feat(corpus): separate lifecycle ownership and recovery

[morluto]

Description

Separates binary installation, corpus migration, derived projections, and corpus content scope into explicit lifecycles.

The original failure looked like setup initialization, but it was an existing 226 MiB corpus running historical migrations and a size-independent integrity check. This change removes those hidden ownership transfers:

• ordinary reads and diagnostics inspect schema compatibility without creating or migrating a corpus;
• setup initializes only a missing corpus and reports an existing migration requirement separately;
• corpus inspect, backup, migrate, restore, list, inventory, prune-code, remove-repository, and projections expose explicit storage operations;
• current processes coordinate through shared/exclusive filesystem leases, with no system-wide process scan or pre-release compatibility path;
• backup uses SQLite's online backup API, while restore verifies the manifest and source, checkpoints destination WAL data, then atomically replaces the main database;
• search projections carry independent build state and preserve the last complete projection on a failed rebuild;
• upgrade compares semantic versions, stages versioned private runtimes, validates a side-effect-free runtime contract on both source and installed bytes, and changes client registrations only after schema compatibility is proven;
• setup verification no longer runs a full-corpus quick check; doctor reports a diagnostic timeout as inconclusive rather than corruption.

This is a hard cutover for the unreleased storage design. Migrations 001-028 are replaced by one canonical 001_initial.sql baseline that directly creates the current schema. Pre-cutover development corpora are intentionally unsupported and must be recreated. Future schema changes append migrations from this baseline. This also removes the expensive migration-024 backfill path rather than preserving or optimizing an unused compatibility route.

Closes #76
Closes #77
Closes #78
Closes #79
Closes #80
Closes #81
Closes #82
Closes #83
Closes #84
Closes #85

Protected invariants

• Corpus reads do not perform network access, process execution, schema writes, or implicit projection rebuilds.
• Migration and restore require exclusive corpus ownership; active current readers hold shared leases and make incompatible work fail fast.
• Restore never exposes a new main database beside an old uncheckpointed WAL.
• Repository removal and code pruning preview exact scope, reject stale plans, and commit transactionally.
• Runtime activation preserves existing client registrations when the target contract is missing, malformed, version-mismatched, schema-incompatible, or changes after installation.

Suggested review order

1. internal/corpus/lifecycle.go, lock.go, and schema_inspect.go for authority, backup/restore, and WAL safety.
2. internal/corpus/migrations/001_initial.sql for the canonical baseline and projections.go for derived-state ownership.
3. internal/app/upgrade.go, runtime_contract.go, and cmd/gitcontribute/main.go for pre-activation validation.
4. internal/app/corpus_lifecycle.go and the CLI adapters for public behavior.
5. Inventory, pruning, repository removal, and their focused regression tests.

Testing Done

• go test -buildvcs=false ./...

• CGO_ENABLED=0 go test -buildvcs=false ./...

• go vet ./...

• GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -buildvcs=false ./...

• go test -race -buildvcs=false ./internal/corpus ./internal/app

• Fresh baseline schema objects, columns, indexes, triggers, and projection seed rows were compared with a fresh database produced by the former migration chain.

• go test ./... passes

• golangci-lint run ./... passes

• go test -race ./internal/app ./internal/corpus passes

Checklist

• Focused regression tests added for ordering, resumability, cancellation, and side-effect boundaries
• Storage invariants preserved (see CONTRIBUTING.md)
• gofmt applied to changed Go files
• No new third-party types exposed outside adapters

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.