Merge-queue flake batch: seven fixes landed together

.alfonso/release-notes/next/queued-outside-edit-diagnostics.md

@@ -0,0 +1 @@
+- `aft_inspect` no longer reports Rust files as clean right after another program changes them while AFT's language-server connection is busy; it now waits for the `cargo check` that change needs, or says the check is still running.

.alfonso/release-notes/next/views-eviction-waits-for-cleanup-read.md

@@ -0,0 +1 @@
+Disk-limit eviction no longer keeps an idle view because a background cleanup pass happened to be reading its pointer at that moment; it waits for that short read to finish.

.alfonso/release-notes/next/views-semantic-ready-snapshot.md

@@ -0,0 +1 @@
+- With views on, semantic search no longer briefly answers with text matches only (while reporting the semantic lane as ready) right after new embeddings are published.

.github/workflows/_unit-suite.yml

@@ -274,7 +274,13 @@ jobs:
       - name: Publication input gate
         run: |
           set -euo pipefail
-          git fetch --force origin refs/tags/v0.48.1:refs/tags/v0.48.1
+          # A runner that briefly cannot reach github.com must not fail the
+          # merge-queue group: retry the tag fetch before giving up.
+          for attempt in 1 2 3; do
+            git fetch --force origin refs/tags/v0.48.1:refs/tags/v0.48.1 && break
+            if [ "$attempt" = 3 ]; then exit 1; fi
+            sleep 20
+          done
           node scripts/release-gate-v049.mjs --check-inputs
 
       - name: Cargo build (debug — needed by plugin e2e tests)

.github/workflows/release.yml

@@ -777,7 +777,15 @@ jobs:
         working-directory: packages/aft-cli
 
       - name: Fetch final v0.48.1 activation baseline
-        run: git fetch --force origin refs/tags/v0.48.1:refs/tags/v0.48.1
+        run: |
+          set -euo pipefail
+          # Retry so a brief network failure reaching github.com does not
+          # fail the release.
+          for attempt in 1 2 3; do
+            git fetch --force origin refs/tags/v0.48.1:refs/tags/v0.48.1 && break
+            if [ "$attempt" = 3 ]; then exit 1; fi
+            sleep 20
+          done
 
       - name: Prepare publication records from the tagged candidate
         run: node scripts/release-gate-v049.mjs --prepare --snapshot-dir "${{ runner.temp }}/governed-publication" --candidate

.github/workflows/tests.yml

@@ -103,7 +103,14 @@ jobs:
         run: bun run --cwd packages/aft-bridge build
       - name: Governed-docs aggregate input validator
         run: |
-          git fetch --no-tags origin refs/tags/v0.48.1:refs/tags/v0.48.1
+          set -euo pipefail
+          # A runner that briefly cannot reach github.com must not fail the
+          # check: retry the tag fetch before giving up.
+          for attempt in 1 2 3; do
+            git fetch --no-tags origin refs/tags/v0.48.1:refs/tags/v0.48.1 && break
+            if [ "$attempt" = 3 ]; then exit 1; fi
+            sleep 20
+          done
           node scripts/release-gate-v049.mjs --check-inputs
 
   pr-checks:

benchmarks/aft-search/slice-descriptors/alfonso-task-bg_5bc274728f6be348-scoped-inspect-certifies-a-stale-clean-result-af.json

@@ -0,0 +1,8 @@
+{
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "slice_class": "non_ranking",
+  "fixtures": [
+    "harness-goldens"
+  ]
+}

benchmarks/aft-search/slice-descriptors/alfonso-task-bg_ccd0193466-replay-tests-complete-pass-wide-budget.json

@@ -0,0 +1,12 @@
+{
+  "slice_class": "non_ranking",
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "fixtures": [
+    "harness-goldens"
+  ],
+  "slices": [
+    "bash-background-project-replay-tests"
+  ],
+  "note": "Test-only: project replay tests in crates/aft/src/bash_background/registry.rs that expect a single replay pass to reach every task now set the per-pass scan time budget to 60 s instead of the 25 ms production limit. No aft_search ranking, fusion, lane admission or truncation change."
+}

benchmarks/aft-search/slice-descriptors/alfonso-task-bg_cd00f3761a4abf2b-two-queue-flakes-callgraph-store-pin-order-exter.json

