feat(vnext): coordinate bounded catalog search work (#195)

## Summary

- add the package-private bounded catalog search-work coordinator
- compose provider authentication, epoch authority, latest-wins
ownership, cancellation, deadlines, and response publication
- harden hostile and reentrant lifecycle boundaries, including exact
disposal hooks and captured Promise intrinsics
- document the scheduler contract and deferred cache/session/UI
responsibilities in ADR 0005
- add strict API fixtures, invariant-heavy unit coverage, and
capacity/performance benchmarks

## Invariants

- at most 8 provider searches are active and 64 are queued
- owners join only exact structural request keys and supersede
independently
- scope epoch changes retire same-scope work without crossing scope
boundaries
- failed captures, invalid input, cancellation, disposal, overload, and
deadlines settle promptly and exactly once
- provider calls, timers, clocks, thenables, callbacks, and response
decoding may be hostile or reentrant without reviving retired work
- the authenticated dialect runtime is the sole dialect identity
authority

## Validation

- `vitest`: 1,856 passed, 1 expected failure
- changed coverage: 97.29% statements, 96.23% branches, 99.46%
functions, 97.73% lines
- search coordinator: 97.03% statements, 95.09% branches, 100%
functions, 97.84% lines
- epoch coordinator: 98.31% statements, 97.42% branches, 98.21%
functions, 98.89% lines
- strict source, tests, vNext API fixture, loose-optional fixture, and
demo typechecks
- zero-warning `oxlint`
- test-integrity gate
- 4 browser files / 7 browser tests
- exact-tarball package smoke test
- worker placement and bundle budgets
- production dependency audit: no known vulnerabilities
- catalog search-work benchmark suite
- two independent adversarial exact-head approvals

Part of #169.

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds a package-private, bounded catalog search-work coordinator that
composes provider auth with epoch authority to run searches safely,
dedupe by exact keys, and enforce deadlines. Also centralizes catalog
scope validation to a shared boundary utility. Progress toward #169.

- **New Features**
- Added `createSqlCatalogSearchWorkCoordinator` with 8 active and 64
queued limits, exact-key in-flight sharing, and latest-wins per owner.
- Owners capture scope and dialect; the authenticated dialect runtime
defines the provider ID and epoch authority.
- Independent cancellation, queue and execution deadlines, and a small
synchronous budget; outcomes include usable, superseded, cancelled, and
unavailable.
- Safe response decoding and epoch publication; first baseline re-keys
unobserved work in the same scope.
- Benchmarks and strict unit/type tests for lifecycle, concurrency,
deadlines, and adversarial scenarios.
- ADR 0005 updated to document scheduler/deadlines and package-owned
disposal semantics.

- **Refactors**
- Epoch coordinator now accepts a package-owned disposal target, invokes
it exactly once, and drains non-undefined returns with captured Promise
intrinsics (resilient to a replaced global Promise).
- Centralized scope validation into `isValidSqlCatalogScope` in the
boundary; adopted by epoch and search-work paths with new tests.
- Hardened lifecycle boundaries and cleanup; exact disposal and hostile
thenable handling.
- Dialect runtime exposes a stable `id`; tests assert coherence and
deep-freeze properties.

<sup>Written for commit 061a3c6.
Summary will update on new commits.</sup>

<a
href="https://cubic.dev/pr/marimo-team/codemirror-sql/pull/195?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->

Author: Light2Dark

docs/adr/0005-parser-independent-relation-completion.md

@@ -484,6 +484,12 @@ state preparation and suppresses later revision listeners; an accidental
 Promise result receives best-effort detached rejection draining. Coordinator
 disposal revokes the preparation closure before external cleanup. The hook
 remains package-private and is not a provider or session extension point.
+The combined search coordinator also installs one package-owned disposal
+target. Epoch self-quarantine makes the outer coordinator inert before
+subscription cleanup continues, so search work cannot outlive its epoch
+authority. The target is receiver-free, invoked at most once, and its failure
+cannot reopen disposal. It is synchronously exact-return and must return
+`undefined`; any other runtime result is detached and rejection-drained.
 
 A search that discovers a higher epoch supersedes itself instead of publishing
 against its older captured revision. Pages and cache entries from different
@@ -555,7 +561,9 @@ callback can always create a poisoned or independent unhandled rejection that
 no JavaScript library can retroactively contain. Legitimate asynchronous
 teardown must consume or report its own failure before the cleanup closure
 returns `undefined`. The valid `undefined` path returns without Promise
-allocation or a microtask. A closure avoids a structural TypeScript
+allocation or a microtask. Detached assimilation uses module-captured Promise
+intrinsics, so replacing the global Promise constructor cannot disable the
+drain. A closure avoids a structural TypeScript
 contract that would accept class instances or inherited methods which the
 hostile runtime boundary could not safely validate. Dropping the last owner
 removes the complete scope incarnation before cleanup. A later join creates a
@@ -654,6 +662,8 @@ outcomes settle through a discriminated request result.
 Completion is latest-wins per session:
 
 - a new completion request supersedes the previous request;
+- a new request that cannot capture an active epoch still supersedes and
+  detaches the previous request before reporting its unavailable outcome;
 - same-key supersession atomically attaches the new request consumer, or
   retags the existing observer as that consumer, before removing old request
   ownership; different-key supersession revokes the old observer first;
@@ -744,6 +754,25 @@ refresh notification and leaves the already-returned incomplete result valid.
 No optional catalog promise can keep `complete()` pending indefinitely or
 block the local baseline past its product response budget.
 
