Summary

• add the package-private bounded catalog search-work coordinator
• compose provider authentication, epoch authority, latest-wins ownership, cancellation, deadlines, and response publication
• harden hostile and reentrant lifecycle boundaries, including exact disposal hooks and captured Promise intrinsics
• document the scheduler contract and deferred cache/session/UI responsibilities in ADR 0005
• add strict API fixtures, invariant-heavy unit coverage, and capacity/performance benchmarks

Invariants

• at most 8 provider searches are active and 64 are queued
• owners join only exact structural request keys and supersede independently
• scope epoch changes retire same-scope work without crossing scope boundaries
• failed captures, invalid input, cancellation, disposal, overload, and deadlines settle promptly and exactly once
• provider calls, timers, clocks, thenables, callbacks, and response decoding may be hostile or reentrant without reviving retired work
• the authenticated dialect runtime is the sole dialect identity authority

Validation

• vitest: 1,856 passed, 1 expected failure
• changed coverage: 97.29% statements, 96.23% branches, 99.46% functions, 97.73% lines
• search coordinator: 97.03% statements, 95.09% branches, 100% functions, 97.84% lines
• epoch coordinator: 98.31% statements, 97.42% branches, 98.21% functions, 98.89% lines
• strict source, tests, vNext API fixture, loose-optional fixture, and demo typechecks
• zero-warning oxlint
• test-integrity gate
• 4 browser files / 7 browser tests
• exact-tarball package smoke test
• worker placement and bundle budgets
• production dependency audit: no known vulnerabilities
• catalog search-work benchmark suite
• two independent adversarial exact-head approvals

Part of #169.

Summary by cubic

Adds a package-private, bounded catalog search-work coordinator that composes provider auth with epoch authority to run searches safely, dedupe by exact keys, and enforce deadlines. Also centralizes catalog scope validation to a shared boundary utility. Progress toward #169.

• New Features

  • Added createSqlCatalogSearchWorkCoordinator with 8 active and 64 queued limits, exact-key in-flight sharing, and latest-wins per owner.
  • Owners capture scope and dialect; the authenticated dialect runtime defines the provider ID and epoch authority.
  • Independent cancellation, queue and execution deadlines, and a small synchronous budget; outcomes include usable, superseded, cancelled, and unavailable.
  • Safe response decoding and epoch publication; first baseline re-keys unobserved work in the same scope.
  • Benchmarks and strict unit/type tests for lifecycle, concurrency, deadlines, and adversarial scenarios.
  • ADR 0005 updated to document scheduler/deadlines and package-owned disposal semantics.

• Refactors

  • Epoch coordinator now accepts a package-owned disposal target, invokes it exactly once, and drains non-undefined returns with captured Promise intrinsics (resilient to a replaced global Promise).
  • Centralized scope validation into isValidSqlCatalogScope in the boundary; adopted by epoch and search-work paths with new tests.
  • Hardened lifecycle boundaries and cleanup; exact disposal and hostile thenable handling.
  • Dialect runtime exposes a stable id; tests assert coherence and deep-freeze properties.

^{Written for commit 061a3c6. Summary will update on new commits.}