@@ -1,4 +1,4 @@
-import ts from '@typescript/typescript6'
+import type ts from '@typescript/typescript6'
 import { DocCompileUserError } from '@/lib/uploads/documents/compile-error'
 
 export type DocumentSourceLanguage = 'javascript' | 'python'
@@ -16,17 +16,25 @@ interface SourceToken {
 }
 
 const FILE_HELPERS = new Set(['getFileBase64', 'addImage', 'drawImage', 'input_path'])
+const INPUT_PATH_PREFIX = '/home/user/inputs/'
+/**
+ * Every reference is a token whose raw source text is a helper name or starts with the input
+ * path, so a source containing none of these substrings has no references and is never parsed.
+ */
+const REFERENCE_MARKERS = [...FILE_HELPERS, INPUT_PATH_PREFIX]
 
 function* javascriptTokens(source: string): Generator<SourceToken> {
+  // The compiler is large and most sources carry no reference, so it loads on first parse.
+  const typescript = require('@typescript/typescript6') as typeof ts
   const fileName = 'document.js'
-  const sourceFile = ts.createSourceFile(
+  const sourceFile = typescript.createSourceFile(
     fileName,
     source,
-    ts.ScriptTarget.Latest,
+    typescript.ScriptTarget.Latest,
     true,
-    ts.ScriptKind.JS
+    typescript.ScriptKind.JS
   )
-  const program = ts.createProgram(
+  const program = typescript.createProgram(
     [fileName],
     { allowJs: true, noLib: true, noResolve: true },
     {
@@ -44,14 +52,16 @@ function* javascriptTokens(source: string): Generator<SourceToken> {
   )
   const diagnostic = program.getSyntacticDiagnostics(sourceFile)[0]
   if (diagnostic) {
-    throw new DocCompileUserError(ts.flattenDiagnosticMessageText(diagnostic.messageText, '\n'))
+    throw new DocCompileUserError(
+      typescript.flattenDiagnosticMessageText(diagnostic.messageText, '\n')
+    )
   }
 
   const pending: ts.Node[] = [sourceFile]
   while (pending.length > 0) {
     const node = pending.pop()
     if (!node) break
-    if (ts.isStringLiteralLike(node)) {
+    if (typescript.isStringLiteralLike(node)) {
       const start = node.getStart(sourceFile) + 1
       yield { kind: 'string', value: source.slice(start, node.end - 1), start }
       continue
@@ -62,7 +72,7 @@ function* javascriptTokens(source: string): Generator<SourceToken> {
     } else {
       const start = node.getStart(sourceFile)
       yield {
-        kind: ts.isIdentifier(node) ? 'word' : 'punctuation',
+        kind: typescript.isIdentifier(node) ? 'word' : 'punctuation',
         value: source.slice(start, node.end),
         start,
       }
@@ -165,6 +175,7 @@ export function* iterateDocumentFileReferences(
   source: string,
   language: DocumentSourceLanguage
 ): Generator<DocumentFileReference> {
+  if (!REFERENCE_MARKERS.some((marker) => source.includes(marker))) return
   const previous: SourceToken[] = []
   for (const token of language === 'javascript' ? javascriptTokens(source) : pythonTokens(source)) {
     if (token.kind === 'string') {
@@ -185,7 +196,7 @@ export function* iterateDocumentFileReferences(
           ? token.value
           : undefined)
       if (fileId) {
-        const start = token.start + (path ? '/home/user/inputs/'.length : 0)
+        const start = token.start + (path ? INPUT_PATH_PREFIX.length : 0)
         yield { fileId, start, end: start + fileId.length }
       }
     }
 
@@ -1,13 +1,13 @@
 import type { Principal } from '@sim/auth/principal'
-import { db } from '@sim/db'
 import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
 import { generateRequestId } from '@/lib/core/utils/request'
 import type { WorkspaceFileRecord } from '@/lib/uploads/contexts/workspace'
 import {
   downloadServableFileFromStorage,
   type ServableFile,
 } from '@/lib/uploads/utils/file-utils.server'
-import { markFileSearchArtifactReadyInTx } from '@/lib/workspace-files/search/artifact-ready'
+import { requeueFileSearchForRenderedArtifact } from '@/lib/workspace-files/search/artifact-ready'
 
 const logger = createLogger('FetchServableWorkspaceFileBuffer')
 
