Implements the tractable items from the native-service upgrade review across all
five reviewed services (notification, vault, search, live-query, embedding):
correctness/robustness fixes, per-tenant fairness, and operator-tunable knobs.
No proto changes; no feature removed. All new logic carries pure-function unit
tests. Larger items (backoff/DLQ, Vault transactional CAS, Search full-text
execution, LiveQuery durable resume, Embedding non-Qdrant teardown/Matryoshka)
remain deferred and are tracked in the private upgrade plan.
- Notification: bounded delivery retries (log -> FAILED after
UDB_NOTIFICATION_DELIVERY_MAX_ATTEMPTS, default 6), bounding the retry storm;
RetryNotification retries the FAILED state only and no longer resurrects
opted-out SUPPRESSED rows (opt-out-bypass fix); UDB_NOTIFICATION_DELIVERY_BATCH.
- Vault: DestroySecret confirmation_token must equal the secret_path; the
DB-lease reaper logs-and-continues on one un-droppable role instead of aborting
the batch; BatchEncrypt rejects oversized input; UDB_VAULT_MAX_VERSIONS_SCAN,
UDB_VAULT_DB_LEASE_REAPER_BATCH, UDB_VAULT_MAX_BATCH_ENCRYPT knobs.
- Search: deep pagination fixed (fetch offset+page_size per index; next_page_token
only when a further page exists); one failing index is skipped, not fatal;
SearchRequest.mode is enforced against the inputs; UDB_SEARCH_MAX_TOP_K,
UDB_SEARCH_MAX_INDEXES_PER_TENANT knobs.
- LiveQuery: process-wide concurrent-stream ceiling
(UDB_LIVEQUERY_MAX_STREAMS_GLOBAL, default 4096); change_op classifies upsert
by the topic verb; predicate values coerce to numeric only in canonical form so
a leading-zero business string binds as text.
- Embedding: the two duplicate cosine/similarity impls are unified into one
metric-aware similarity (fixing EUCLID read-your-writes ordering); the
read-your-writes fresh buffer is sharded per tenant; rerank URL, candidate cap,
MMR over-fetch, and rerank timeout are now config knobs.
Shared spawn sites (Vault reaper batch, Notification delivery batch) wired to the
new env-backed knobs.