Summary

• add a bounded exact-key ready-page cache with epoch-scoped invalidation
• add fail-closed loading barriers and retry gates for subscribed and unsubscribed providers
• add atomic refresh-observer transfer with reentrancy-safe availability dispatch
• document marimo connection-incarnation and unresolved-metadata semantics
• codify the accelerated candidate-boundary delivery cadence

Why

Catalog completion needs to reuse proven results without allowing stale pages, same-epoch loading transitions, remounted editors, or cache pressure to bypass epoch authority. This keeps the package-private scheduler, policy state, and observer lifecycle coherent before session composition and the public adapter are added.

Verification

• 1,895 tests passed; 1 expected failure
• changed coverage: 98.02% statements, 95.86% branches, 99.47% functions, 98.49% lines
• full typecheck, oxlint, test-integrity, browser, demo, and package smoke passed
• two independent exact-head adversarial reviews approved
• catalog scheduler benchmark passed

Summary by cubic

Adds a bounded, epoch-aware cache for catalog search to reuse “ready” pages without serving stale data, and introduces refresh leases to prevent duplicate provider work.

• New Features

  • Added SqlCatalogSearchPolicyStore: exact-key cache for ready pages with epoch-scoped invalidation.
    • Bounded by MAX_CATALOG_POLICY_STORE_ENTRIES (256) and MAX_CATALOG_POLICY_STORE_RETAINED_BYTES (2 MiB).
  • Integrated the policy store into relation-catalog-search-work with fail-closed loading/retry gates.
  • Added refresh leasing (retainForRefresh) and single-shot availability dispatch with reentrancy safety.
  • New default DEFAULT_CATALOG_REFRESH_LEASE_MS = 1000.
  • Exposed hasLiveSubscription(scope) on the epoch coordinator.
  • Updated ADR and implementation docs; added comprehensive unit and type tests.

• Migration

  • If you provide a custom SqlCatalogEpochCoordinator, implement hasLiveSubscription(scope).
  • Availability targets must be synchronous and return undefined.
  • Optional: tune refreshLeaseMs via search-work options; no other changes required.

^{Written for commit 803afd1. Summary will update on new commits.}