akm-cli 0.9.5 → 0.9.6

package/dist/core/maintenance-barrier.js

@@ -5,6 +5,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { sleepSync } from "../runtime.js";
 import { ConfigError } from "./errors.js";
 import { createLockPayload, probeLock, reclaimStaleLock, releaseLock, tryAcquireLockSync } from "./file-lock.js";
 import { getMaintenanceBarrierPath } from "./paths.js";
@@ -93,7 +94,7 @@ function withMaintenanceStartBarrierSyncWait(run) {
     const deadline = Date.now() + 5_000;
     let release = tryAcquireMaintenanceBarrier();
     while (!release && Date.now() < deadline) {
-        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 5);
+        sleepSync(5);
         release = tryAcquireMaintenanceBarrier();
     }
     if (!release)
@@ -107,19 +108,6 @@ function withMaintenanceStartBarrierSyncWait(run) {
         release();
     }
 }
-/** Register a long-lived state operation atomically with other start acquisitions. */
-export async function acquireMaintenanceActivity(name) {
-    return withMaintenanceStartBarrierAsync(async () => {
-        const directory = path.join(path.dirname(getMaintenanceBarrierPath()), "maintenance-activities");
-        fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
-        const lockPath = path.join(directory, `${name}-${process.pid}-${randomUUID()}.lock`);
-        const ownership = tryAcquireLockSync(lockPath, createLockPayload({ purpose: name }));
-        if (!ownership) {
-            throw new ConfigError(`Could not register AKM maintenance activity at ${lockPath}.`, "INVALID_CONFIG_FILE");
-        }
-        return () => releaseLock(ownership);
-    });
-}
 /** Synchronous activity registration for synchronous database handle lifetimes. */
 export function acquireMaintenanceActivitySync(name) {
     return withMaintenanceStartBarrierSyncWait(() => {

package/dist/core/paths.js

@@ -251,9 +251,6 @@ export function getLockfilePath() {
 export function getLockfileLockPath() {
     return path.join(getDataDir(), "akm.lock.lck");
 }
-export function getSemanticStatusPath() {
-    return path.join(getCacheDir(), "semantic-status.json");
-}
 export function getRegistryCacheDir() {
     return path.join(getCacheDir(), "registry");
 }

package/dist/core/redaction.js

@@ -373,11 +373,11 @@ const ERROR_BODY_MAX_LEN = 200;
  * Make an HTTP error body safe to put in an error message: pattern-redact
  * credential shapes, then clip. Provider bodies can echo the credential that
  * was sent and can be megabytes of HTML, and these messages travel — into
- * persisted status files, `--json` output, and agent transcripts.
+ * `--json` output and agent transcripts.
  *
  * Lives here rather than beside one transport because every HTTP client in the
  * codebase needs it; the embeddings transport originally lacked it and leaked
- * raw 10 MB bodies into `semantic-status.json`.
+ * raw 10 MB bodies into error messages.
  */
 export function redactErrorBody(input) {
     if (!input)

package/dist/core/spawn-env.js

@@ -4,19 +4,15 @@
 /**
  * The ONE allowlist-based child-environment primitive.
  *
- * Two akm code paths spawn a child from an explicit list of environment
+ * Three akm code paths spawn a child from an explicit list of environment
  * variable NAMES — the agent-CLI spawn wrapper
- * (`integrations/agent/spawn.ts`, `profile.envPassthrough`) and the workflow
- * `exec` unit runner (`workflows/exec/exec-unit.ts`) — and both start from an
- * EMPTY environment and copy through named entries with
- * {@link collectAllowlistedEnv}. Keeping that in one leaf module is what makes
- * "allowlist" a single reviewable mechanism instead of two implementations
- * that drift apart.
- *
- * NOT covered: the opencode-sdk server spawn
- * (`integrations/harnesses/opencode-sdk/sdk-runner.ts`) keeps its own
- * hard-coded name list and does not route through here, so it gets neither the
- * platform floor below nor PATH supplementation.
+ * (`integrations/agent/spawn.ts`, `profile.envPassthrough`), the workflow
+ * `exec` unit runner (`workflows/exec/exec-unit.ts`), and the opencode-sdk
+ * server spawn (`integrations/harnesses/opencode-sdk/sdk-runner.ts`) — and
+ * all build their allowlist from {@link COMMON_SPAWN_ENV_PASSTHROUGH} /
+ * {@link spawnEnvNamesFor}. Keeping that in one leaf module is what makes
+ * "allowlist" a single reviewable mechanism instead of independent
+ * implementations that drift apart.
  *
  * A LEAF: node built-ins only, so both the integrations layer and the workflow
  * engine can import it without opening a cycle.

