feat(account): finish C1 authority projection and query seams

[skakri]

Closes #604.

Completes the remaining C1 spine from the frozen phase-C v5 design:

• finishes the stratified account fold, control-side stream ownership/grant/revoke effects, contested recovery, and point-in-time authority facts
• adds monotone auth_len readiness gating so parked authority cannot leak registers or state while recoverable dependency failures are recomputed
• adds V064 authority projection and atomic backfill/rollback coverage
• exposes typed roster, owner, stream, and combined grant/device queries; grant plus device boundary is read from one SQLite snapshot and fails closed as Open, Cut, or Closed
• keeps raw grant/cut helpers private to the account module
• adds defensive fold, migration, transaction, corruption, order-independence, laundering, state-replay, and two-connection WAL snapshot tests

Validation:

• cargo +nightly fmt --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo nextest run --workspace (2634 passed)
• three final adversarial reviews: no actionable blockers

[github-actions]

SCIP oracle — resolution report

Heuristic→compiler edge resolution per corpus. Δ compares resolved-after to the main baseline (only when the corpus profile + tool version match).

corpus	tool	edges	resolved (heuristic → compiler)	precision	recall	monikers	Δ vs main
c-libuv	scip-clang	12283	37.8% → 47.8%	89.3%	48.7%	679	+0.0pp
cpp-yaml	scip-clang	9223	43.2% → 73.1%	82.8%	40.1%	1038	+0.0pp
py-django	scip-python	12937	29.8% → 73.5%	93.7%	84.1%	3036	+0.0pp
py-rich	scip-python	8383	27.6% → 92.3%	95.0%	81.3%	1098	+0.0pp
rust-time	rust-analyzer	11040	37.5% → 58.7%	68.7%	83.6%	510	+0.0pp
ts-rxjs	scip-typescript	7875	39.6% → 94.9%	87.3%	77.4%	626	+0.0pp

_{resolved = Exact/Syntactic + compiler upgrades + resolved-external, over edge candidates with a callee range. precision/recall are the oracle eval metrics.}

[codecov]

Codecov Report

❌ Patch coverage is 98.21189% with 40 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
crates/rag-rat-core/src/oplog/account/fold.rs	97.52%	23 Missing ⚠️
crates/rag-rat-core/src/oplog/account/storage.rs	98.31%	17 Missing ⚠️

📢 Thoughts on this report? Let us know!

[github-actions]

Bencher Report

Branch	feat/604-c1-finish
Testbed	ubuntu-latest

⚠️ WARNING: No Threshold found!

Without a Threshold, no Alerts will ever be generated.

• LL Hits (hits)
• RAM Hits (hits)
• Instructions (instructions)
• Total read+write (reads/writes)
• L1 Hits (hits)
• Estimated Cycles (cycles)

Click here to create a new Threshold
For more information, see the Threshold documentation.
To only post results if a Threshold exists, set the --ci-only-thresholds flag.

Click to view all benchmark results

Benchmark	Estimated Cycles	cycles x 1e6	Instructions	instructions x 1e6	L1 Hits	hits x 1e6	LL Hits	hits x 1e6	RAM Hits	hits x 1e3	Total read+write	reads/writes x 1e6
rag_pipeline::pipeline::index cargo_resolver:resolver_config()	📈 view plot ⚠️ NO THRESHOLD	2,346.40 x 1e6	📈 view plot ⚠️ NO THRESHOLD	1,534.39 x 1e6	📈 view plot ⚠️ NO THRESHOLD	2,088.94 x 1e6	📈 view plot ⚠️ NO THRESHOLD	42.38 x 1e6	📈 view plot ⚠️ NO THRESHOLD	1,301.26 x 1e3	📈 view plot ⚠️ NO THRESHOLD	2,132.63 x 1e6
rag_pipeline::pipeline::query_cold cargo_resolver:resolver_built_config()	📈 view plot ⚠️ NO THRESHOLD	350.30 x 1e6	📈 view plot ⚠️ NO THRESHOLD	232.84 x 1e6	📈 view plot ⚠️ NO THRESHOLD	334.50 x 1e6	📈 view plot ⚠️ NO THRESHOLD	2.99 x 1e6	📈 view plot ⚠️ NO THRESHOLD	24.61 x 1e3	📈 view plot ⚠️ NO THRESHOLD	337.51 x 1e6
rag_pipeline::pipeline::query_warm cargo_resolver:resolver_index()	📈 view plot ⚠️ NO THRESHOLD	336.29 x 1e6	📈 view plot ⚠️ NO THRESHOLD	223.71 x 1e6	📈 view plot ⚠️ NO THRESHOLD	321.42 x 1e6	📈 view plot ⚠️ NO THRESHOLD	2.80 x 1e6	📈 view plot ⚠️ NO THRESHOLD	25.40 x 1e3	📈 view plot ⚠️ NO THRESHOLD	324.24 x 1e6

🐰 View full continuous benchmarking report in Bencher

[github-actions]

Bencher Report

Branch	feat/604-c1-finish
Testbed	ubuntu-latest

Click to view all benchmark results

Benchmark	Latency	Benchmark Result seconds (s) (Result Δ%)	Upper Boundary seconds (s) (Limit %)
index_time/full_rebuild_cargo	📈 view plot 🚷 view threshold	5.11 s (-11.62%) Baseline: 5.78 s	7.65 s (66.79%)

🐰 View full continuous benchmarking report in Bencher

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 134d431159

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".