Closes #1780.

Three zero-config gaps that made a brain silently fail for an unattended/agent consumer. Two real, one optional (all included).

Gap 1 — code-* readiness signal (was: silent empty result)

code-def / code-refs / code-callers / code-callees returned count: 0 in three indistinguishable cases: graph not built, source never synced, or genuinely no match. An agent reading count: 0 couldn't tell "wait and retry" from "trust this." Now every CLI envelope and the four MCP ops carry a typed status (not_built | indexing | ready | unknown) + ready boolean.

• count: 0 + ready: true → genuinely none. ready: false → ask later.
• New src/core/code-graph-readiness.ts: EXISTS-based (cheap; no page_kind index needed, pending probe rides the partial idx_content_chunks_edges_backfill), chunk-grain, fail-open on DB error. count > 0 short-circuits to ready with no query.
• def/refs are 2-state + brain-wide (their data is set at chunk time). callers/callees are 3-state + source-scoped, with the pending predicate mirroring the resolver (edges_backfilled_at IS NULL OR < EDGE_EXTRACTOR_VERSION_TS) so a resolver-version bump can't falsely report ready.

Gap 2 — gbrain init validates the embedding key (was: silent embedded=0 at first sync)

Init persisted --embedding-model without checking the key; first sync imported pages but embedded zero, and search came back empty. Now init runs a free config-only diagnoseEmbedding (missing key, all providers) + a best-effort 1-token live test-embed (invalid/expired key, 5s timeout). Loud warning to stderr, init still exits 0.

• New src/core/init-embed-check.ts. Builds the effective env (process.env + file-plane *_api_key + --key) via buildGatewayConfig so it sees the same keys + provider base URLs as runtime (no false warning for config.json-keyed users).
• buildGatewayConfig extracted to src/core/ai/build-gateway-config.ts (cli.ts re-exports).
• New --skip-embed-check flag / GBRAIN_INIT_SKIP_EMBED_CHECK=1; embedding_check in --json. --no-embedding skips the whole check.

Gap 3 — automatic same-host dead-pid cycle-lock takeover (was: TTL-only, ~30min wait)

A crashed lock holder blocked new cycles for the full TTL. tryAcquireDbLock now reclaims a held, not-TTL-expired lock when the same-host holder is provably dead (process.kill ESRCH) past a 60s grace, via a guarded DELETE + one normal-upsert retry returning the standard handle. Cross-host stays TTL-only. The shared classifyHolderLiveness predicate (EPERM treated as alive — never steal a live lock) is reused by gbrain sync --break-lock, fixing its prior EPERM-as-dead bug.

Tests

• New: test/code-graph-readiness.test.ts (11), test/db-lock-auto-takeover.test.ts (11), test/init-embed-check.test.ts (9, hermetic via the gateway embed-transport seam + withEnv). Readiness-envelope cases added to test/e2e/code-intel-mcp-ops-pglite.test.ts. 3 critical-regression tests: file-plane no-false-warn, readiness-query-throw → unknown, EPERM-as-alive.
• bun run verify green (29/29: typecheck, privacy, jsonb, wasm, resolver, all guards). 134-test post-merge re-verify across the affected + new suites, 0 fail. Targeted Postgres E2E: 127 pass (1 skip, 1 pre-existing stale failure unrelated to this diff — sync-lock-recovery › --break-lock + --all asserts a refusal string absent in both master and this branch).
• Manual smoke (isolated GBRAIN_HOME): init with no key → loud warning + embedding_check.ok=false; code-callers foo on a fresh brain → status: "not_built", ready: false.

No schema migration. gbrain upgrade handles everything.

🤖 Generated with Claude Code

Documentation

• CLAUDE.md — added Key Files entries for src/core/code-graph-readiness.ts, src/core/init-embed-check.ts, src/core/ai/build-gateway-config.ts; noted the tryAcquireDbLock auto-takeover + classifyHolderLiveness on the db-lock.ts entry and the status/ready readiness fields on the code-def/code-refs entry.
• llms-full.txt — regenerated from CLAUDE.md (bun run build:llms; freshness test green).
• CHANGELOG.md — v0.42.14.0 entry (ELI10-lead summary + "To take advantage of" block + itemized changes).
• TODOS.md — filed one P3 follow-up (Two zero-config gaps: code-* should signal "graph not built" vs silent empty, and gbrain init should validate the embedding key #1780): unify init-embed-check.ts:liveTestEmbed with models.ts:probeEmbeddingReachability onto a shared embed-probe core.

Coverage: all shipped surface (code-* status/ready fields, gbrain init --skip-embed-check + embedding_check JSON, the three new modules, db-lock auto-takeover) is documented in CLAUDE.md + CHANGELOG. README is product-level and needs no change. No architecture-diagram drift.