Release v1.0.160 — full review fixes: concurrency, tests, safe_canonicalize, doc-comments

CHANGELOG.md

@@ -7,6 +7,57 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 
 
+## [1.0.160] - 2026-06-02
+
+### Fixed
+
+- **`evaluate_csharp_rebuild` no longer holds `config.write()` during git/fs I/O** —
+  the bootstrap timestamp computation (git subprocess + ≤10 000-entry filesystem
+  walk) previously ran while holding the `config` write-lock, blocking every
+  concurrent `config.read()` caller for the full scan duration. The lock is now
+  acquired only for the brief config update; the slow work runs with no lock held.
+- **`evaluate_csharp_rebuild` offloaded to `spawn_blocking` in phase 2** — even
+  after the lock fix, the function ran synchronously on a Tokio worker thread.
+  Wrapped in `spawn_blocking` at the call site in `run_phase_2_csharp_scip` so
+  the async runtime stays responsive while processing all C# candidates.
+- **`build_index()` in warmup and add-repo background task now use `spawn_blocking`** —
+  two sites called the CPU-heavy HNSW `build_index()` directly on async threads.
+  Both now follow the established pattern (`spawn_blocking` + `blocking_write()`).
+- **`reload_if_changed` uses `safe_canonicalize`** — replaces the raw
+  `std::fs::canonicalize` that could leave Windows `\\?\` UNC prefixes on the
+  config path, causing path comparisons to silently fail.
+- **Accurate doc-comments on `relocate_missing` / `prune_stale`** — both
+  methods perform disk I/O (filesystem traversal, git subprocess) and should
+  be called via `spawn_blocking` in async contexts; the comments now say so.
+- **`ensure_hnsw_index_if_needed` extracted and tested** — the safety-net HNSW
+  rebuild logic (detects and repairs a DB with chunks but no index, e.g. after
+  cancellation) is now a named `pub(crate)` function with 3 unit tests
+  (unindexed-with-chunks rebuilds, already-indexed is idempotent, empty DB skips).
+- **`metadata.json` schema consistency** — the normal index path now writes
+  `"partial": false` so readers always find the field regardless of whether
+  indexing completed or was cancelled.
+- **Cancellation finalisation is best-effort** — metadata write, FileMetaStore
+  save, and stats read in the cancel path now log-and-continue on failure
+  instead of propagating `Err`, so the partial chunks remain searchable even
+  if any recovery step fails.
+
+## [1.0.156] - 2026-06-02
+
+### Fixed
+
+- **`reconcile_all_paths` no longer blocks the Tokio async runtime** — the
+  function spawns git subprocesses and holds the config `RwLock` write-guard
+  while scanning the filesystem. It is now offloaded via
+  `tokio::task::spawn_blocking` so Tokio worker threads stay responsive during
+  startup reconciliation.
+- **Phase 1 auto-prune now honours `config_path_override`** — the prune path
+  wrote `repos.json` via `config.save()`, bypassing `ServeState::persist_config`.
+  All save sites in `ServeState` must route through `persist_config` so the
+  override (used in integration tests) is respected. Fixed to use
+  `self.persist_config(&config)`.
+
+
+
 ## [1.0.154] - 2026-06-02
 
 ### Fixed

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "codesearch"
-version = "1.0.154"
+version = "1.0.160"
 edition = "2021"
 authors = ["codesearch contributors"]
 license = "Apache-2.0"

src/db_discovery/repos.rs

@@ -401,10 +401,16 @@ impl ReposConfig {
     ///
     /// For each missing path a best-effort git-identity relocation is attempted
     /// ([`Self::try_relocate`]); successful matches rewrite the in-memory
-    /// `repos` map. This is pure (no disk I/O, no logging) so callers can decide
-    /// how to report and persist. Returns `(relocated, unresolved)` where
-    /// `relocated` is the list of `(alias, new_path)` rewrites and `unresolved`
-    /// is the list of aliases whose path is still missing.
+    /// `repos` map.
+    ///
+    /// **Note:** this method performs disk I/O (filesystem traversal, git
+    /// subprocess) and should not be called while holding an async lock or from
+    /// an async task without `spawn_blocking`. No logging is emitted — callers
+    /// are responsible for reporting results.
+    ///
+    /// Returns `(relocated, unresolved)` where `relocated` is the list of
+    /// `(alias, new_path)` rewrites and `unresolved` is the list of aliases
+    /// whose path is still missing.
     #[must_use]
     pub fn relocate_missing(&mut self) -> (Vec<(String, PathBuf)>, Vec<String>) {
         let aliases: Vec<String> = self.repos.keys().cloned().collect();
@@ -431,7 +437,12 @@ impl ReposConfig {
     }
 
     /// Prune stale entries: relocate what can be relocated, then unregister the
-    /// rest. Pure (no disk I/O, no logging). Returns `(relocated, removed)`.
+    /// rest.
+    ///
+    /// **Note:** this method performs disk I/O (filesystem traversal, git
+    /// subprocess) via [`Self::relocate_missing`]. No logging is emitted.
+    ///
+    /// Returns `(relocated, removed)`.
     #[must_use]
     pub fn prune_stale(&mut self) -> (Vec<(String, PathBuf)>, Vec<String>) {
         let (relocated, unresolved) = self.relocate_missing();