perf(sessions): stop rebuilding the entire Git-evidence projection for bounded reads

[ScriptedAlchemy]

Priority: P1 performance/scalability
Release gate: affected retained-session query acceptance, not a new universal benchmark gate.

Evidence

At #707 607df500b1eb5568aa3a20e07f2924262b46c808:

GlobalDbGitCorrelationStore calls git_evidence_projection() from correlation_index_health, sessions_for_with_relation_and_presence, and sessions_for_with_relation.

GitEvidenceProjectionStore::from_verified_snapshot walks every entity/relation page, JSON-decodes all spans and commit records into vectors, reconstructs GitEvidenceProjectionV1, then calls require_git_evidence_generation, which recomputes the projection-derived identity. Health ultimately needs counts; presence needs booleans; a session query filters the resulting full in-memory projection.

The page size bounds each read, not total materialization or work per request. Sharing one recovered projection between results and presence already removes one duplicate pass, but still rebuilds the whole projection for each facade call. This is a source-confirmed O(total evidence) read/reconstruction path, not a freshly measured latency claim.

Change

Separate full recovery/merge work from the bounded query view. Serve counts/presence from authenticated generation metadata or the verified store's bounded count/exists operations, and serve filtered session queries through generation-bound indexed reads. Reuse existing verified graph APIs; do not create a parallel SQL source of truth for Git evidence.

Perform full payload consistency verification at the owning publication/recovery boundary and preserve the exact verified-generation/read lifetime on subsequent queries. A generation ID string alone must not authorize unverified bytes. If a retained typed view is needed as an interim step, keep one bounded, generation-bound owner rather than request-local full copies or a process-global unbounded cache. Repeated reads must not rerun canonical JSON reconstruction/hash without new evidence requiring it.

Route any remaining blocking recovery through the existing bounded operation owner, and carry request cancellation/deadline into the actual graph read. Do not replace errors with empty results: never-published is a legitimate empty projection; corrupt/unavailable is not.

Acceptance

• A count/presence read does not decode every span/commit payload.
• Selective session queries report rows/pages/bytes visited independently of rows returned; enlarging unrelated evidence does not force full projection hydration.
• Repeated queries against one unchanged generation avoid repeated full decode/hash.
• Publication racing a read preserves one coherent generation; new readers see the successor, old admitted readers cannot outlive their authority.
• Tampering, absent projection, wrong namespace/project, cancellation, and relation filters preserve their current distinctions.
• Compare cold/warm query allocations and p50/p95 against the current path on small and retained-profile-sized data; no budget increase.

Related: #843 tracks missing/background convergence; #915 tracks executor lifetime. This issue is specifically the already-published projection's read amplification, not a duplicate of those failures. Source review only; no repository benchmark executed. Keep #707 draft.

[ScriptedAlchemy]

Correction to the original issue's phrase “never-published is a legitimate empty projection”: that is not a valid general contract for scoped session retrieval.

At a8c322a02ce7f5453dab0a3d89393b9b729f6b4d, session-temporal-store/src/lib.rs::git_scope_session_ids explicitly returns Unavailable when the verified Git-evidence projection has not been published. An empty verified projection and an absent projection are different evidence. Preserve that distinction during the read-amplification fix; do not turn missing publication into an authoritative empty session result.

This method is also another real full-recovery consumer to include in the same cutover. It calls recover_git_evidence_projection for a scoped filter, so optimizing only the GlobalDbGitCorrelationStore facade would leave this path rebuilding the projection. Keep exact registered project and graph generation ownership; no new issue is needed for the same repeated work.

[ScriptedAlchemy]

Fixed in bb1ee0460, 09988362b, 1df85e0f3, 7f0949777 (on #707 at 694b590ae). The Git-evidence projector (rev v2) publishes a query index — newest-first branch/worktree span keys, 6-hex commit-prefix buckets, span/commit counts and projector revision on the projection entity — and GitEvidenceGraphView serves health, presence, sessions_for and scope resolution from point reads and hub fan-out under the verified snapshot lease. All four full-recovery consumers are cut over: the GlobalDbGitCorrelationStore facade, git_scope_session_ids (never-published stays typed Unavailable, not an empty scope, per the correction comment), and the proximity authority. Results are identical to the in-memory projection (asserted across 300+ query shapes: limits, windows, ties, relation filters, 6/7/40-char prefixes, compound scopes). Pre-index (v1) heads still recover in full, are typed Unavailable to bounded readers, and are re-projected once by convergence — kept because live stores hold v1 heads. Measured at 5,000 sessions: health 1 row / 8 µs (was 53,142 rows / 1.45 s); branch sessions_for limit 20 → 81 rows / 0.92 ms (was 53,142 / 1.25 s); commit prefix 9 rows / 0.19 ms; scope branch∩worktree 239 rows for 238 answers / 6.9 ms. Row counts for fixed-limit queries are identical at 500 and 5,000 sessions.