@@ -45,8 +45,8 @@ export async function fetchAuthorizedServableWorkspaceFileBuffer(
       (file) => file.contentUpdatedAt && ['workspace', 'test', 'changelog'].includes(file.context)
     ) !== false
   ) {
-    await db.transaction((tx) =>
-      markFileSearchArtifactReadyInTx(tx, {
+    try {
+      await requeueFileSearchForRenderedArtifact({
         owner: { entityType: 'workspace', entityId: fileRecord.workspaceId },
         file: {
           fileId: fileRecord.id,
@@ -64,7 +64,12 @@ export async function fetchAuthorizedServableWorkspaceFileBuffer(
         }),
         artifactKey,
       })
-    )
+    } catch (error) {
+      logger.warn('Could not requeue file search for a rendered artifact', {
+        fileId: fileRecord.id,
+        error: getErrorMessage(error),
+      })
+    }
   }
   return result
 }
@@ -1,6 +1,5 @@
 import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
 import { dbChainMockFns, queueTableRows, resetDbChainMock } from '@sim/testing/mocks/database.mock'
-import { projectMembershipMock } from '@sim/testing/mocks/project-membership.mock'
 import { schemaMock } from '@sim/testing/mocks/schema.mock'
 import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/workspace-authz.mock'
 import {
@@ -19,7 +18,6 @@ const hoisted = vi.hoisted(() => ({
 }))
 vi.mock('@sim/platform-authz/workspace', () => workspaceAuthzMock)
 vi.mock('@/lib/uploads/contexts/workspace', () => workspaceUploadsMock)
-vi.mock('@/lib/projects/membership', () => projectMembershipMock)
 vi.mock('@/lib/workspace-files/search/repository', async (importOriginal) => ({
   ...(await importOriginal<typeof import('@/lib/workspace-files/search/repository')>()),
   searchFileIndex: hoisted.search,
 
@@ -4,8 +4,6 @@ import { getPostgresErrorCode } from '@sim/utils/errors'
 import { and, eq, isNull } from 'drizzle-orm'
 import { admitEach, mustClassifyContent } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
-import { acquirePermissionGroupOrgLock } from '@/lib/permission-groups/locks'
-import { lockWorkspaceProject } from '@/lib/projects/membership'
 import { listFileFolders, loadActiveWorkspaceContext } from '@/lib/uploads/contexts/workspace'
 import { authorizeWorkspaceFileAccess } from '@/lib/workspace-files/application/authorization'
 import { defineAuthorizedWorkspaceFileUseCase } from '@/lib/workspace-files/application/authorized-workspace-file-use-case'
@@ -102,56 +100,66 @@ export const searchWorkspaceFileContent = defineAuthorizedWorkspaceFileUseCase({
           })
         return toWorkspaceFileSearchResult(result)
       }
-      const provenance = await db.transaction(async (tx) => {
-        await lockWorkspaceProject(tx, context.workspaceId)
-        const [current] = await tx
-          .select({
-            workspaceId: workspace.id,
-            billedAccountUserId: workspace.billedAccountUserId,
-            workspaceOrganizationId: workspace.organizationId,
-            allowPersonalApiKeys: workspace.allowPersonalApiKeys,
+      // One repeatable-read snapshot keeps the folder scope and file rows consistent with each other.
+      // Admission runs after commit, so row or advisory locks would fence nothing.
+      const delivery = await db.transaction(
+        async (tx) => {
+          const [current] = await tx
+            .select({
+              workspaceId: workspace.id,
+              billedAccountUserId: workspace.billedAccountUserId,
+              workspaceOrganizationId: workspace.organizationId,
+              allowPersonalApiKeys: workspace.allowPersonalApiKeys,
+            })
+            .from(workspace)
+            .where(and(eq(workspace.id, context.workspaceId), isNull(workspace.archivedAt)))
+          if (!current) throw new OrchestrationError('not_found', 'Workspace not found')
+          await authorizeWorkspaceFileAccess(principal, fileOperations.searchContent, current, {
+            executor: tx,
           })
-          .from(workspace)
-          .where(and(eq(workspace.id, context.workspaceId), isNull(workspace.archivedAt)))
-          .for('share')
-        if (!current) throw new OrchestrationError('not_found', 'Workspace not found')
-        if (current.workspaceOrganizationId)
-          await acquirePermissionGroupOrgLock(tx, current.workspaceOrganizationId)
-        await authorizeWorkspaceFileAccess(principal, fileOperations.searchContent, current, {
-          executor: tx,
-          forUpdate: true,
-        })
-        const folders = input.folderPaths === undefined ? [] : await listFileFolders(owner, {}, tx)
-        const delivery = await loadFileSearchDelivery(tx, {
-          owner,
-          prepared: result,
-          scope: resolveFileSearchFolderScope(folders, input),
-          signal,
-          classify: classified,
-        })
-        for (const dependency of delivery.inputs)
-          await assertOwnedFileAccess(principal, { ...current, ...dependency }, tx)
-        return delivery.provenance
-      })
-      const admitted = await admitEach(principal, result.sources, async (sources) =>
+          const folders =
+            input.folderPaths === undefined ? [] : await listFileFolders(owner, {}, tx)
+          const loaded = await loadFileSearchDelivery(tx, {
+            owner,
+            prepared: result,
+            scope: resolveFileSearchFolderScope(folders, input),
+            signal,
+            classify: classified,
+          })
+          for (const dependency of loaded.inputs)
+            await assertOwnedFileAccess(principal, { ...current, ...dependency }, tx)
+          return loaded
+        },
+        { isolationLevel: 'repeatable read' }
+      )
+      const inScope = result.sources.filter(
+        (source) => !delivery.outOfScope.has(source.identity.fileId)
+      )
+      const admitted = await admitEach(principal, inScope, async (sources) =>
         sources.map((source) => ({
           kind: 'workspace-file' as const,
           id: source.identity.fileId,
-          provenance: provenance.get(source.identity.fileId) ?? { status: 'unknown' as const },
+          provenance: delivery.provenance.get(source.identity.fileId) ?? {
+            status: 'unknown' as const,
+          },
           view: 'excerpt' as const,
         }))
       )
       const admittedIds = new Set(admitted.map((source) => source.identity.fileId))
-      return toWorkspaceFileSearchResult({
-        ...result,
-        results: result.results.map((hit) =>
+      const results = result.results
+        .filter((hit) => !delivery.outOfScope.has(hit.fileId))
+        .map((hit) =>
           admittedIds.has(hit.fileId)
             ? hit
             : {
                 ...hit,
                 text: '[Preview withheld: read or grep this file to inspect protected text.]',
               }
-        ),
+        )
+      return toWorkspaceFileSearchResult({
+        ...result,
+        results,
+        count: results.length,
         sources: admitted,
       })
     } catch (error) {
 
