fix(serve): release startup maintenance from foreground resync fallbacks

The foreground resync runner's in-process branches called SyncAll or
ResyncAll directly. Both record startup reconciliation, which closes
the gate the deferred startup fallback checks, but neither releases
the startup-maintenance gate, so on a skip-initial-sync daemon the
signals and identity backfills stayed blocked until shutdown. The
direct ResyncAll call also dropped SyncThenRun's abort-to-incremental
fallback for a safely aborted resync.

Route the spawn-failure/test fallback through SyncThenRun(full=true),
matching the handler's no-runner arm, and give the worker-aborted arm
an explicit release via a helper that keeps the gate closed when the
pass was cancelled so the deferred fallback still owns recovery.

Author: wesm

cmd/agentsview/main.go

@@ -942,7 +942,9 @@ func newForegroundResyncRunner(
 					// "aborted" verdict takes this path: operational build
 					// failures report "failed" and must surface their error
 					// rather than masquerade as a successful incremental sync.
-					return engine.SyncAll(ctx, progress), nil
+					return syncAllReleasingStartupMaintenance(
+						ctx, engine, progress,
+					), nil
 				}
 				return statsFromWorkerResult(result), err
 			}
@@ -951,10 +953,34 @@ func newForegroundResyncRunner(
 					"(falling back in-process)", err,
 			)
 		}
-		return engine.ResyncAll(ctx, progress), nil
+		// SyncThenRun, not ResyncAll: it keeps the abort-to-incremental
+		// fallback for a safely aborted in-process resync and releases
+		// startup maintenance on success, matching the handler's no-runner
+		// arm (runResyncWithFallback) and the sync runner's fallback above.
+		return engine.SyncThenRun(
+			ctx, true, progress, func(bool) error { return nil },
+		)
 	}
 }
 
+// syncAllReleasingStartupMaintenance runs an incremental pass and, mirroring
+// SyncThenRun, releases startup maintenance when the pass was not cancelled.
+// SyncAll records startup reconciliation on its own but never releases the
+// maintenance gate; without the explicit release, a skip-initial-sync daemon
+// whose foreground resync took this arm would keep archive-wide backfills
+// gated until shutdown, because the deferred startup fallback observes the
+// closed reconciliation gate and returns without releasing. A cancelled pass
+// leaves the gate closed so the deferred fallback still owns recovery.
+func syncAllReleasingStartupMaintenance(
+	ctx context.Context, engine *sync.Engine, progress func(sync.Progress),
+) sync.SyncStats {
+	stats := engine.SyncAll(ctx, progress)
+	if ctx.Err() == nil {
+		engine.ReleaseStartupMaintenance()
+	}
+	return stats
+}
+
 // runWorkerResyncBuild builds a resync replacement in a worker process behind the
 // write barrier, then swaps it in and resets caches. It closes the writer for the
 // whole build-and-swap window (readers keep serving, direct writes fail with

cmd/agentsview/resync_worker_test.go

@@ -2,11 +2,15 @@ package main
 
 import (
 	"context"
+	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.kenn.io/agentsview/internal/config"
 	"go.kenn.io/agentsview/internal/db"
+	"go.kenn.io/agentsview/internal/dbtest"
 	"go.kenn.io/agentsview/internal/sync"
 )
 
