attempts=${open.attempts} outcome=${outcome} timing=through_commit_upper_bound caller=${writerCaller()}`,
                 );
             }
         }
     }
 }
 
+// Capture a stack only for slow writes. Synchronous COMMIT retains the writer's
+// caller, so fast transactions need neither stack allocation nor source mapping.
+function writerCaller(): string {
+    return (
+        new Error().stack
+            ?.split("\n")
+            .find(
+                (line) =>
+                    line.includes(" at ") &&
+                    !/[/\\]sqlite\.[tj]s[:)]/.test(line) &&
+                    !/\b(?:writerCaller|endWriterTransaction|withAutocommitTimeout|value)\b/.test(
+                        line,
+                    ),
+            )
+            ?.trim()
+            .replace(/\s+/g, "_") ?? "unknown"
+    );
+}
+
 /** Begin an immediate transaction with bounded asynchronous retries on writer contention.
  * Callers must recheck any lease or source snapshot after this function returns.
  * Resolves with the `performance.now()` time at which BEGIN IMMEDIATE succeeded,
@@ -1071,3 +1376,80 @@ export function withPrivilegedWriter<T>(db: Database, operation: () => T): T {
         throw error;
     }
 }
+
+// Process-local admission only; SQLite remains the cross-process writer arbiter.
+const indexCoordinationKey = Symbol.for("magic-context.index-foreground-coordination.v1");
+const indexCoordinationHeap = globalThis as unknown as Record<
+    symbol,
+    SharedArrayBuffer | undefined
+>;
+const indexCoordinationBuffer =
+    indexCoordinationHeap[indexCoordinationKey] ??
+    new SharedArrayBuffer(3 * Int32Array.BYTES_PER_ELEMENT);
+indexCoordinationHeap[indexCoordinationKey] = indexCoordinationBuffer;
+const indexCoordinationState = new Int32Array(indexCoordinationBuffer);
+// Slots: foreground interest, current maintenance owner, next owner token.
+
+export function indexCoordinationInput(): {
+    indexCoordination: SharedArrayBuffer;
+    indexOwner: number;
+} {
+    return {
+        indexCoordination: indexCoordinationBuffer,
+        indexOwner: Atomics.add(indexCoordinationState, 2, 1) + 1,
+    };
+}
+
+const yieldIndexTurn = () => new Promise<void>((resolve) => setTimeout(resolve, 1));
+
+/** Announce interest before waiting, so no maintenance chunk overtakes a foreground turn. */
+function reserveForegroundSqliteTurn(): (() => void) | Promise<() => void> {
+    Atomics.add(indexCoordinationState, 0, 1);
+    const release = () => {
+        Atomics.sub(indexCoordinationState, 0, 1);
+        Atomics.notify(indexCoordinationState, 0);
+    };
+    if (Atomics.load(indexCoordinationState, 1) === 0) return release;
+    return (async () => {
+        while (Atomics.load(indexCoordinationState, 1) !== 0) await yieldIndexTurn();
+        return release;
+    })();
+}
+
+export function releaseIndexOwner(input: {
+    indexCoordination?: SharedArrayBuffer;
+    indexOwner?: number;
+}): void {
+    if (!input.indexCoordination || !input.indexOwner) return;
+    const shared = new Int32Array(input.indexCoordination);
+    Atomics.compareExchange(shared, 1, input.indexOwner, 0);
+    Atomics.notify(shared, 1);
+}
+
+/** One synchronous transaction per permit; release the permit before yielding. */
+export async function withIndexChunk<T>(
+    input: { indexCoordination?: SharedArrayBuffer; indexOwner?: number },
+    operation: () => T,
+): Promise<T> {
+    if (!input.indexCoordination || !input.indexOwner) return operation();
+    const shared = new Int32Array(input.indexCoordination);
+    for (;;) {
+        if (
+            Atomics.load(shared, 0) === 0 &&
+            Atomics.compareExchange(shared, 1, 0, input.indexOwner) === 0
+        ) {
+            if (Atomics.load(shared, 0) === 0) break;
+            releaseIndexOwner(input);
+        }
+        await yieldIndexTurn();
+    }
+    try {
+        return await operation();
+    } finally {
+        releaseIndexOwner(input);
+    }
+}
+
+export async function yieldIndexChunk(): Promise<void> {
+    await yieldIndexTurn();
+}