@@ -0,0 +1,10 @@
+{
+  "slice_class": "engine_unwired",
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "fixtures": [
+    "crates/aft/tests/integration/tool_call_parity_test.rs",
+    "crates/aft/src/commands/semantic_search/mod.rs"
+  ],
+  "note": "The ranking-fenced semantic_search mod.rs change is test-only: the split-request ranking test runs its borrowed-load, disk-check and first-search waits generous so a loaded runner cannot truncate the file list, and a missing host now prints the response. Enumeration, lane selection, scores, fusion, ordering and page cuts are unchanged; benchmark rows must remain byte-identical."
+}

benchmarks/aft-search/slice-descriptors/land-bash-test-races.json

@@ -0,0 +1,8 @@
+{
+  "slice_class": "non_ranking",
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "fixtures": ["harness-goldens"],
+  "slices": ["bash-test-race-waits"],
+  "note": "Test-only: three bash tests now wait on an observable signal instead of racing it (a complete pid in the pid file, the aborted command's start marker, and a replay time budget wide enough to reach the injected recording failure). No product code changed and no changed path matches RANKING_FENCE_PREFIXES."
+}

benchmarks/aft-search/slice-descriptors/land-borrowed-reload-entry-count.json

@@ -0,0 +1,14 @@
+{
+  "slice_class": "engine_unwired",
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "fixtures": [
+    "crates/aft/tests/integration/tool_call_parity_test.rs",
+    "crates/aft/src/search_index.rs",
+    "crates/aft/src/commands/semantic_search/mod.rs"
+  ],
+  "slices": [
+    "borrowed-reload-entry-count"
+  ],
+  "note": "Test-only. search_index.rs gains a #[cfg(test)] per-root counter of records read on the borrowed-load path; semantic_search/mod.rs and readonly_artifacts.rs tests assert the reload read between 1 and the entry budget instead of timing it. No product code in the fence changes, so ranked rows must remain byte-identical to the committed reference."
+}

benchmarks/aft-search/slice-descriptors/land-eviction-cleanup-read.json

@@ -0,0 +1,8 @@
+{
+  "slice_class": "non_ranking",
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "fixtures": ["harness-goldens"],
+  "slices": ["views-eviction-cleanup-read"],
+  "note": "Views storage only: disk-limit eviction now waits for this process's background cleanup reads of a view's pointer to close (bounded by its deadline or the registry busy timeout) instead of refusing an idle view as open. No changed path matches RANKING_FENCE_PREFIXES."
+}

benchmarks/aft-search/slice-descriptors/land-flake-batch-1027.json

@@ -0,0 +1,15 @@
+{
+  "slice_class": "engine_unwired",
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "fixtures": [
+    "crates/aft/tests/integration/tool_call_parity_test.rs",
+    "crates/aft/src/commands/semantic_search/mod.rs",
+    "crates/aft/src/commands/semantic_search/external_disk_check.rs",
+    "crates/aft/src/search_index.rs"
+  ],
+  "slices": [
+    "flake-batch-1027"
+  ],
+  "note": "Batch of seven merge-queue fixes landed together so their groups stop failing on each other's flakes: #1028 (views-on readiness samples the installed snapshot's index; views-off unchanged), #1029, #1030, #1031, #1032, #1033, #1037. Fence hits are #1028's views-only readiness sample and test-only code in semantic_search and search_index; views-off ranked rows stay byte-identical to the committed reference."
+}