@@ -1,18 +1,21 @@
+import { db } from '@sim/db'
 import {
   fileSearchDispatchQueue,
   workspaceFileSearchBuild,
   workspaceFileSearchRevision,
 } from '@sim/db/schema'
-import { and, eq, sql } from 'drizzle-orm'
+import { and, eq, or, sql } from 'drizzle-orm'
 import type { DbTransaction } from '@/lib/db/types'
 import type { EditableFileOwner } from '@/lib/workspace-files/ownership'
+import { FILE_SEARCH_ARTIFACT_READY_LOCK_TIMEOUT_MS } from '@/lib/workspace-files/search/constants'
 import { lockFileSearchInputs } from '@/lib/workspace-files/search/index-state'
 import {
   fileSearchOwnerCondition,
   fileSearchOwnerFields,
   resolveFileSearchOwner,
 } from '@/lib/workspace-files/search/scope'
 import type { FileSearchDependencyIdentity } from '@/lib/workspace-files/search/source'
+import { configureFileSearchTransaction } from '@/lib/workspace-files/search/transaction'
 
 /** A renderer's private receipt; surfaces cannot supply it through a file contract. */
 interface FileSearchArtifactCompletion {
@@ -22,11 +25,8 @@ interface FileSearchArtifactCompletion {
   artifactKey: string
 }
 
