fix(search,ci,install): Arc-token context identity for semantic search TOCTOU safety, per-mode two-tier unavailability tracking, CI frankensearch clone, crates.io publish readiness gate

Semantic search context identity (src/search/query.rs):
- Replace string-based embedder ID comparison with Arc<()> context
  token created on each set_semantic_context call -- all
  lock-release-reacquire loops now use Arc::ptr_eq to detect context
  swaps, eliminating TOCTOU races where the context changes mid-query
  to one with an identically-named embedder
- Replace single in_memory_two_tier_init_attempted boolean with
  per-mode (fast_only / quality) unavailability tracking via
  InMemoryTwoTierUnavailable, preventing a failed quality probe from
  blocking subsequent fast-only loads
- Three new tests: stale same-ID embedding rejection, failed quality
  not poisoning fast-only, progressive context errors not permanently
  memoized

Cargo.toml metadata normalization:
- Add explicit version = "*" to all git-pinned dependencies
  (asupersync, toon, frankensqlite, frankentui crates, frankensearch,
  franken-agent-detection, fsqlite-types) -- required for crates.io
  publish compatibility

CI release workflow (.github/workflows/release.yml):
- Add missing frankensearch git clone to all three CI job steps
  (build, sign, test) so builds that depend on it as a git dependency
  succeed
- Add cargo package --locked --no-verify readiness check before
  crates.io publish, with structured warning when manifest is not
  registry-ready instead of a hard failure

Installer (install.sh):
- Drop darwin-amd64 (Intel macOS) from prebuilt targets since those
  binaries are no longer published, with specific fallback message
  instead of the generic "no prebuilt artifact" warning

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Dicklesworthstone

.github/workflows/release.yml

@@ -71,6 +71,7 @@ jobs:
           git clone --depth 1 https://github.com/Dicklesworthstone/asupersync.git ../asupersync
           git clone --depth 1 https://github.com/Dicklesworthstone/frankensqlite.git ../frankensqlite
           git clone --depth 1 https://github.com/Dicklesworthstone/franken_agent_detection.git ../franken_agent_detection
+          git clone --depth 1 https://github.com/Dicklesworthstone/frankensearch.git ../frankensearch
 
       - name: Install Rust stable
         uses: dtolnay/rust-toolchain@stable
@@ -203,6 +204,7 @@ jobs:
           git clone --depth 1 https://github.com/Dicklesworthstone/asupersync.git ../asupersync
           git clone --depth 1 https://github.com/Dicklesworthstone/frankensqlite.git ../frankensqlite
           git clone --depth 1 https://github.com/Dicklesworthstone/franken_agent_detection.git ../franken_agent_detection
+          git clone --depth 1 https://github.com/Dicklesworthstone/frankensearch.git ../frankensearch
 
       - name: Download all artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
@@ -369,18 +371,41 @@ jobs:
           git clone --depth 1 https://github.com/Dicklesworthstone/asupersync.git ../asupersync
           git clone --depth 1 https://github.com/Dicklesworthstone/frankensqlite.git ../frankensqlite
           git clone --depth 1 https://github.com/Dicklesworthstone/franken_agent_detection.git ../franken_agent_detection
+          git clone --depth 1 https://github.com/Dicklesworthstone/frankensearch.git ../frankensearch
 
       - name: Install Rust stable
         uses: dtolnay/rust-toolchain@stable
 
+      - name: Check crates.io publish readiness
+        id: publish_readiness
+        shell: bash
+        run: |
+          set +e
+          cargo package --locked --no-verify >"$RUNNER_TEMP/cargo-package.log" 2>&1
+          status=$?
+          set -e
+          if [[ "$status" -eq 0 ]]; then
+            echo "ready=true" >> "$GITHUB_OUTPUT"
+            echo "Cargo package validation passed."
+            exit 0
+          fi
+
+          echo "ready=false" >> "$GITHUB_OUTPUT"
+          echo "::warning::Skipping crates.io publish because the manifest is not registry-ready with the currently published dependency set."
+          cat "$RUNNER_TEMP/cargo-package.log"
+
       - name: Publish to crates.io
-        if: ${{ env.CARGO_REGISTRY_TOKEN != '' }}
+        if: ${{ env.CARGO_REGISTRY_TOKEN != '' && steps.publish_readiness.outputs.ready == 'true' }}
         run: cargo publish --all-features --locked
 