benchmarks/aft-search/slice-descriptors/land-stderr-exit-hold-test.json

@@ -0,0 +1,12 @@
+{
+  "slice_class": "non_ranking",
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "fixtures": [
+    "harness-goldens"
+  ],
+  "slices": [
+    "stderr-exit-hold-test"
+  ],
+  "note": "Test-only hook (debug builds) that holds the stderr mirror until the exit fence starts, so the slow-writer exit test proves the fence delivers the terminal marker to stderr. No search, ranking or routing code changes."
+}

benchmarks/aft-search/slice-descriptors/land-tag-fetch-retry.json

@@ -0,0 +1,12 @@
+{
+  "slice_class": "non_ranking",
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "fixtures": [
+    "harness-goldens"
+  ],
+  "slices": [
+    "tag-fetch-retry"
+  ],
+  "note": "CI only: the v0.48.1 tag fetch before the publication input gate retries three times, so a runner that briefly cannot reach github.com does not fail a merge-queue group. No engine or ranking files change."
+}

benchmarks/aft-search/slice-descriptors/land-timing-flakes-batch.json

@@ -0,0 +1,14 @@
+{
+  "slice_class": "engine_unwired",
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "fixtures": [
+    "crates/aft/tests/integration/tool_call_parity_test.rs",
+    "crates/aft/src/commands/semantic_search/mod.rs",
+    "crates/aft/src/commands/semantic_search/external_disk_check.rs"
+  ],
+  "slices": [
+    "timing-flakes-batch"
+  ],
+  "note": "The ranking fence hits are test modules only: commands/semantic_search/mod.rs and external_disk_check.rs change only inside #[cfg(test)] code (a contended-search test bounds its wait well above the product budget; a capped disk-check test waits for the borrowed index to load and widens the time limits the test is not about). No product code in the fence changes, so ranked rows must remain byte-identical to the committed reference."
+}

benchmarks/aft-search/slice-descriptors/land-views-semantic-ready-snapshot.json

@@ -0,0 +1,11 @@
+{
+  "slice_class": "engine_unwired",
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "fixtures": [
+    "crates/aft/tests/integration/tool_call_parity_test.rs",
+    "crates/aft/tests/integration/per_checkout_semantic_runtime.rs",
+    "crates/aft/src/commands/semantic_search/mod.rs"
+  ],
+  "note": "The readiness sample for a views-on root now asks the checkout view for the index it serves for the installed snapshot (building it only when that snapshot has none yet) instead of the owner's scope-wide cache, which a publication resets. Previously a search between a fill's publication and the worker's index rebuild saw no semantic snapshot, planned no semantic lane and answered with lexical hits only. Views-off roots have no checkout view and take the unchanged path, so their ranked rows stay byte-identical; scoring, fusion and paging are untouched."
+}

crates/aft/src/bash_background/registry.rs

@@ -17746,6 +17746,12 @@ mod tests {
         let db_task_id = "bash-4444444444444444";
         let disk_task_id = "bash-5555555555555555";
         let (registry, db, _) = registry_with_db_and_frames(storage.path());
+        // The assertion below claims one pass reaches every session. A duration
+        // limit lets a loaded machine stop the scan before it gets there.
+        registry.set_project_replay_scan_budget_for_test(
+            PROJECT_REPLAY_SCAN_ENTRY_BUDGET,
+            Duration::from_secs(60),
+        );
 