package/dist/core/state/migrations.js

@@ -1132,22 +1132,11 @@ export function runMigrations(db, options) {
     runSqliteMigrations(db, STATE_MIGRATIONS, {
         lockInitialMigrationPrefixThrough: options?.existingUnversionedDatabase ? "002-task-history-per-run" : undefined,
         beforeLedgerInitializationLocked(lockedDb) {
-            if (options?.freshDatabase) {
-                if (!options.verifyFreshDatabaseOwnership) {
-                    throw new Error("A fresh state.db migration requires verified file ownership.");
-                }
-                options.verifyFreshDatabaseOwnership();
+            if (options?.freshDatabase)
                 return;
-            }
             prepareExistingUnversionedState(lockedDb);
         },
         beforeMigrationLocked(migration, lockedDb) {
-            if (options?.freshDatabase) {
-                if (!options.verifyFreshDatabaseOwnership) {
-                    throw new Error("A fresh state.db migration requires verified file ownership.");
-                }
-                options.verifyFreshDatabaseOwnership();
-            }
             if (options?.existingUnversionedDatabase && !existingUnversionedSnapshotPrepared) {
                 prepareExistingUnversionedState(lockedDb);
             }

package/dist/core/state-db.js

@@ -65,6 +65,7 @@
 import { randomUUID } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { sleepSync } from "../runtime.js";
 import { openDatabase } from "../storage/database.js";
 import { assertMigrationLedger } from "../storage/engines/sqlite-migrations.js";
 import { openManagedDatabase, withManagedDb } from "../storage/managed-db.js";
@@ -189,20 +190,18 @@ function reserveFreshStateDatabase(dbPath) {
         throw error;
     }
     try {
-        const reservation = {
+        return {
             path: dbPath,
             fd,
             identity: fs.fstatSync(fd, { bigint: true }),
         };
-        assertOwnedFileReservation(reservation, "Fresh state.db");
-        return reservation;
     }
     catch (error) {
         try {
             fs.closeSync(fd);
         }
         catch {
-            // Preserve the ownership failure.
+            // Preserve the fstat failure.
         }
         throw error;
     }
@@ -217,20 +216,18 @@ function openExistingStateDatabaseSource(dbPath) {
         throw new Error(`Could not bind the existing state.db source inode: ${detail}`);
     }
     try {
-        const source = {
+        return {
             path: dbPath,
             fd,
             identity: fs.fstatSync(fd, { bigint: true }),
         };
-        assertStateDatabaseSource(source);
-        return source;
     }
     catch (error) {
         try {
             fs.closeSync(fd);
         }
         catch {
-            // Preserve the source identity failure.
+            // Preserve the fstat failure.
         }
         throw error;
     }
@@ -386,10 +383,7 @@ export function openStateDatabase(dbPath, options) {
         return openManagedDatabase({
             path: resolvedPath,
             pragmas: { dataDir: path.dirname(resolvedPath) },
-            init: (db) => runMigrations(db, {
-                freshDatabase: true,
-                verifyFreshDatabaseOwnership: () => { },
-            }),
+            init: (db) => runMigrations(db, { freshDatabase: true }),
         });
     }
     const isCanonical = path.resolve(resolvedPath) === path.resolve(canonicalPath);
@@ -404,12 +398,10 @@ export function openStateDatabase(dbPath, options) {
         freshReservation = reserveFreshStateDatabase(resolvedPath);
         if (!freshReservation) {
             existingSource = openExistingStateDatabaseSource(resolvedPath);
-            assertStateDatabaseSource(existingSource);
             const preflight = openDatabase(sqliteBoundFilePath(existingSource), {
                 readonly: true,
             });
             try {
-                assertStateDatabaseSource(existingSource);
                 preflight.exec("PRAGMA busy_timeout = 30000");
                 const ledger = assertMigrationLedger(preflight, STATE_MIGRATIONS);
                 existingUnversionedDatabase = ledger.migrationIds.length === 0;
@@ -422,21 +414,13 @@ export function openStateDatabase(dbPath, options) {
                 preflight.close();
             }
         }
-        const ownedFresh = freshReservation;
         const boundSource = existingSource;
-        if (boundSource)
-            assertStateDatabaseSource(boundSource);
         openedDb = openManagedDatabase({
             path: boundSource ? sqliteBoundFilePath(boundSource) : resolvedPath,
             pragmas: { dataDir: path.dirname(resolvedPath) },
             init: (db) => {
-                if (boundSource)
-                    assertStateDatabaseSource(boundSource);
                 runMigrations(db, {
-                    freshDatabase: !!ownedFresh,
-                    verifyFreshDatabaseOwnership: ownedFresh
-                        ? () => assertOwnedFileReservation(ownedFresh, "Fresh state.db")
-                        : undefined,
+                    freshDatabase: !!freshReservation,
                     existingUnversionedDatabase,
                     allowHistoricalDestructiveStateUpgrade: options?.allowHistoricalDestructiveStateUpgrade,
                     beforeExistingUnversionedStateMigration: options?.allowHistoricalDestructiveStateUpgrade
@@ -463,12 +447,10 @@ export function openStateDatabase(dbPath, options) {
             },
         });
         if (existingSource) {
-            assertStateDatabaseSource(existingSource);
             closeFileIdentity(existingSource);
             existingSource = undefined;
         }
         if (freshReservation) {
-            assertOwnedFileReservation(freshReservation, "Fresh state.db");
             closeFileIdentity(freshReservation);
             freshReservation = undefined;
         }
@@ -610,11 +592,11 @@ function isRetryableBeginError(err) {
         msg.includes("did not open a transaction"));
 }
 const WITH_IMMEDIATE_TX_MAX_ATTEMPTS = 5;
-/** Portable synchronous sleep (works under both Bun and Node). */
+/** Portable synchronous sleep (works under both Bun and Node). Delegates to the runtime boundary's `sleepSync`. */
 function sleepSyncMs(ms) {
     if (ms <= 0)
         return;
-    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+    sleepSync(ms);
 }
 /**
  * Open, but deliberately do not finish, an immediate transaction.