+The first implementation increment of this section is intentionally
+package-private. It combines an authenticated provider with the epoch
+coordinator and owns the fixed 8-active/64-queued scheduler, exact-key
+in-flight sharing, one latest-wins consumer per owner, independent
+cancellation, absolute queue and execution deadlines, response decoding, and
+epoch publication. An owner captures its scope and dialect when prepared, so
+individual requests cannot substitute provider, scope, dialect, or epoch
+authority. The authenticated dialect runtime owns its canonical provider ID;
+callers cannot pair an unrelated ID and runtime. Establishing the first
+baseline re-keys other joinable unobserved work in that scope, allowing
+newly-observed consumers to join it without duplicating a provider call.
+
+Cache entries, loading/retry policy, refresh observers and their leases, the
+40 ms completion-response budget, pagination composition, ranking, session
+composition, and CodeMirror integration do not belong to that increment. They
+remain explicit follow-up increments; the coordinator must not expose a
+premature public surface that makes those deferred semantics difficult to add
+or test.
+
 The exact structural cache and shared-work key contains:
 
 - service-owned provider configuration identity and unique provider ID;

src/vnext/__tests__/relation-catalog-boundary.test.ts

@@ -5,6 +5,7 @@ import {
   createSqlCatalogSearchRequest,
   decodeSqlCatalogInvalidation,
   decodeSqlCatalogSearchResponse,
+  isValidSqlCatalogScope,
   MAX_CATALOG_CONTINUATION_TOKEN_LENGTH,
   MAX_CATALOG_DETAIL_LENGTH,
   MAX_CATALOG_ENTITY_ID_LENGTH,
@@ -345,6 +346,29 @@ describe("relation catalog provider capture", () => {
   });
 });
 
+describe("catalog scope validation", () => {
+  it("accepts only bounded, non-NUL, well-formed text", () => {
+    expect(isValidSqlCatalogScope("connection:primary")).toBe(true);
+    expect(
+      isValidSqlCatalogScope(
+        `\ud83d\ude80${"x".repeat(MAX_CATALOG_SCOPE_LENGTH - 2)}`,
+      ),
+    ).toBe(true);
+    for (const candidate of [
+      null,
+      1,
+      "",
+      "bad\0scope",
+      "\ud800",
+      "\ud800x",
+      "\udc00",
+      "x".repeat(MAX_CATALOG_SCOPE_LENGTH + 1),
+    ]) {
+      expect(isValidSqlCatalogScope(candidate)).toBe(false);
+    }
+  });
+});
+
 describe("catalog search request snapshots", () => {
   it("copies and recursively freezes the exact provider request", () => {
     const raw = request();

src/vnext/__tests__/relation-catalog-epoch-coordinator.test.ts

@@ -236,6 +236,108 @@ describe("catalog epoch coordinator construction and membership", () => {
     expect(reads).toBe(0);
   });
 
+  it("validates, drains, and invokes the package disposal target exactly once", async () => {
+    expect(
+      Reflect.apply(createSqlCatalogEpochCoordinator, undefined, [
+        capturedProvider(),
+        undefined,
+        1,
+      ]),
+    ).toEqual({
+      reason: "invalid-disposal-target",
+      status: "unavailable",
+    });
+
+    let disposalCalls = 0;
+    const created = createSqlCatalogEpochCoordinator(
+      capturedProvider(),
+      undefined,
+      () => {
+        disposalCalls += 1;
+        throw new Error("package disposal target failed");
+      },
+    );
+    expect(created.status).toBe("created");
+    if (created.status !== "created") {
+      throw new Error("Expected a coordinator fixture");
+    }
+    expect(() => {
+      created.coordinator.dispose();
+      created.coordinator.dispose();
+    }).not.toThrow();
+    expect(disposalCalls).toBe(1);
+
+    const invalidReturn = Promise.reject(
+      new Error("invalid async package disposal"),
+    );
+    const withInvalidReturn = Reflect.apply(
+      createSqlCatalogEpochCoordinator,
+      undefined,
+      [
+        capturedProvider(),
+        undefined,
+        () => invalidReturn,
+      ],
+    );
+    expect(withInvalidReturn.status).toBe("created");
+    if (withInvalidReturn.status !== "created") {
+      throw new Error("Expected a coordinator fixture");
+    }
+    withInvalidReturn.coordinator.dispose();
+    await Promise.resolve();
+    await Promise.resolve();
+  });
+
+  it("drains a plain thenable with captured Promise intrinsics after the global constructor is replaced", async () => {
+    const intrinsicPromise = Promise;
+    let thenCalls = 0;
+    const thenable = new Proxy(
+      {},
+      {
+        get(target, property, receiver): unknown {
+          if (property === "then") {
+            return (
+              _resolve: (value: unknown) => void,
+              reject: (reason?: unknown) => void,
+            ): void => {
+              thenCalls += 1;
+              reject(new Error("detached plain thenable"));
+            };
+          }
+          return Reflect.get(target, property, receiver);
+        },
+      },
+    );
+    function HostilePromise(): never {
+      throw new Error("mutable global Promise was used");
+    }
+    expect(
+      Reflect.set(globalThis, "Promise", HostilePromise),
+    ).toBe(true);
+    try {
+      const created = Reflect.apply(
+        createSqlCatalogEpochCoordinator,
+        undefined,
+        [
+          capturedProvider(),
+          undefined,
+          () => thenable,
+        ],
+      );
+      expect(created.status).toBe("created");
+      if (created.status !== "created") {
+        throw new Error("Expected a coordinator fixture");
+      }
+      const createdCoordinator = created.coordinator;
+      expect(() => createdCoordinator.dispose()).not.toThrow();
+    } finally {
+      Reflect.set(globalThis, "Promise", intrinsicPromise);
+    }
+    await intrinsicPromise.resolve();
+    await intrinsicPromise.resolve();
+    expect(thenCalls).toBe(1);
+  });
+
   it("validates exact bounded well-formed scopes without raw errors", () => {
     const owner = coordinator();
     expect(