-/** Requeues only current stored inputs and fences workers that read before the artifact existed. */
-export async function markFileSearchArtifactReadyInTx(
-  tx: DbTransaction,
-  input: FileSearchArtifactCompletion
-): Promise<boolean> {
+/** Pure check that the artifact key was minted for this file owner; throws otherwise. */
+function assertFileSearchArtifactReceipt(input: FileSearchArtifactCompletion) {
   const owner = resolveFileSearchOwner(input)
   const prefix =
     owner.entityType === 'workspace'
@@ -37,17 +37,79 @@ export async function markFileSearchArtifactReadyInTx(
     !/^[a-f0-9]{64}\.(docx|pptx|pdf|xlsx)$/.test(input.artifactKey.slice(prefix.length))
   )
     throw new Error('Artifact receipt does not belong to this file owner')
+  return owner
+}
+
+function artifactRevisionCondition(input: FileSearchArtifactCompletion, owner: EditableFileOwner) {
+  return and(
+    eq(workspaceFileSearchRevision.fileId, input.file.fileId),
+    fileSearchOwnerCondition(workspaceFileSearchRevision, owner),
+    eq(workspaceFileSearchRevision.sourceContentUpdatedAt, input.file.contentUpdatedAt)
+  )
+}
+
+/**
+ * Lock-free form of {@link markFileSearchArtifactReadyInTx}'s no-op test: the file's current
+ * revision is already built from this artifact, ready or still under a live build lease.
+ */
+async function isFileSearchArtifactCurrent(
+  input: FileSearchArtifactCompletion,
+  owner: EditableFileOwner
+): Promise<boolean> {
+  const [current] = await db
+    .select({ fileId: workspaceFileSearchRevision.fileId })
+    .from(workspaceFileSearchRevision)
+    .innerJoin(
+      workspaceFileSearchBuild,
+      eq(workspaceFileSearchBuild.id, workspaceFileSearchRevision.buildId)
+    )
+    .where(
+      and(
+        artifactRevisionCondition(input, owner),
+        eq(workspaceFileSearchBuild.artifactKey, input.artifactKey),
+        or(
+          eq(workspaceFileSearchRevision.status, 'ready'),
+          and(
+            eq(workspaceFileSearchRevision.status, 'pending'),
+            sql`${workspaceFileSearchBuild.expiresAt} > clock_timestamp()`
+          )
+        )
+      )
+    )
+    .limit(1)
+  return current !== undefined
+}
+
+/**
+ * Requeues search for a freshly rendered artifact unless its revision already uses it. The common
+ * already-current case takes no locks; the locked requeue is bounded by a short lock timeout.
+ */
+export async function requeueFileSearchForRenderedArtifact(
+  input: FileSearchArtifactCompletion
+): Promise<void> {
+  const owner = assertFileSearchArtifactReceipt(input)
+  if (await isFileSearchArtifactCurrent(input, owner)) return
+  await db.transaction(async (tx) => {
+    await configureFileSearchTransaction(tx, {
+      lockTimeout: FILE_SEARCH_ARTIFACT_READY_LOCK_TIMEOUT_MS,
+    })
+    await markFileSearchArtifactReadyInTx(tx, input)
+  })
+}
+
+/** Requeues only current stored inputs and fences workers that read before the artifact existed. */
+export async function markFileSearchArtifactReadyInTx(
+  tx: DbTransaction,
+  input: FileSearchArtifactCompletion
+): Promise<boolean> {
+  const owner = assertFileSearchArtifactReceipt(input)
   const revision = {
     owner,
     fileId: input.file.fileId,
     sourceContentUpdatedAt: input.file.contentUpdatedAt,
   }
   if (!(await lockFileSearchInputs(tx, revision, input.dependencies, input.file.key))) return false
-  const predicate = and(
-    eq(workspaceFileSearchRevision.fileId, revision.fileId),
-    fileSearchOwnerCondition(workspaceFileSearchRevision, owner),
-    eq(workspaceFileSearchRevision.sourceContentUpdatedAt, revision.sourceContentUpdatedAt)
-  )
+  const predicate = artifactRevisionCondition(input, owner)
   const [state] = await tx.select().from(workspaceFileSearchRevision).where(predicate).limit(1)
   if (state?.buildId) {
     const [build] = await tx
 
@@ -14,6 +14,8 @@ export const FILE_SEARCH_PATTERN_MAX_DEPTH = 20
 /** Total search deadline, including patterns whose literals cannot provide a selective trigram probe. */
 export const FILE_SEARCH_STATEMENT_TIMEOUT_MS = 10 * 1000
 export const FILE_SEARCH_LOCK_TIMEOUT_MS = 5 * 1000
+/** A rendered file's bytes are already fetched, so a contended requeue gives up rather than stall the read. */
+export const FILE_SEARCH_ARTIFACT_READY_LOCK_TIMEOUT_MS = 1000
 export const FILE_SEARCH_DEFAULT_MAX_RESULTS = 50
 export const FILE_SEARCH_MAX_RESULTS = 200