package/dist/core/write-source.js

@@ -34,7 +34,7 @@ import { assetPathForName, stashDirFor } from "./asset/asset-placement.js";
 import { conceptIdFromTypeName, displayRef } from "./asset/resolve-ref.js";
 import { deriveBundleId } from "./bundle-id.js";
 import { existingFileMode, isWithin, resolveStashDir, writeFileAtomic } from "./common.js";
-import { resolveConfiguredSources } from "./config/config.js";
+import { bundleContentRoot, resolveConfiguredSources } from "./config/config.js";
 import { ConfigError, UsageError } from "./errors.js";
 import { sanitizeCommitMessage } from "./git-message.js";
 import { warn } from "./warn.js";
@@ -111,7 +111,15 @@ export function planWriteTargetPublication(target, filePaths, options) {
     }
     const unignoredPaths = paths.filter((_, index) => !ignored.has(relativePaths[index]));
     assertWriteTargetPathsClean(target.source, unignoredPaths);
-    assertWriteTargetPlanBase(target, expectedBaseHead);
+    // Not re-verified against `expectedBaseHead` here: any drift during the
+    // ignored/clean-path checks above is caught by the SAME expectedBaseHead
+    // comparison `beginWriteTargetMutation` runs immediately before the first
+    // mutation (its documented contract, and every real caller calls it right
+    // after this function returns) -- checking it again here a few lines
+    // earlier for the exact same value only duplicated that check, not added
+    // a new one. `publishWriteTargetPlan` independently re-checks a third time
+    // after the actual mutation, which is a genuinely different point in time
+    // and stays.
     return { target, paths, publish: ignored.size === 0, expectedBaseHead };
 }
 function assertNoWritePathDescendantSymlinks(source, filePaths) {
@@ -538,7 +546,6 @@ function captureGitPathState(repoPath, absolutePath, relativePath) {
 }
 /** Create or recover the one transaction-owned commit without pushing it. */
 export function ensureGitTransactionCommit(target, publication, options) {
-    assertGitPublicationIdentity(target, publication);
     const paths = normalizePublicationPaths(options.paths);
     validateGitWorktreeSnapshots(target, paths, options.snapshots);
     if (publication.commit !== undefined) {
@@ -626,7 +633,6 @@ export function publishWriteTargetTransaction(target, publication, options) {
 }
 /** Push only the recorded transaction commit, never later local descendants. */
 export function publishGitTransactionCommit(target, publication, transactionId, paths, snapshots) {
-    assertGitPublicationIdentity(target, publication);
     if (publication.commit === undefined) {
         throw new Error(`Git transaction ${transactionId} has no recorded publication decision.`);
     }
@@ -703,20 +709,6 @@ function readGitPublicationIdentity(target) {
         upstream: upstreamResult.stdout.trim(),
     };
 }
-function assertGitPublicationIdentity(target, publication) {
-    if (target.source.kind !== "git") {
-        throw new Error(`Git publication is bound to non-Git target "${target.source.name}".`);
-    }
-    const current = readGitPublicationIdentity(target);
-    for (const key of ["repoPath", "branch", "remote", "mergeRef", "remoteUrl", "upstream"]) {
-        if (current[key] !== publication[key]) {
-            throw new Error(`Git publication target identity changed at ${key} for "${target.source.name}".`);
-        }
-    }
-    if (JSON.stringify(current.pushUrls ?? []) !== JSON.stringify(publication.pushUrls ?? [])) {
-        throw new Error(`Git publication target identity changed at pushUrls for "${target.source.name}".`);
-    }
-}
 function normalizePublicationPaths(paths) {
     const normalized = new Set();
