Harden secondary indexes with an industrial atomic foundation

[forhappy]

Outcome

Implements the approved 2026-07-28-secondary-index-industrial-foundation-hard-cutover.md plan for the industrial foundation: atomic architecture, bounded resources, correctness, observability, and rigorous release gates.

This is a hard cutover. It adds no compatibility reader, dual publication, migration shim, or suffix-named V2/V3 API.

Architecture

• Replaces source/index/catalog/control publication with one canonical IndexedCollectionState root and one CAS linearization point.
• Makes snapshots content-addressed and binds private cursors to snapshot, source/state versions, descriptor, direction, bounds, and continuation.
• Fences raw source-head mutation after canonical indexed initialization.
• Introduces exact store profiles. SQLite is the only production-qualified adapter; MemStore, FileNodeStore, PGlite, redb, RocksDB, and SlateDB are verification-only.

Industrial controls

• Finite typed budgets for mutation, query, maintenance/spill, transfer, retry, and elapsed work.
• Spillable bounded index construction and verification.
• Bounded bundle parsing/import/export, retention, durable pins, shared-store-safe GC, and structural health.
• Structured redacted errors, retry advice, and measured indexed-operation counters.
• Canonical API propagation through UniFFI, Node, WASM, Python, Ruby, Swift, Java, and Kotlin.

Release gates

• Deterministic confirmation/CAS fault injection and barrier-controlled two-writer visibility tests.
• Bounded resource and 10,000-case malformed descriptor/cursor/bundle parser fuzz smoke.
• Required Rust, SQLite production-profile, binding parity, API-inventory, and hard-cutover CI.
• Scheduled release-mode, ASan, and 100,000-record repeated benchmark jobs.
• Exact local evidence and limitations: docs/secondary-index-release-evidence.md.

Local validation

• cargo fmt --all -- --check
• cargo clippy --all-targets -- -D warnings
• cargo test: 500 library tests, all integration suites, 74 doc tests
• Focused industrial gate: 41/41
• SQLite production profile/shared contract/separate-handle CAS: 3/3
• UniFFI 77/77; Node 60/60; WASM 34/34; Python 23/23; Ruby 22/22; targeted JVM portable parity passed
• Binding inventory: 3,052 operations
• PGlite, redb, RocksDB, and SlateDB all-target compilation passed with verification profiles
• Two independent five-sample benchmark smoke runs passed with every row semantically verified

Release status

The implementation is complete for review. Merge and production release remain gated on the required PR workflow. Swift runtime parity requires a configured macOS/XCTest runner, and scheduled ASan/extended performance evidence must be attached before a production release.