perf(code-index): memoize generation validation

Author: ScriptedAlchemy

crates/tracedecay-code-index/src/production/mod.rs

@@ -451,6 +451,10 @@ pub struct CodeIndexPublishedGenerationV1 {
     coverage: CoverageSummaryV1,
     capability: CodeIndexCapabilityManifestV1,
     projection: ProjectionPublicationHandoffV1,
+    /// Set only after a complete fail-closed integrity sweep. All generation
+    /// evidence is private and immutable after construction, so successful
+    /// validation remains authoritative for every clone and serving read.
+    integrity_validated: bool,
 }
 
 /// Immutable test-attribution reader derived from one sealed production code
@@ -839,8 +843,9 @@ impl CodeIndexPublishedGenerationV1 {
             coverage: envelope.generation.coverage,
             capability: envelope.generation.capability,
             projection,
+            integrity_validated: false,
         };
-        generation.validate()?;
+        let generation = generation.validate_new()?;
         Ok(generation)
     }
 
@@ -855,6 +860,22 @@ impl CodeIndexPublishedGenerationV1 {
     }
 
     fn validate(&self) -> Result<(), CodeIndexProductionErrorV1> {
+        if self.integrity_validated {
+            Ok(())
+        } else {
+            Err(CodeIndexProductionErrorV1::Contract(
+                "published generation has not passed integrity validation".to_owned(),
+            ))
+        }
+    }
+
+    fn validate_new(mut self) -> Result<Self, CodeIndexProductionErrorV1> {
+        self.validate_fresh()?;
+        self.integrity_validated = true;
+        Ok(self)
+    }
+
+    fn validate_fresh(&self) -> Result<(), CodeIndexProductionErrorV1> {
         self.manifest
             .validate()
             .map_err(|error| CodeIndexProductionErrorV1::Contract(error.to_string()))?;
@@ -1250,8 +1271,9 @@ where
             coverage,
             capability,
             projection,
+            integrity_validated: false,
         };
-        candidate.validate()?;
+        let candidate = candidate.validate_new()?;
 
         let expected = active
             .as_ref()

crates/tracedecay-code-index/tests/code_index_suite/production_orchestration.rs

@@ -333,18 +333,30 @@ fn production_owner_publishes_complete_generation_and_restores_it_after_restart(
 }
 
 #[test]
-fn sealed_generation_rejects_file_authority_from_foreign_project() {
+fn sealed_generation_validation_is_memoized_but_decode_stays_fail_closed() {
     let store = SharedPublicationStore::default();
     let mut owner = CodeIndexProductionOwnerV1::new(config(), store, ApplyingProjectionSink)
         .expect("production owner");
     let generation = owner
         .build_and_publish(request("file.project-binding", 1_200_000), &ActiveControl)
         .expect("valid generation publishes");
     let sealed = generation.encode_sealed().expect("valid generation seals");
+    assert_eq!(
+        generation
+            .encode_sealed()
+            .expect("memoized generation seals again"),
+        sealed
+    );
 
     let restored =
         CodeIndexPublishedGenerationV1::decode_sealed(&sealed).expect("valid generation restores");
     assert_eq!(restored.manifest().project_id, config().project_id);
+    assert_eq!(
+        restored
+            .encode_sealed()
+            .expect("restored generation retains successful validation"),
+        sealed
+    );
 
     let mut envelope: serde_json::Value =
         serde_json::from_slice(&sealed).expect("sealed generation JSON");