fix(db): index decision_ledger_anchors on (row_hash, status) (#9830)

`anchorBackendsMissingForRowHash` (#9489) runs
`SELECT DISTINCT backend FROM decision_ledger_anchors WHERE row_hash = ? AND status = 'ok' AND backend IN (...)`
once per row being re-anchored, but the table had no index on row_hash — so each
call was a full table scan that grows with the anchor ledger.

Add migration 0203 creating `decision_ledger_anchors_row_hash_status (row_hash, status)`
— row_hash first (the equality predicate), status included so the `status = 'ok'`
filter is served from the index rather than a row fetch. Mirrors the
decision_ledger_record_id index added in 0198. The migration contains nothing else.
(Issue named 0202; that number is now taken, so this is the next contiguous 0203.)

A new test asserts the index exists after replaying migrations and that the real
query SEARCHes via it (not SCAN); the existing anchorBackendsMissingForRowHash
behaviour cases confirm results are unchanged.

Closes #9652

Author: shin-core

migrations/0203_decision_ledger_anchors_row_hash_index.sql

@@ -0,0 +1,6 @@
+-- #9489: anchorBackendsMissingForRowHash queries
+-- `SELECT DISTINCT backend FROM decision_ledger_anchors WHERE row_hash = ? AND status = 'ok' AND backend IN (...)`
+-- once per row being re-anchored; without an index on (row_hash, status) that is a full table scan per call.
+-- Lead with row_hash (the equality predicate) and include status so the `status = 'ok'` filter is served from
+-- the index rather than a row fetch. Sibling precedent: decision_ledger_record_id in migrations/0198.
+CREATE INDEX IF NOT EXISTS decision_ledger_anchors_row_hash_status ON decision_ledger_anchors (row_hash, status);

test/unit/ledger-anchor-persistence.test.ts

@@ -240,4 +240,22 @@ describe("anchorBackendsMissingForRowHash (#9489)", () => {
     expect(await anchorBackendsMissingForRowHash(env, "hash-a", [])).toEqual([]);
     expect(spy).not.toHaveBeenCalled();
   });
+
+  it("is served by the (row_hash, status) index rather than a full table scan (#9652)", async () => {
+    const env = createTestEnv();
+    const idx = await env.DB.prepare("SELECT name FROM sqlite_master WHERE type='index' AND name = ?")
+      .bind("decision_ledger_anchors_row_hash_status")
+      .first<{ name: string }>();
+    expect(idx?.name).toBe("decision_ledger_anchors_row_hash_status");
+
+    // The exact predicate anchorBackendsMissingForRowHash runs — must SEARCH via the new index, not SCAN.
+    const plan = await env.DB.prepare(
+      "EXPLAIN QUERY PLAN SELECT DISTINCT backend FROM decision_ledger_anchors WHERE row_hash = ? AND status = 'ok' AND backend IN ('rekor', 'git')",
+    )
+      .bind("hash-a")
+      .all<{ detail: string }>();
+    const detail = (plan.results ?? []).map((row) => row.detail).join(" ");
+    expect(detail).toContain("decision_ledger_anchors_row_hash_status");
+    expect(detail).not.toContain("SCAN decision_ledger_anchors ");
+  });
 });