Post-0.64 batch 3

.alfonso/release-notes/next/cross-repo-search-index-store.md

@@ -0,0 +1 @@
+Cross-repository search keeps published index-store reads and the bounded unpublished-pattern fallback while removing unused unbounded trigram builds and comparisons of saved trigram indexes against files on disk.

.alfonso/release-notes/next/issue-1425.md

@@ -0,0 +1 @@
+Rust diagnostics now handle literal `concat!` include paths and local fixture macros with literal arguments. Unresolved includes name their source file. Thanks @elmagow. (#1425)

.alfonso/release-notes/next/issue-1428.md

@@ -0,0 +1 @@
+Shared temporary folders no longer start project watchers, indexing, or language-server discovery, regardless of how they are mounted. Projects in their subfolders still work normally. Index builds now skip unreadable folders, report the coverage gap, and retry them on the next rescan instead of failing the whole build.

.alfonso/release-notes/next/linux-shell-oom-priority.md

@@ -0,0 +1 @@
+Linux agent shell commands now raise their OOM kill priority to protect AFT and desktop sessions during memory pressure (#750).

.alfonso/release-notes/next/live-secret-vault.md

@@ -0,0 +1 @@
+Shell `{{ck-secret:<label>}}` placeholders now use the live vault over AFT's authenticated daemon route. Each HTTPS request is checked against its real host and path; released keys are inserted only at the vault's designated location and are never reused to authorize another request. Requests needing phone approval share the same pending vault request's card, with one 10-minute deadline across all labels in each HTTP request. Cancelling the last waiter withdraws its card. URL fetches also ask per request and redirect, and never retry a credential-bearing send. Standalone use remains fail-closed, and keys stay out of command output, task logs and status replies.

.alfonso/release-notes/next/lsp-applicability-walks.md

@@ -0,0 +1 @@
+- Coalesce per-root language-server applicability walks with a short settle window and one follow-up for changes received during a walk.

.alfonso/release-notes/next/manifest-vault-sync.md

@@ -0,0 +1 @@
+AFT now synchronizes signed GitHub routing manifests from the vault and reports the gh shim's activation verdict in daemon health.

.alfonso/release-notes/next/pr-read-thread-state.md

@@ -0,0 +1 @@
+Pull-request reads now show review-thread IDs and open/resolved state, with explicit warnings when thread state is unavailable, incomplete, or cached.

.alfonso/release-notes/next/protected-folder-and-pty-exit-text.md

@@ -0,0 +1,2 @@
+- Protected CortexKit module data, module state, and AFT storage refusals explain why file tools cannot open them and which commands to use instead.
+- PTY tasks with lost exit status report exit status unknown without an exit code; real kills keep their status and reason.

.alfonso/release-notes/next/redact-inline-passwords.md

@@ -0,0 +1 @@
+Shell command logs and issue reports now mask inline passwords named `PW` or `PASS` and secret-shaped assignment values.

.alfonso/release-notes/next/release-debug-symbols.md

@@ -0,0 +1 @@
+Release downloads now include matching Linux debug-symbol and Windows PDB archives for symbolizing production stack traces without enlarging installed packages.

.alfonso/release-notes/next/rerank-prepare.md

@@ -0,0 +1 @@
+- Search prepares matching-line text only when needed, reducing concurrent rerank CPU without changing results.

.alfonso/release-notes/next/search-bounded-reads.md

@@ -0,0 +1 @@
+Keep status and configuration responsive while grep searches large files.

.alfonso/release-notes/next/self-diagnosis-snapshot.md

@@ -0,0 +1 @@
+- AFT self-diagnosis now uses complete root evidence and each snapshot part's freshness window, so large heaps and size-trimmed health reports do not produce spurious unknown findings.

.alfonso/release-notes/next/status-push-cost.md

@@ -0,0 +1 @@
+Status pushes avoid checkpoint mutation locks, meaning-store rebuilds and compression scans, and sample physical index-store size in the background.

.alfonso/release-notes/next/status-unknown-checkpoints.md

@@ -0,0 +1 @@
+Show unknown checkpoint counts as — in status dialogs.

.alfonso/release-notes/next/task-metadata-writes.md

@@ -0,0 +1 @@
+Skip repeated background-task metadata writes and fsyncs when persisted fields and their durability requirements have not changed.