         write_running_project_task(storage.path(), project.path(), db_session, db_task_id);
         write_running_project_task(storage.path(), project.path(), disk_session, disk_task_id);
@@ -17775,6 +17781,12 @@ mod tests {
         let session = "delivered-project-task";
         let task_id = "bash-6666666666666666";
         let (registry, _db, _) = registry_with_db_and_frames(storage.path());
+        // This asserts the first pass already decided the delivered bundle is not
+        // replayed. A duration limit would defer that decision to a later pass.
+        registry.set_project_replay_scan_budget_for_test(
+            PROJECT_REPLAY_SCAN_ENTRY_BUDGET,
+            Duration::from_secs(60),
+        );
         write_running_project_task(storage.path(), project.path(), session, task_id);
         let paths = task_paths(storage.path(), session, task_id).unwrap();
         let mut metadata = read_task(&paths.json).unwrap();
@@ -17802,6 +17814,12 @@ mod tests {
         let project = tempfile::tempdir().unwrap();
         let storage = tempfile::tempdir().unwrap();
         let (registry, _db, _) = registry_with_db_and_frames(storage.path());
+        // The batch is expected to reach the healthy session after parking the
+        // blocked one. A duration limit could stop the scan in between.
+        registry.set_project_replay_scan_budget_for_test(
+            PROJECT_REPLAY_SCAN_ENTRY_BUDGET,
+            Duration::from_secs(60),
+        );
         let blocked_session = "unreadable-project-session";
         let healthy_session = "readable-project-session";
         let healthy_task = "bash-000000000000beef";
@@ -18033,6 +18051,8 @@ mod tests {
         let (registry, db, _) = registry_with_db_and_frames(storage.path());
         let (session, mut live) =
             project_replay_history_fixture(storage.path(), project.path(), &db);
+        // The pass after the drain is expected to restore the live tasks on its
+        // own. A duration limit could stop it before reaching their session.
         registry.set_project_replay_scan_budget_for_test(64, Duration::from_secs(60));
         let (mut merged, reads, passes) =
             drain_project_replay_fixture(&registry, storage.path(), project.path(), &session);
@@ -18117,6 +18137,12 @@ mod tests {
         let storage = tempfile::tempdir().unwrap();
         let project = tempfile::tempdir().unwrap();
         let (registry, db, _) = registry_with_db_and_frames(storage.path());
+        // The first pass is expected to reach the task directory of this session;
+        // a duration limit could postpone it to a later pass.
+        registry.set_project_replay_scan_budget_for_test(
+            PROJECT_REPLAY_SCAN_ENTRY_BUDGET,
+            Duration::from_secs(60),
+        );
         let session = "cross-harness-project-session";
         let task_id = "bash-000000000000cafe";
         write_running_project_task(storage.path(), project.path(), session, task_id);
@@ -18242,6 +18268,14 @@ mod tests {
         db.lock().unwrap().execute_batch(
             "CREATE TRIGGER reject_discovery BEFORE INSERT ON bash_tasks BEGIN SELECT RAISE(FAIL, 'fixture recording refused'); END;"
         ).unwrap();
+        // The product's 25 ms time budget can expire on a slow runner after
+        // the task is read but before the session directory is exhausted, and
+        // a budget stop is reported ahead of the recording failure. A wide
+        // time budget keeps each pass checking the recording-failure report.
+        registry.set_project_replay_scan_budget_for_test(
+            PROJECT_REPLAY_SCAN_ENTRY_BUDGET,
+            Duration::from_secs(60),
+        );
         for _ in 0..2 {
             let batch = registry.replay_session_from_disk_for_project(
                 storage.path(),
@@ -25545,6 +25579,12 @@ mod tests {
                     .persisted_gc_started
                     .store(true, Ordering::SeqCst);
                 if project_scoped {
+                    // This asserts the first project pass already replayed the task.
+                    // A duration limit could postpone that to a later pass.
+                    replay.set_project_replay_scan_budget_for_test(
+                        PROJECT_REPLAY_SCAN_ENTRY_BUDGET,
+                        Duration::from_secs(60),
+                    );
                     replay
                         .replay_session_for_project(storage.path(), "session", storage.path())
                         .unwrap();
@@ -25628,6 +25668,12 @@ mod tests {
             .inner
             .persisted_gc_started
             .store(true, Ordering::SeqCst);
+        // This expects a single pass to reach the task and record the foreign
+        // acknowledgement. A duration limit could postpone it to a later pass.
+        replay.set_project_replay_scan_budget_for_test(
+            PROJECT_REPLAY_SCAN_ENTRY_BUDGET,
+            Duration::from_secs(60),
+        );
         replay
             .replay_session_for_project(storage.path(), "session", storage.path())
             .unwrap();