     for (const filePath of paths) {
@@ -951,9 +943,10 @@ export function resolveWorkingStashTarget(akmConfig, options = {}) {
     const requireWritable = options.requireWritable !== false;
     if (process.env.AKM_BUNDLE_DIR?.trim()) {
         const stashDir = resolveStashDir();
+        const resolvedStashDir = path.resolve(stashDir);
         const configured = configuredSources.find((source) => {
             const sourcePath = source.source.type === "filesystem" ? source.source.path : undefined;
-            return sourcePath !== undefined && path.resolve(sourcePath) === path.resolve(stashDir);
+            return sourcePath !== undefined && bundleContentRoot(sourcePath, source.componentRoot) === resolvedStashDir;
         });
         if (configured) {
             const target = adaptConfiguredSource(configured);

package/dist/execution/directory-identity.js

@@ -27,19 +27,48 @@ export function captureFrozenDirectoryIdentity(rootInput, relativeCwd) {
         cwdInode: cwdStat.ino.toString(),
     });
 }
-export function assertFrozenDirectoryIdentity(identity) {
-    let actual;
+/**
+ * Re-verify, immediately before spawn, that a frozen cwd still resolves
+ * inside its execution root — path containment and resolved-path identity,
+ * NOT device/inode identity. Unlike the removed assertFrozenDirectoryIdentity,
+ * this does not compare device/inode numbers against the frozen snapshot: a
+ * remount, an rsync, or a container rebuild that leaves the same real
+ * content at the same real PATH must not abort a dispatch. What still
+ * throws is anything that changes the resolved real PATH itself — a
+ * symlink swap, an ancestor swap, a file replacing the directory, or the
+ * root itself being replaced by a symlink elsewhere (root-vs-cwd
+ * containment alone can't catch that last one, since both resolve together
+ * under the new root; comparing the root's own resolved path to its frozen
+ * value catches it).
+ */
+export function assertFrozenDirectoryContained(identity) {
+    let realRoot;
+    let realCwd;
     try {
-        const relative = path.relative(identity.requestedRoot, identity.requestedCwd);
-        actual = captureFrozenDirectoryIdentity(identity.requestedRoot, relative);
+        realRoot = fs.realpathSync(identity.requestedRoot);
+        realCwd = fs.realpathSync(identity.requestedCwd);
     }
     catch {
         throw changed(identity.requestedCwd);
     }
-    for (const key of ["realRoot", "rootDevice", "rootInode", "realCwd", "cwdDevice", "cwdInode"]) {
-        if (actual[key] !== identity[key])
-            throw changed(identity.requestedCwd);
+    if (realRoot !== identity.realRoot)
+        throw changed(identity.requestedCwd);
+    const relative = path.relative(realRoot, realCwd);
+    if (relative.startsWith("..") || path.isAbsolute(relative)) {
+        throw changed(identity.requestedCwd);
     }
+    let cwdStat;
+    try {
+        cwdStat = fs.statSync(realCwd, { bigint: true });
+    }
+    catch {
+        throw changed(identity.requestedCwd);
+    }
+    if (!cwdStat.isDirectory())
+        throw changed(identity.requestedCwd);
+}
+function changed(cwd) {
+    return new UsageError(`Frozen execution cwd ${cwd} changed and no longer resolves inside its root.`, "PATH_ESCAPE_VIOLATION");
 }
 function requireContained(root, candidate) {
     const relative = path.relative(root, candidate);
@@ -47,6 +76,3 @@ function requireContained(root, candidate) {
         throw new UsageError(`${candidate} escapes its execution root.`, "PATH_ESCAPE_VIOLATION");
     }
 }
-function changed(cwd) {
-    return new UsageError(`Frozen execution cwd ${cwd} changed after publication.`, "RESOURCE_ALREADY_EXISTS");
-}