.alfonso/release-notes/next/test-gate-loops.md

@@ -0,0 +1 @@
+Test shell commands waiting for release files now stop when their parent directory disappears or their deadline expires, preventing orphaned polling processes.

.alfonso/release-notes/next/worker-pty-handback.md

@@ -0,0 +1 @@
+A worker's interactive (pty) shell command answers with its task id at once instead of waiting until it ends.

.github/workflows/_unit-suite.yml

@@ -337,6 +337,32 @@ jobs:
           SUBC_CORE_BIN: ${{ steps.subc_core.outputs.path }}
           SUBC_CORE_WIRE_VERSION: "2"
 
+  unit-linux-real-daemon:
+    name: Real-daemon tool-provider tests (Linux)
+    if: ${{ github.event_name != 'pull_request' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 19
+    env:
+      SCCACHE_GHA_ENABLED: "true"
+      RUSTC_WRAPPER: sccache
+      CARGO_INCREMENTAL: "0"
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
+        continue-on-error: true
+      - name: Start compiler cache (fall back to uncached)
+        shell: bash
+        run: bash scripts/ci-sccache-start.sh
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+        with:
+          shared-key: unit-linux-real-daemon
+          cache-on-failure: true
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - uses: ./.github/actions/setup-nextest
+      - name: Run ignored real-daemon tool-provider tests
+        run: bash scripts/ci-real-daemon-tests.sh
+
   plugin-e2e-linux:
     name: Plugin e2e (${{ matrix.suite }}, Linux)
     if: ${{ github.event_name != 'pull_request' }}

.github/workflows/release.yml

@@ -441,7 +441,22 @@ jobs:
       # Use gnu target (not musl) so dlopen works for ONNX Runtime loading.
       # musl produces static binaries where dlopen is a stub that always fails.
       - name: Build
-        run: cross build --release --target aarch64-unknown-linux-gnu
+        # Keep line tables only until objcopy detaches them below; shipped code
+        # and optimization settings are unchanged.
+        run: cross build --release --target aarch64-unknown-linux-gnu --config 'profile.release.strip=false' --config 'profile.release.split-debuginfo="off"'
+
+      - name: Install ARM64 debug extraction tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends -y binutils-aarch64-linux-gnu
+      - name: Split and verify Linux debug symbols
+        run: python3 scripts/release-debug-symbols.py linux --binary target/aarch64-unknown-linux-gnu/release/aft --objcopy aarch64-linux-gnu-objcopy --archive release-debug/aft-linux-arm64-debug.zip
+      - uses: actions/upload-artifact@v4
+        with:
+          name: linux-arm64-debug
+          retention-days: ${{ github.event_name == 'schedule' && 2 || 90 }}
+          path: release-debug/aft-linux-arm64-debug.zip
+          if-no-files-found: error
 
       - uses: actions/upload-artifact@v4
         with:
@@ -484,7 +499,16 @@ jobs:
       # Use gnu target (not musl) so dlopen works for ONNX Runtime loading.
       # musl produces static binaries where dlopen is a stub that always fails.
       - name: Build
-        run: cross build --release --target x86_64-unknown-linux-gnu
+        run: cross build --release --target x86_64-unknown-linux-gnu --config 'profile.release.strip=false' --config 'profile.release.split-debuginfo="off"'
+
+      - name: Split and verify Linux debug symbols
+        run: python3 scripts/release-debug-symbols.py linux --binary target/x86_64-unknown-linux-gnu/release/aft --archive release-debug/aft-linux-x64-debug.zip
+      - uses: actions/upload-artifact@v4
+        with:
+          name: linux-x64-debug
+          retention-days: ${{ github.event_name == 'schedule' && 2 || 90 }}
+          path: release-debug/aft-linux-x64-debug.zip
+          if-no-files-found: error
 
       - name: Bundle shipped Linux binary
         id: bundle
@@ -601,7 +625,8 @@ jobs:
           }
 
       - name: Build
-        run: cargo build --release --target aarch64-pc-windows-msvc
+        # MSVC keeps debug info in a PDB, not in the shipped executable.
+        run: cargo build --release --target aarch64-pc-windows-msvc --config 'profile.release.strip=false'
         env:
           CARGO_TARGET_DIR: ${{ env.AFT_CI_TARGET_DIR }}
 
@@ -616,6 +641,16 @@ jobs:
             throw "Staged release binary differs from the compiled bytes"
           }
 
