v2.2.0

Upgrading is a binary swap. No data migration, no re-backfill. On-disk state from 2.0 and 2.1 is
read as it is.

This release is mostly about behaving well when something underneath you has gone wrong.

A damaged nest degrades honestly

A page-corrupt sealed segment (footer intact, data region destroyed) used to take down an entire
/sql query with Invalid Error: don't know what type: and nothing named. Now the bad segment
reduces its own table, the rest of the data is served, and the nest tells you it happened:

• /sql returns degraded and degraded_tables, naming the affected tables
• nuthatch sql prints a warning line
• the MCP server carries the same notice

The caveat states a fact about the nest, not about the rows you happened to receive, so a query
that missed the damaged range still reports it. A warning you can dodge by asking a different
question is not a warning.

The sweep that detects this is bounded by the query's own deadline rather than a fresh one, and
concurrent sweeps coalesce, so a degraded nest under load cannot be turned into a way of spending
someone else's CPU.

Blocks-only nests work

Nests that index chain structure rather than a contract now start at all, derive one row per block
instead of one per log, and no longer ask an endpoint for every log on the chain. The window
controller is bounded at the header ceiling itself rather than only where it is used, so it cannot
drift upward across a retirement.

Measurements corrected

• The per-nest RSS estimate was about 13x pessimistic and it gated a refusal, so mounts that fit
  comfortably were being turned away. Refitted against measurement.
• The committed point-read baseline was a dev-box artifact while the gate ran on CI hardware. It is
  now measured where it is enforced.
• nuthatch sql and the adoption path no longer create the store they are probing for. Asking
  whether a dataset exists must not be able to answer itself.
• nuthatch doctor's width-probe note was wrong, and its range-only recommendations are now capped.

Fixes

• A declared big-int column that no sealed segment carries no longer deletes the table
• An unreadable store is not copied during adoption
• A nest hot-mounted into a running runtime gets its early cutoff
• The empty getLogs filter is now unrepresentable rather than guarded at each call site
• CI: the footprint gate's timeout bounded iterations rather than seconds; every job now has a
  wall-clock cap

Provenance

19 PRs, 13 issues, +4730/-383 across 29 files. Merged in #499 after a board audit that re-ran every
gate and mutation-checked six of the merged PRs against what their tests claim to protect. That
audit found one gap, filed as #500: it is in a test's naming, not in shipped behaviour.

Nine of the nineteen PRs were verified in depth; the remainder rest on CI and their authors' own
mutation claims, which is worth saying plainly rather than implying otherwise.

Not verified on a production box. #441 remains open.