fix: make index status crash-atomic

[andrei-hasna]

Summary

• keep the run-start marker committed for liveness, but move status='indexing' into the same SQLite transaction as file mutations and status='ready'
• classify interrupted ready and pending rows through the existing lock/timeout evidence, so dead owners self-heal without reviving never-started pending roots
• heartbeat the root lock during the write transaction
• add a child-process SIGKILL regression that exercises SQLite crash rollback against a file-backed database

Non-vacuous regression

Before the implementation change, bun test src/lib/local/wedged-index.test.ts exited 1 with 22 passing and 1 failing test: the killed child left raw status indexing where the prior ready state was expected. Existing stale/dead-owner recovery tests remained green, isolating the missing transaction boundary.

Verification

• bun test: 267 pass, 0 fail, 698 assertions across 24 files; no skips
• bun run typecheck: exit 0
• git diff --check: exit 0
• shield review: no security issues in the 3 staged files

Task: 4c551a36-4bee-4a44-854a-bd27142738b6

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Agent: Augustus

[andrei-hasna]

[REVIEW] GO — #7 @ 2943399 — lens: correctness+security+gates, reviewer unresolved-account004 (1 of 1)

Reviewed exact candidate origin/main...HEAD with origin/main at c9688b5d4025fdb0a8a076111b05fcb88b7f3d6e and HEAD at 29433998f645b9bcf6a9802f579689c551f4888a.

What I ran:

• git log --oneline origin/main..HEAD — exit 0; one commit: 2943399 fix: make index status crash-atomic.
• git diff origin/main...HEAD --stat and full per-file diffs — exit 0; 3 changed files, 131 insertions, 20 deletions.
• bun install — exit 0; setup only, 158 packages installed.
• bun run typecheck — exit 0; 0 diagnostics/failures (the typecheck gate emits no test-style pass count).
• bun run test — exit 0; 267 pass, 0 fail, 698 assertions across 24 files.

What I read:

• The full diff of src/lib/local/indexer.ts, src/lib/local/test-fixtures/crash-after-indexing-status.ts, and src/lib/local/wedged-index.test.ts.
• Surrounding indexer lock acquisition/probing/heartbeat, health classification, indexing transaction, stale recovery, and auto-refresh code.
• Query behavior in src/lib/local/find.ts, index database configuration and migrations, CLI/MCP/HTTP callers, the complete wedged-index regression suite, and the declared scripts in package.json.

Adversarial result:

• The committed start marker remains externally visible, while status='indexing' and all file/index mutations now share the same SQLite transaction. SIGKILL therefore rolls the transient status and partial mutations back together, and the surviving marker plus dead/stale lock evidence reaches the existing recovery path.
• Current-version live runs refresh the lock throughout tree scanning and mutation loops; rootHealth checks a fresh live holder before marker age, so auto-recovery does not steal a healthy run.
• The added SIGKILL regression passed, as did recovery from legacy and first-index crash states, live-lock non-stealing, PID-reuse bounds, heartbeat freshness, CLI loud-failure behavior, and normal indexing/query behavior.
• No new attacker-controlled source, authorization boundary, credential path, or dangerous sink was introduced.

Blocking P0/P1 findings: none.

Non-blocking follow-ups: none.