package/dist/indexer/graph/graph-boost.js

@@ -68,11 +68,7 @@ function combineConfidence(...parts) {
     return out;
 }
 function toConfidenceMultiplier(rawConfidence, weights) {
-    if (weights.confidenceMode === "off")
-        return 1;
     const confidence = normalizeConfidence(rawConfidence) ?? 1;
-    if (weights.confidenceMode === "multiply")
-        return confidence;
     const blendWeight = Math.max(0, Math.min(1, weights.confidenceWeight));
     return 1 - blendWeight + blendWeight * confidence;
 }

package/dist/indexer/index-writer-lock.js

@@ -1,15 +1,36 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * Asset-mutation lease — serializes writes to real, authored user content
+ * (source updates, `akm remember`, proposal apply, ...) so two concurrent
+ * writers cannot both pass a git exact-path preflight check before either
+ * commits.
+ *
+ * This module previously also gated full index REBUILDS behind the same
+ * lease with a 12-hour age-based stale-reclaim window (#872). That guard was
+ * removed: the index is a regenerable cache, concurrent rebuilds only waste
+ * work rather than corrupt anything, and a live-but-wedged holder passed the
+ * PID-liveness check forever, so only the 12h clock could ever free it —
+ * which cost one real install a half-day indexing outage. Index rebuilds no
+ * longer take any lease.
+ *
+ * What remains here guards actual data loss (a lost or conflicting git
+ * commit), so per AGENTS.md `## Defensive Code` it stays — but with the same
+ * fix applied: no age-based stale-reclaim. A holder is only ever reclaimed
+ * once its PID is verifiably dead; a live-but-wedged holder makes an
+ * acquisition attempt wait (bounded by `maxWaitMs`) or fail, never silently
+ * override a lease someone might still be using.
+ */
 import { AsyncLocalStorage } from "node:async_hooks";
 import fs from "node:fs";
 import path from "node:path";
 import { createLockPayload, probeLock, reclaimStaleLock, releaseLock, tryAcquireLockSync, } from "../core/file-lock.js";
 import { tryAcquireMaintenanceBarrier } from "../core/maintenance-barrier.js";
 import { getDbPath, getIndexWriterLockPath } from "../core/paths.js";
-const INDEX_WRITER_LOCK_STALE_AFTER_MS = 12 * 60 * 60 * 1000;
-const INDEX_WRITER_WAIT_MS = 100;
-const DEFAULT_INDEX_WRITER_MAX_WAIT_MS = 10 * 60 * 1000;
+import { sleepSync } from "../runtime.js";
+const ASSET_MUTATION_WAIT_MS = 100;
+const DEFAULT_ASSET_MUTATION_MAX_WAIT_MS = 10 * 60 * 1000;
 const leaseContext = new AsyncLocalStorage();
 function buildPayload(purpose) {
     return createLockPayload({
@@ -24,7 +45,7 @@ function delay(ms) {
 function throwIfAborted(signal) {
     if (!signal?.aborted)
         return;
-    throw signal.reason instanceof Error ? signal.reason : new Error("index writer wait aborted");
+    throw signal.reason instanceof Error ? signal.reason : new Error("asset mutation lease wait aborted");
 }
 function createLease(lockPath, ownership) {
     const exitHandler = () => releaseLock(ownership);
@@ -41,7 +62,7 @@ function createLease(lockPath, ownership) {
         },
     };
 }
-function tryAcquireIndexWriterLease(lockPath, purpose) {
+function tryAcquireAssetMutationLease(lockPath, purpose) {
     while (true) {
         const releaseBarrier = tryAcquireMaintenanceBarrier();
         if (!releaseBarrier)
@@ -50,7 +71,8 @@ function tryAcquireIndexWriterLease(lockPath, purpose) {
             const ownership = tryAcquireLockSync(lockPath, buildPayload(purpose));
             if (ownership)
                 return createLease(lockPath, ownership);
-            const probe = probeLock(lockPath, { staleAfterMs: INDEX_WRITER_LOCK_STALE_AFTER_MS });
+            // No `staleAfterMs`: only a verifiably dead holder is ever reclaimed.
+            const probe = probeLock(lockPath);
             if (probe.state !== "stale" || !reclaimStaleLock(lockPath, probe))
                 return undefined;
         }
@@ -59,16 +81,16 @@ function tryAcquireIndexWriterLease(lockPath, purpose) {
         }
     }
 }
-export async function acquireIndexWriterLease(options) {
+export async function acquireAssetMutationLease(options) {
     const mode = options.mode ?? "wait";
