[puretensor]

Fixes from a max-effort review of #10 (index lock, fail-closed vault switch, purge debt).

Fixes

• A stale watch could revert a failed or interrupted --rebuild. A model or vault mismatch was allowed whenever the index held 0 files. A --rebuild that emptied the index and then failed or was cut short before its first write left it at 0 files. A puremind watch waiting on the lock with the old model or vault could then claim the index, clear it and index it again with the old model. That contradicts the CHANGELOG. Also, clear() and the set_meta("embedder", …) calls ran in separate transactions, so a crash between them left the old identity on an emptied index.
  • Store.clear(meta) now records the new model, root and a rebuild_pending marker in the transaction that empties the index. Only a run that visits every note removes the marker.
  • While the marker is set, a mismatched run is refused even on an empty index. An index that is empty for any other reason still takes a new model without --rebuild, as in v0.1.4.
• A successful Store.purge() left the -wal non-empty (8 KB), because the debt DELETE was committed after the checkpoint. That defeats _open_read_only's immutable fallback. purge() now checkpoints again after clearing the debt.
• Runs with purge=False that inherited debt used to checkpoint on every run. They also logged "text deleted or replaced in this run stays in -wal" even when nothing changed. Such a run now checkpoints only if it removed or replaced text itself, and purge_deferred still reports the debt.
• compact() in cmd_watch reset owed_since even when a reader kept the purge from finishing. It now keeps the timer running while the debt remains.
• test_a_failed_vault_switch_leaves_no_old_content could not fail. Its asserts inside the embed hook were wrapped into the EmbedderError the test expects. The hook now records what it sees, and the test asserts on that after the raise. A mutation that moves the clear after embedding now fails the test.
• Cleanup: one _put_meta helper shared by set_meta and clear.

Tests

• New regression tests:
  • a stale run cannot take back an unfinished rebuild (model and vault cases);
  • an index emptied by a finished rebuild still takes a new model;
  • a deferring run that changed nothing does not checkpoint or warn;
  • the -wal is 0 bytes after a purging run.
• Each new test fails on main and passes here.
• Full suite: 720 passed, 19 skipped. The permission tests skip when run as root.
• ruff check is clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KNcv9ZmzjUZyZT2Xk6i6mj

[puretensor]

Closing as superseded by #12, which merged to main as squash commit 36f04a7. #12 makes every change this PR makes: the REBUILD_PENDING marker written atomically through clear(meta=...), _put_meta/delete_meta, the second checkpoint in purge(), deferring runs that checkpoint only when they removed or updated text, compact() keeping owed_since, and the vault-switch test fix. The HAL PR sweep (2026-11-04) copied this PR's new tests unchanged into #12's tree, and all of them pass there. #12 also fixes this PR's Important finding F1: the rebuild marker is now cleared only after a clean scan (if not scan.errors), so a stale watch can no longer take the index back after a rebuild whose directories could not be listed. It also covers F2 (_one_line(str(exc)) in cmd_watch), the <db>.lock dot-file name collision, compaction outside the run lock, the root-owned lock file, and LOCK_UN at fork. After #12 this PR conflicts in 6 files, and both claim v0.2.0. The branch is kept.