Fix profiled cold-index and warm-restart costs

[zzet]

Summary

Fixes the four findings from isolated cold-index / warm-restart profiling:

• Scoped contract/ownership loading avoids ordinary-node hydration while preserving full persisted records, shared-ID roles, and repository/generation isolation.
• Empty-repository eviction skips require proof under the writer lock/transaction; retain the repository-leading ingestion index and verify query plans.
• Publish manifest, SIZE, and content-policy skip census receipts only after successful publication/version revalidation. Preserve shared contracts, incoming ownership and canonical FTS through restart deletion and structural refresh; prune actual final orphans transactionally.
• Sparse missing-ownership eligibility avoids no-op backfill scans while preserving fill-only builtin/project-only/partial ownership and configuration reevaluation.

Regression coverage includes fresh index→reopen parity, policy/size changes, failed/cancelled publication and retry, Merkle preservation, Windows identity capture, shared-ID metadata, opaque adapters, sibling generations, real structural reparse/derived dispatch, retained FTS and transaction rollback.

Validation and provenance

Final source: 5b17b56 (27 atomic commits, pushed); final clean-VCS binary SHA256: 54464ea1c6402328a5543cd01ff8848b9308656ad64792de39340a4f90fc8df3.

• Final production core a39ba43: actual no-overlay affected-package normal and race suites both pass: 3 packages, 2,233 passing test/subtest records, 2 opt-in measurement skips, zero failures per run. Indexer package: normal 377.808 s, race 983.954 s; both logs complete.
• 5b17b56 adds tests only: 459 added lines, original bodies and production unchanged. Expanded eight-test selection passes actual normal 2.767 s / race 28.024 s; build, vet, lint (0 issues), formatting/diff checks pass. Broad core binaries compiled before this expansion; do not count the focused selection as another full-package run.
• Earlier whole-repository normal/race suites passed on e0f9a1f, with 193 package results each (40 normal entries had no test files). dc84927 only reformatted tests; its follow-up static/fixture checks passed. Those whole suites were not rerun after the later production policy fix.
• Native analysis remains a lower-bound contract warning; it mapped tests to none of four changed anchors. Actual build/race execution is separate evidence, not a claim that this warning or graph coverage was cleared.

Measured tradeoff and remaining costs

All 40 serial microbenchmark samples passed on dc84927: scalar loader median 68.926→0.969 ms (allocated 54.240→0.604 MB/op); no-op backfill 9.016→0.053 ms; absent eviction 9.670→0.148 ms;
tiny eviction 113.304→78.436 ms; recount 852.449→0.996 ms. 100k-node insertion costs 2.170→2.337 s (+7.67%). These are fixture-level results, not startup gains: scalar loader has no owners; maintenance compares current-code index availability; insertion has no edges. Five samples per loader variant, three for the other variants.

The earlier 29-repository checkpoint measured cold queryable/full 468.999 / 1122.688 s, warm1 22.298 /31.666 s. It still spent warm 11.038 s in reconciliation, 6.555 s rehydrating contracts and 5.123 s seeding enrichment. Cold index/finalization 289.608 s, enrichment 236.219 s, end-batch 205.479 s (framework 126.377 s nested), and resolver tail 210.011 s remain material costs—not all proven waste or LSP startup. Do not double-count nested/overlapping timers or infer a historical causal speedup.

Explicit validation gap and compatibility limits

The dc84927 real-config cold→warm1 comparison found exactly 2 added census entries and 4 removed co-change edges; all 609,749 node payloads and 3,478,038 retained edge payloads were equal. This was not parity. The final policy fix covers the reproduced receipt loss in passing regression tests.

Final targeted real replay was NOT RUN: its preflight exited before daemon launch because free space was below the unchanged 20 GiB safety gate. No gate relaxation or evidence deletion was used. Therefore no final real-config cold/warm parity or final targeted timing is claimed. The earlier stable-input measurement also qualifies 1,644 unfollowed symlink targets.

Empty repo scope remains exact, never global; backfills remain fill-only. Opaque adapters omit ambiguous scalars; overwritten/never-persisted legacy fields cannot be reconstructed. Dependency contracts retain sparse cold single-writer payloads. The historical exact bridge split remains incompletely attributed.

PR merge-ref CI: results pending. GitHub checks will provide integration results; Windows runtime validation is distinct from local macOS execution.

[zzet]

Pushed both CI corrections: 9897f247 and a26e87cb.

The first separates ordinary Store.Close() from the interactive checkpoint's 10-second deadline. Checkpoint and pool-close errors still propagate; bounded BUSY/LOCKED retries, explicit CheckpointWAL(), and bulk finalization are unchanged. Ordinary close deliberately has no wall-clock limit for an individual operation or pool wait. Four deterministic regressions preserve these contracts without weakening the existing JSONB/reopen assertions.

That fix is verified on Windows: the entire SQLite package passed (276.482s), including both originally failing tests and all four new regressions. Other checks on 9897f247, including Linux and macOS tests, passed. Windows remained red only on a base-provided MCP checkout test that expected a terminal rejection before asynchronous discovery finished.

The second, test-only correction retries only transient checkout-busy responses for up to 10 seconds. Every attempt still requires an error result and no handler execution; the final assertion still requires checkout_inaccessible. Production behavior is unchanged. A controlled 350ms Git delay reproduces the original failure; the corrected test passes 10 repetitions (25.201s) and three under race (18.549s).

Local checks are green: full SQLite normal/race (61.077s/1024.217s), broader checkout race (41.575s), full MCP normal (266.889s, 5,846 passing test/subtest events, zero failures), and lint. No CI timeout was increased.

Fresh Windows CI on a26e87cb is running; no new-head CI success is claimed yet. The current exact view is available, but this test has no indexed symbol mapping, so graph-only postchecks could not certify it.