       - name: Warn when token is missing
         if: ${{ env.CARGO_REGISTRY_TOKEN == '' }}
         run: echo "::warning::CARGO_REGISTRY_TOKEN is not configured; skipping publish."
 
+      - name: Warn when manifest is not registry-ready
+        if: ${{ env.CARGO_REGISTRY_TOKEN != '' && steps.publish_readiness.outputs.ready != 'true' }}
+        run: echo "::warning::Crates.io publish skipped because cargo package validation failed."
+
   # ==========================================================================
   # Notify Package Managers to Update
   # ==========================================================================

Cargo.toml

@@ -14,7 +14,7 @@ anyhow = "*"
 thiserror = "*"
 tracing = "*"
 tracing-subscriber = { version = "*", features = ["env-filter", "fmt", "ansi"] }
-asupersync = { git = "https://github.com/Dicklesworthstone/asupersync", rev = "08dd31df", features = ["test-internals", "tls-native-roots"] }
+asupersync = { version = "*", git = "https://github.com/Dicklesworthstone/asupersync", rev = "08dd31df", features = ["test-internals", "tls-native-roots"] }
 clap = { version = "*", features = ["derive", "cargo", "env", "unicode", "wrap_help"] }
 clap_complete = "*"
 clap_mangen = "*"
@@ -23,7 +23,7 @@ console = "*"
 colored = "*"
 serde = { version = "*", features = ["derive"] }
 serde_json = "*"
-toon = { git = "https://github.com/Dicklesworthstone/toon_rust", rev = "bc3f9da", package = "tru" }
+toon = { version = "*", git = "https://github.com/Dicklesworthstone/toon_rust", rev = "bc3f9da", package = "tru" }
 tempfile = "*"
 rmp-serde = "*"  # MessagePack for binary metadata serialization (Opt 3.1)
 toml = "*"
@@ -32,7 +32,7 @@ which = "*"
 shell-words = "*"
 dotenvy = "*"
 notify = "*"
-frankensqlite = { git = "https://github.com/Dicklesworthstone/frankensqlite", rev = "9cedb30b", package = "fsqlite", features = ["fts5"] }
+frankensqlite = { version = "*", git = "https://github.com/Dicklesworthstone/frankensqlite", rev = "9cedb30b", package = "fsqlite", features = ["fts5"] }
 rayon = "*"
 crossbeam-channel = "*"
 parking_lot = "*"
@@ -44,10 +44,10 @@ regex = "*"
 portable-pty = "*"
 # FrankenTUI migration foundation (bead 2noh9.2.1).
 # Strategy: pin a Git revision for reproducible CI builds.
-ftui = { git = "https://github.com/Dicklesworthstone/frankentui", rev = "7a91089" }
-ftui-runtime = { git = "https://github.com/Dicklesworthstone/frankentui", rev = "7a91089", features = ["native-backend", "crossterm-compat"] }
-ftui-tty = { git = "https://github.com/Dicklesworthstone/frankentui", rev = "7a91089" }
-ftui-extras = { git = "https://github.com/Dicklesworthstone/frankentui", rev = "7a91089", default-features = false, features = ["markdown", "syntax", "charts", "canvas", "theme", "clipboard", "clipboard-fallback", "export", "visual-fx", "forms", "validation", "help"] }
+ftui = { version = "*", git = "https://github.com/Dicklesworthstone/frankentui", rev = "7a91089" }
+ftui-runtime = { version = "*", git = "https://github.com/Dicklesworthstone/frankentui", rev = "7a91089", features = ["native-backend", "crossterm-compat"] }
+ftui-tty = { version = "*", git = "https://github.com/Dicklesworthstone/frankentui", rev = "7a91089" }
+ftui-extras = { version = "*", git = "https://github.com/Dicklesworthstone/frankentui", rev = "7a91089", default-features = false, features = ["markdown", "syntax", "charts", "canvas", "theme", "clipboard", "clipboard-fallback", "export", "visual-fx", "forms", "validation", "help"] }
 dirs = "*"
 walkdir = "*"
 glob = "*"
@@ -69,8 +69,8 @@ half = { version = "*", features = ["bytemuck"] }
 memmap2 = "*"
 bytemuck = "*"
 fastembed = { version = "*", default-features = false, features = ["ort-download-binaries-rustls-tls"] }
-frankensearch = { git = "https://github.com/Dicklesworthstone/frankensearch", rev = "9961c0e7", default-features = false, features = ["hash", "lexical", "ann", "fastembed-reranker"] }
-franken-agent-detection = { git = "https://github.com/Dicklesworthstone/franken_agent_detection", rev = "ba9c598", features = ["connectors", "cursor", "chatgpt", "opencode", "crush"] }
+frankensearch = { version = "*", git = "https://github.com/Dicklesworthstone/frankensearch", rev = "9961c0e7", default-features = false, features = ["hash", "lexical", "ann", "fastembed-reranker"] }
+franken-agent-detection = { version = "*", git = "https://github.com/Dicklesworthstone/franken_agent_detection", rev = "ba9c598", features = ["connectors", "cursor", "chatgpt", "opencode", "crush"] }
 wide = "*"  # Portable SIMD for P0 Opt 2: SIMD dot product
 arrayvec = "*"  # Stack-based arrays for P1 Opt 1.4: Edge N-gram optimization
 bloomfilter = "*"  # Probabilistic membership testing for P2 Opt 3.3: Workspace Cache
@@ -138,7 +138,7 @@ rand = "0.10"
 rand_chacha = "0.10"
 # frankensqlite compat gate tests (bead 3vvqa) — fsqlite-types needed for SqliteValue
 # enum variants in test assertions. The main fsqlite dep is available as `frankensqlite`.
-fsqlite-types = { git = "https://github.com/Dicklesworthstone/frankensqlite", rev = "9cedb30b", package = "fsqlite-types" }
+fsqlite-types = { version = "*", git = "https://github.com/Dicklesworthstone/frankensqlite", rev = "9cedb30b", package = "fsqlite-types" }
 