     const lockPath = getIndexWriterLockPath();
     const startedAt = Date.now();
-    const maxWaitMs = options.maxWaitMs ?? DEFAULT_INDEX_WRITER_MAX_WAIT_MS;
+    const maxWaitMs = options.maxWaitMs ?? DEFAULT_ASSET_MUTATION_MAX_WAIT_MS;
     fs.mkdirSync(path.dirname(lockPath), { recursive: true });
     let lastWaitNoticeMs = 0;
     while (true) {
         throwIfAborted(options.signal);
-        const lease = tryAcquireIndexWriterLease(lockPath, options.purpose);
+        const lease = tryAcquireAssetMutationLease(lockPath, options.purpose);
         if (lease) {
             options.onAcquired?.({ waitedMs: Date.now() - startedAt });
             return lease;
@@ -79,26 +101,27 @@ export async function acquireIndexWriterLease(options) {
         // attempt, so a caller with maxWaitMs:0 still gets one chance at a free lock
         // instead of throwing before it ever tries.
         if (maxWaitMs >= 0 && Date.now() - startedAt >= maxWaitMs) {
-            throw new Error(`timed out waiting for index writer lease for ${options.purpose}`);
+            throw new Error(`timed out waiting for asset mutation lease for ${options.purpose}`);
         }
         const waitedMs = Date.now() - startedAt;
         if (waitedMs - lastWaitNoticeMs >= 15000) {
             options.onWait?.({ waitedMs });
             lastWaitNoticeMs = waitedMs;
         }
-        await delay(INDEX_WRITER_WAIT_MS);
+        await delay(ASSET_MUTATION_WAIT_MS);
     }
 }
-export async function withIndexWriterLease(options, run) {
+/** Asset writes share one lease so two concurrent writers cannot both pass preflight before either commits. */
+export async function withAssetMutationLease(purpose, run) {
     const lockPath = getIndexWriterLockPath();
     const inherited = leaseContext.getStore();
     if (inherited?.has(lockPath))
         return run();
     const context = inherited ?? new Set();
     const execute = async () => {
-        const lease = await acquireIndexWriterLease(options);
+        const lease = await acquireAssetMutationLease({ purpose });
         if (!lease)
-            throw new Error(`index writer lease unavailable for ${options.purpose}`);
+            throw new Error(`asset mutation lease unavailable for ${purpose}`);
         context.add(lockPath);
         try {
             return await run();
@@ -110,10 +133,6 @@ export async function withIndexWriterLease(options, run) {
     };
     return inherited ? execute() : leaseContext.run(context, execute);
 }
-/** Asset writes and index rebuilds share one lease so scans cannot publish stale snapshots. */
-export function withAssetMutationLease(purpose, run) {
-    return withIndexWriterLease({ purpose }, run);
-}
 /** Synchronous asset-write boundary over the same interprocess lease. */
 export function withAssetMutationLeaseSync(purpose, run) {
     const lockPath = getIndexWriterLockPath();
@@ -126,12 +145,12 @@ export function withAssetMutationLeaseSync(purpose, run) {
         fs.mkdirSync(path.dirname(lockPath), { recursive: true });
         let lease;
         while (!lease) {
-            lease = tryAcquireIndexWriterLease(lockPath, purpose);
+            lease = tryAcquireAssetMutationLease(lockPath, purpose);
             if (!lease) {
-                if (Date.now() - startedAt >= DEFAULT_INDEX_WRITER_MAX_WAIT_MS) {
-                    throw new Error(`timed out waiting for index writer lease for ${purpose}`);
+                if (Date.now() - startedAt >= DEFAULT_ASSET_MUTATION_MAX_WAIT_MS) {
+                    throw new Error(`timed out waiting for asset mutation lease for ${purpose}`);
                 }
-                Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, INDEX_WRITER_WAIT_MS);
+                sleepSync(ASSET_MUTATION_WAIT_MS);
             }
         }
         context.add(lockPath);
@@ -145,6 +164,6 @@ export function withAssetMutationLeaseSync(purpose, run) {
     };
     return inherited ? execute() : leaseContext.run(context, execute);
 }
-export function probeIndexWriterLease() {
-    return probeLock(getIndexWriterLockPath(), { staleAfterMs: INDEX_WRITER_LOCK_STALE_AFTER_MS });
+export function probeAssetMutationLease() {
+    return probeLock(getIndexWriterLockPath());
 }

