fix(storage): harden project store authority and resolution

[HashemKhalifa]

Summary

• authorize only consolidation-owned staged databases during offline maintenance and keep volatile runtime telemetry out of stable plan fingerprints
• validate the graph that the current branch would actually serve instead of assuming the root graph is active
• reuse the already-open graph when an explicit selector resolves to the active project, while preserving separate routing for sibling worktrees and other projects
• keep session correlation and identity-conflict diagnostics responsive with bounded presence probes instead of full-table and full-tree counts
• keep daemon shutdown bounded when background maintenance holds the writer gate or watcher tasks are inside synchronous work
• isolate branch recovery markers and avoid duplicate full-store crash-recovery validation

Root cause

Project resolution treated store comparison as an inventory operation even on authoritative and conflict-reporting paths. Preserved candidates therefore caused expensive graph and session-table diagnostics before ordinary graph tools could run. Branch-scoped stores could also be misclassified because health checks opened the root graph rather than the serving branch graph. An explicit selector for the already-active project opened the same store a second time, re-entering resolution and amplifying the delay.

A separate hot path remained in session correlation: ordinary requests traversed large correlation tables for diagnostic counts. During restart, scheduler shutdown could also wait indefinitely for writer administration, and watcher shutdown awaited one task before aborting the rest. The process could remain alive while the listener stopped making progress.

Crash recovery also validated the same non-empty database twice: the lifecycle performed a read-only preflight, then Database::open performed its own WAL-aware read-only validation before writable pragmas and migrations. Branch syncs additionally published a repository-wide legacy dirty marker, allowing one sibling worktree to trigger recovery in another branch graph. Dirty zero-length stores required an explicit guard because the ordinary open path correctly treats a zero-length database as fresh outside recovery.

Behavior after this change

• selected exact-root stores use bounded read-only presence probes; actual serving opens still perform full integrity validation and fail closed
• identity-conflict diagnostics report presence-only values and do not run full table or artifact-tree counts
• unreadable graph, session, branch-metadata, or artifact state is reported as unhealthy and blocks marker or manifest repair
• duplicate legacy stores remain untouched and recoverable; genuinely ambiguous stores continue to fail closed
• same-project selectors use the active reader; different projects and explicit sibling-worktree paths still dispatch separately
• ordinary session correlation uses bounded presence probes and labels populated-family values as count_mode: presence_only
• daemon shutdown bounds writer-gate acquisition and joins; all watcher tasks are aborted before any join is awaited
• non-empty crash recovery performs one WAL-aware validation before writable work
• branch graphs publish and honor only graph-local dirty markers; the root graph retains legacy-marker recovery behavior
• dirty zero-length or unreadable recovery sets fail before writable initialization and preserve their recovery evidence

Validation

• 44 storage-resolver tests passed
• focused read-only presence-probe, scheduler shutdown, blocked-watcher, session-correlation, and MCP correlation regressions passed
• focused branch-marker, corrupt-branch, legacy-root-marker, and dirty-store regressions passed, including RED-first coverage for sibling marker isolation and zero-length recovery
• cargo check --workspace
• cargo fmt --check
• git diff --check
• optimized release build completed for the audited candidate
• independent exact-commit audit: PASS, no critical or warning findings after remediation
• managed-daemon restart completed and rebound the socket; cold graph access completed through startup catch-up, and repeated active-project and sibling-worktree graph calls completed without another storage recovery scan

One-time transcript catch-up and stale-index refresh remain cold-start work; they are separate from the repeated recovery scans fixed here.

commitlint was unavailable in this checkout (commitlint: command not found); all commit subjects follow the repository's conventional format.

[changeset-bot]

🦋 Changeset detected

Latest commit: a818fcd

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[HashemKhalifa]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 043a047e03

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".