+      - name: Verify and package Windows PDB
+        shell: pwsh
+        run: python scripts/release-debug-symbols.py windows --binary target/aarch64-pc-windows-msvc/release/aft.exe --pdb "$env:AFT_CI_TARGET_DIR/aarch64-pc-windows-msvc/release/aft.pdb" --archive release-debug/aft-windows-arm64-pdb.zip
+      - uses: actions/upload-artifact@v4
+        with:
+          name: windows-arm64-pdb
+          retention-days: ${{ github.event_name == 'schedule' && 2 || 90 }}
+          path: release-debug/aft-windows-arm64-pdb.zip
+          if-no-files-found: error
+
       - uses: actions/upload-artifact@v4
         with:
           name: win32-arm64
@@ -685,13 +720,13 @@ jobs:
         shell: pwsh
 
       - name: Release library codegen (shipped profile)
-        run: cargo build --release --lib --target x86_64-pc-windows-msvc -p agent-file-tools --timings
+        run: cargo build --release --lib --target x86_64-pc-windows-msvc -p agent-file-tools --timings --config 'profile.release.strip=false'
         shell: pwsh
         env:
           CARGO_TARGET_DIR: ${{ env.AFT_CI_TARGET_DIR }}
 
       - name: Build
-        run: cargo build --release --bin aft --target x86_64-pc-windows-msvc -p agent-file-tools --timings
+        run: cargo build --release --bin aft --target x86_64-pc-windows-msvc -p agent-file-tools --timings --config 'profile.release.strip=false'
         shell: pwsh
         env:
           CARGO_TARGET_DIR: ${{ env.AFT_CI_TARGET_DIR }}
@@ -707,6 +742,16 @@ jobs:
             throw "Staged release binary differs from the compiled bytes"
           }
 
+      - name: Verify and package Windows PDB
+        shell: pwsh
+        run: python scripts/release-debug-symbols.py windows --binary target/x86_64-pc-windows-msvc/release/aft.exe --pdb "$env:AFT_CI_TARGET_DIR/x86_64-pc-windows-msvc/release/aft.pdb" --archive release-debug/aft-windows-x64-pdb.zip
+      - uses: actions/upload-artifact@v4
+        with:
+          name: windows-x64-pdb
+          retention-days: ${{ github.event_name == 'schedule' && 2 || 90 }}
+          path: release-debug/aft-windows-x64-pdb.zip
+          if-no-files-found: error
+
       # Execute the exact bytes being published once on Windows.
       - name: Smoke-test binary
         run: target/x86_64-pc-windows-msvc/release/aft.exe --version
@@ -1393,6 +1438,18 @@ jobs:
         with:
           name: win32-arm64
           path: artifacts/win32-arm64
+      - name: Download Linux debug symbols
+        uses: actions/download-artifact@v4
+        with:
+          pattern: linux-*-debug
+          path: release-assets
+          merge-multiple: true
+      - name: Download Windows PDBs
+        uses: actions/download-artifact@v4
+        with:
+          pattern: windows-*-pdb
+          path: release-assets
+          merge-multiple: true
 
       - name: Verify tested macOS binary for release
         run: python3 scripts/native-release-artifact.py unpack-published --target aarch64-apple-darwin --archive "$RUNNER_TEMP/tested-darwin-arm64/release.tar" --binary release-assets/aft-darwin-arm64 --dsym release-assets/aft-darwin-arm64-dsym.zip

benchmarks/aft-search/slice-descriptors/alfonso-task-bg_bbb97ce9a9634cf6-aft-search-on-another-repository-uses-the-index-.json

@@ -0,0 +1,13 @@
+{
+  "slice_class": "engine_unwired",
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "fixtures": [
+    "crates/aft/tests/integration/tool_call_parity_test.rs",
+    "crates/aft/src/commands/semantic_search/external_disk_check.rs",
+    "crates/aft/src/commands/semantic_search/mod.rs",
+    "crates/aft/src/search_index.rs",
+    "crates/aft/src/semantic_index.rs"
+  ],
+  "note": "Remove the unused unbounded legacy trigram builder, capped lexical-ranking API, memory accounting, saved-index reconciliation and its semantic recorded-stat accessor. Published external repositories already use ExternalSearch's index-store checkout at this base. Preserve unpublished external plain-query walks and the bounded explicit-pattern/query+pattern corpus; specialize its disk collector to the empty corpus its sole production caller supplies. Candidate selection, score formulas, source-first admission, deadlines and public coverage fields remain unchanged. Remove constant-None legacy snapshot branches from ranking and glob. The 300-query interleaved cross-repository replay uses a frozen second AFT checkout; ranked paths and counts must remain identical. No ranking or count difference is waived. Full legacy module deletion is deferred because changing the unpublished pattern fallback requires a separate design decision."
+}