package/dist/indexer/index-written-assets.js

@@ -29,9 +29,8 @@ import { getDbPath } from "../core/paths.js";
 import { warn, warnVerbose } from "../core/warn.js";
 import { closeDatabase, openExistingDatabase } from "../storage/repositories/index-connection.js";
 import { deleteEntriesByIds, getEntryCount, upsertEntry } from "../storage/repositories/index-entries-repository.js";
-import { withIndexWriterLease } from "./index-writer-lock.js";
 import { deriveEntryProvenance, deriveInstallations } from "./installations.js";
-import { generateEmbeddingsForDb, publishTargetedSemanticStatus } from "./materialize-embeddings.js";
+import { generateEmbeddingsForDb, publishTargetedEmbeddingMeta } from "./materialize-embeddings.js";
 import { drainDirDocuments } from "./scan/drain-dir.js";
 import { buildSearchText } from "./search/search-fields.js";
 import { buildFileContext } from "./walk/file-context.js";
@@ -57,7 +56,7 @@ export const WRITE_PATH_INDEX_BUSY_TIMEOUT_MS = 5_000;
  */
 export async function indexWrittenAssets(stashDir, filePaths, options = {}) {
     try {
-        return await withIndexWriterLease({ purpose: "index-written-assets" }, async () => {
+        return await (async () => {
             const dbPath = getDbPath();
             // `true` here means "the index is in the state the caller expects" — and
             // `acceptProposal` advances its journal to `index-finalized` on the
@@ -181,15 +180,15 @@ export async function indexWrittenAssets(stashDir, filePaths, options = {}) {
                 })();
                 if (mutated) {
                     const config = loadConfig();
-                    const embeddingResult = await generateEmbeddingsForDb(db, config, () => { }, undefined, [...targetEntryIds]);
-                    publishTargetedSemanticStatus(db, config, embeddingResult);
+                    await generateEmbeddingsForDb(db, config, () => { }, undefined, [...targetEntryIds]);
+                    publishTargetedEmbeddingMeta(db, config);
                 }
             }
             finally {
                 closeDatabase(db);
             }
             return true;
-        });
+        })();
     }
     catch (error) {
         // A permission fault is the one failure the next full index will NOT heal,