@@ -32,3 +36,123 @@ func TestForegroundResyncRunnerFallsBackInProcess(t *testing.T) {
 	assert.Equal(t, 3, stats.Synced, "in-process resync fallback rebuilds the archive")
 	assert.False(t, database.NeedsResync())
 }
+
+// requireStartupMaintenanceReleased asserts that RunStartupMaintenance is no
+// longer gated: its work function must run promptly instead of blocking on the
+// startup-maintenance gate until shutdown.
+func requireStartupMaintenanceReleased(t *testing.T, engine *sync.Engine) {
+	t.Helper()
+	maintenanceRan := make(chan struct{})
+	maintenanceDone := make(chan error, 1)
+	go func() {
+		maintenanceDone <- engine.RunStartupMaintenance(
+			t.Context(), func() error {
+				close(maintenanceRan)
+				return nil
+			},
+		)
+	}()
+	select {
+	case <-maintenanceRan:
+	case <-time.After(2 * time.Second):
+		require.FailNow(t, "startup maintenance still gated after the pass")
+	}
+	require.NoError(t, <-maintenanceDone)
+}
+
+// TestForegroundResyncRunnerReleasesStartupMaintenance covers the
+// skip-initial-sync daemon shape: when the in-process fallback drives startup
+// reconciliation, it must also release the startup-maintenance gate.
+// Otherwise the deferred startup fallback sees the closed reconciliation gate,
+// returns early, and archive-wide backfills stay blocked until shutdown.
+func TestForegroundResyncRunnerReleasesStartupMaintenance(t *testing.T) {
+	cfg := testConfigWithClaudeFixture(t)
+	database, err := db.Open(cfg.DBPath)
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, database.Close()) })
+	engineCfg := workerEngineConfig(cfg)
+	engineCfg.DeferStartupMaintenance = true
+	engine := sync.NewEngine(database, engineCfg)
+	t.Cleanup(engine.Close)
+
+	runner := newForegroundResyncRunner(context.Background(), cfg, engine, database)
+	_, err = runner(context.Background(), nil)
+
+	require.NoError(t, err)
+	require.True(t, engine.StartupReconciled(),
+		"a successful in-process resync closes the reconciliation gate")
+	requireStartupMaintenanceReleased(t, engine)
+}
+
+// TestForegroundResyncRunnerAbortedResyncFallsBackIncremental verifies the
+// in-process fallback keeps SyncThenRun's abort semantics: a safely aborted
+// resync catches up with an incremental pass instead of surfacing the bare
+// abort, and startup still reconciles and releases maintenance.
+func TestForegroundResyncRunnerAbortedResyncFallsBackIncremental(t *testing.T) {
+	database := dbtest.OpenTestDB(t)
+	missingPath := filepath.Join(t.TempDir(), "missing.jsonl")
+	dbtest.SeedSession(t, database, "existing", "proj", func(s *db.Session) {
+		s.FilePath = &missingPath
+	})
+	engine := sync.NewEngine(database, sync.EngineConfig{
+		Machine:                 "local",
+		DeferStartupMaintenance: true,
+	})
+	t.Cleanup(engine.Close)
+
+	runner := newForegroundResyncRunner(
+		context.Background(), config.Config{}, engine, database,
+	)
+	stats, err := runner(context.Background(), nil)
+
+	require.NoError(t, err)
+	assert.False(t, stats.Aborted,
+		"a safely aborted resync must fall back to an incremental sync")
+	assert.True(t, engine.StartupReconciled(),
+		"the incremental fallback pass reconciles startup")
+	requireStartupMaintenanceReleased(t, engine)
+}
+
+// TestSyncAllReleasingStartupMaintenance covers the worker-aborted resync arm
+// (unreachable under a test binary): a completed incremental catch-up must
+// release the startup-maintenance gate, while a cancelled pass leaves the gate
+// closed so the deferred startup fallback still owns recovery.
+func TestSyncAllReleasingStartupMaintenance(t *testing.T) {
+	t.Run("releases after completed pass", func(t *testing.T) {
+		database := dbtest.OpenTestDB(t)
+		engine := sync.NewEngine(database, sync.EngineConfig{
+			Machine:                 "local",
+			DeferStartupMaintenance: true,
+		})
+		t.Cleanup(engine.Close)
+
+		syncAllReleasingStartupMaintenance(context.Background(), engine, nil)
+
+		requireStartupMaintenanceReleased(t, engine)
+	})
+	t.Run("keeps gate closed when cancelled", func(t *testing.T) {
+		database := dbtest.OpenTestDB(t)
+		engine := sync.NewEngine(database, sync.EngineConfig{
+			Machine:                 "local",
+			DeferStartupMaintenance: true,
+		})
+		t.Cleanup(engine.Close)
+		ctx, cancel := context.WithCancel(context.Background())
+		cancel()
+
+		syncAllReleasingStartupMaintenance(ctx, engine, nil)
+
+		maintenanceErr := make(chan error, 1)
+		blockedCtx, blockedCancel := context.WithTimeout(
+			context.Background(), 100*time.Millisecond,
+		)
+		defer blockedCancel()
+		go func() {
+			maintenanceErr <- engine.RunStartupMaintenance(
+				blockedCtx, func() error { return nil },
+			)
+		}()
+		require.ErrorIs(t, <-maintenanceErr, context.DeadlineExceeded,
+			"a cancelled pass must leave maintenance to the deferred fallback")
+	})
+}