benchmarks/aft-search/slice-descriptors/ci-speed-post064-batch-3.json

@@ -0,0 +1,114 @@
+{
+  "slice_class": "engine_unwired",
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "fixtures": [
+    "crates/aft/src/commands/semantic_search/external_disk_check.rs",
+    "crates/aft/src/commands/semantic_search/external_pattern.rs",
+    "crates/aft/src/commands/semantic_search/mod.rs",
+    "crates/aft/src/commands/semantic_search/snippet_bounds.rs",
+    "crates/aft/src/lib.rs",
+    "crates/aft/src/search_index.rs",
+    "crates/aft/src/semantic_index.rs",
+    "crates/aft/tests/integration/tool_call_parity_test.rs"
+  ],
+  "slices": [
+    "rerank-line-prefilter",
+    "cross-repo-search-index-store",
+    "deferred-standalone-grep",
+    "status-push-cost"
+  ],
+  "note": "Combined post-0.64 batch 3 integration, based on batch 2's tip 398e5549aeaa (main 9b505ee5 has the same tree). Copied the engine_unwired descriptor class and the inherited reference pattern-count declarations from ci-speed-post064-batch-2.json. Ranking-fenced changes: semantic_search/mod.rs scans a phrase's first word in raw line bytes before normalizing a line during rerank (exact because normalization only collapses whitespace and ASCII-lowercases, proven on 400 random mixed-script sources); external_pattern.rs and external_disk_check.rs serve another repository's search from the index store instead of the deleted in-memory text index; search_index.rs and semantic_index.rs lose that in-memory index; telemetry.rs adds status-cost probes; lib.rs module declarations. No routing, candidate selection, score, range or ranked rendering change is intended. Evidence: the rerank change replayed all 6,897 recorded query lines with byte-identical rankings, scores, snippets and counts; the cross-repository change replayed 300 queries identically. The pattern_counts below remain only the pre-0.64 reference transitions already declared by batch 1 and batch 2; they grant no new difference.",
+  "pattern_counts": {
+    "followup-census:910002": {
+      "candidate_files": {
+        "before": 3,
+        "after": 6
+      },
+      "files_examined": {
+        "before": 3,
+        "after": 6
+      }
+    },
+    "followup-census:910003": {
+      "candidate_files": {
+        "before": 972,
+        "after": 860
+      },
+      "files_examined": {
+        "before": 972,
+        "after": 860
+      }
+    },
+    "followup-census:910004": {
+      "candidate_files": {
+        "before": 972,
+        "after": 860
+      },
+      "files_examined": {
+        "before": 972,
+        "after": 860
+      }
+    },
+    "followup-census:910005": {
+      "candidate_files": {
+        "before": 194,
+        "after": 141
+      },
+      "files_examined": {
+        "before": 194,
+        "after": 141
+      }
+    },
+    "followup-census:910010": {
+      "candidate_files": {
+        "before": 6,
+        "after": 19
+      },
+      "files_examined": {
+        "before": 6,
+        "after": 19
+      }
+    },
+    "followup-census:910011": {
+      "candidate_files": {
+        "before": 942,
+        "after": 729
+      },
+      "files_examined": {
+        "before": 942,
+        "after": 729
+      }
+    },
+    "followup-census:910012": {
+      "candidate_files": {
+        "before": 1031,
+        "after": 730
+      },
+      "files_examined": {
+        "before": 1031,
+        "after": 730
+      }
+    },
+    "followup-census:910013": {
+      "candidate_files": {
+        "before": 908,
+        "after": 45
+      },
+      "files_examined": {
+        "before": 908,
+        "after": 45
+      }
+    },
+    "followup-census:910014": {
+      "candidate_files": {
+        "before": 1011,
+        "after": 24
+      },
+      "files_examined": {
+        "before": 1011,
+        "after": 24
+      }
+    }
+  }
+}