Projects on machines without working Git stay indexable with a stable identity, and a locked or busy aft.db no longer fails configure. Failed standing checks back off instead of probing Git every 250 ms, and backup repair and storage cleanup are safer.
Index identity
The first bound identity (path or verified Git) is persisted per canonical root and reused across restarts and aliases; broken Git can't downgrade it, and unreadable or conflicting records are refused.
Stored Git identities are revalidated under the root lock so a replaced repository gets its own verified identity, and a non-repository replacement can't resurrect a legacy committed-repository memo.
Identity stamps advance only from fresh verified Git answers; uncertain results keep the older certificate.
Idle standing passes reuse unchanged repository metadata instead of walking Git history every 250 ms; directory/HEAD evidence changes and real binds still verify.
A provisional session claims its own standing entry by folder, so standing ticks no longer re-derive a Git key; when the identity retry settles, the replayed bind claims standing entries by the settled key and pauses a sibling checkout that would otherwise publish into the same family.
Borrowed search, semantic, callgraph, symbol-loader and view readers resolve through the saved identity records without writing, so adding Git later still finds the existing index; repository replacement invalidates them.
Configured writers and migration publish under the saved key matching the legacy base derivation, so later Git builds and upgrades keep one index family; the configure memo is keyed by (storage root, path), and memo hits also refresh the root-only artifact-key cache so returning to a previous storage keeps the correct key.
Legacy Git memos are imported into the new records, and health checks observe them without creating or modifying records.
Configure reads the legacy aft.db pin with zero busy wait or skips it when a saved identity record exists; an unreadable pin makes the bind provisional with all indexes and views off. A bounded background retry replays the bind once the database frees, submitted with a route bind's admission and cancelled when the root unbinds, so reads never see a half-published configure. The retry settles only from the last committed configure's published state, and a provisional root caches no Git-only key, so a standing pass between attempts can't drop the retry or pin the wrong key.
Retries and cleanup
Failed standing-root checks back off from 60 seconds to a 15-minute cap; new binds or changed roots retry immediately.
Backup repair retries partial repairs without replacing conflicts or moving active stacks and shares namespace admission while waiting on file leases.
Legacy backup migration is deferred while namespace admission is held, retried after a repair, and bounded to once per namespace.
Storage cleanup requires stable volume identity or a proven boot anchor before reclaiming a missing checkout's data.
SQLite databases within 12 characters of the Windows path limit open in \\?\ long-path form, so deep standing-subtree callgraph stores don't fail on journal or WAL sidecars.
Confidence Score: 5/5
The PR appears safe to merge; no new actionable failures were found.
Summary
The PR saves stable root identities, keeps borrowed readers and writers on matching keys, retries busy-database binds, and strengthens backup repair and storage cleanup.
AFT keeps each project’s artifact key tied to its saved path or Git identity.
A busy identity database delays indexes until the project can bind safely.
Standing-root checks reuse stable identity evidence and back off after failures.
Backup repair moves legacy history safely and retries unfinished migrations.
Storage cleanup checks volume evidence before reclaiming a missing checkout’s data.
Long Windows database paths leave room for SQLite sidecar files.
All supplied earlier threads were marked resolved without explanatory replies. The current code contains the corresponding fixes. No new actionable issues were found.
Diagram
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Database path] --> B[sqlite_open_path]
B --> C{Long Windows path?}
C -->|Yes| D[Use absolute verbatim path]
C -->|No| E[Keep original path]
D --> F[Open writer]
E --> F
D --> G[Encode read-only URI]
E --> G
G --> H[Open callgraph reader]