 [[bin]]
 name = "cass"

install.sh

@@ -190,10 +190,11 @@ esac
 
 TARGET=""
 EXT="tar.gz"
+NO_PREBUILT_REASON=""
 case "${OS}-${ARCH}" in
   linux-amd64) TARGET="linux-amd64" ;;
   linux-arm64) TARGET="linux-arm64" ;;
-  darwin-amd64) TARGET="darwin-amd64" ;;
+  darwin-amd64) NO_PREBUILT_REASON="Intel macOS release binaries are not published" ;;
   darwin-arm64) TARGET="darwin-arm64" ;;
   mingw*-amd64|msys*-amd64|cygwin*-amd64) TARGET="windows-amd64"; EXT="zip" ;;
   *) :;;
@@ -210,7 +211,11 @@ if [ "$FROM_SOURCE" -eq 0 ]; then
     TAR="cass-${TARGET}.${EXT}"
     URL="https://github.com/${OWNER}/${REPO}/releases/download/${VERSION}/${TAR}"
   else
-    warn "No prebuilt artifact for ${OS}/${ARCH}; falling back to build-from-source"
+    if [ -n "$NO_PREBUILT_REASON" ]; then
+      warn "$NO_PREBUILT_REASON; falling back to build-from-source"
+    else
+      warn "No prebuilt artifact for ${OS}/${ARCH}; falling back to build-from-source"
+    fi
     FROM_SOURCE=1
   fi
 fi