perf(add): cache verified remote candidates

[forhappy]

Summary

• add a bounded in-memory LRU for proof-backed remote chunk candidates
• persist successful candidates in a bucket/global-prefix scoped SQLite cache
• batch persistent lookups, cap the cache at 2,000,000 rows, and retain push-time proof revalidation

Correctness

Cached values are advisory only. Push still revalidates placement and origin proofs; cache failures, stale rows, and eviction fall back to the existing remote proof/local-authority path. No negative results are persisted.

Validation

• cargo fmt --all
• git diff --check
• Existing Rust quality/tests and integration checks passed on the preceding merged PR.
• A new local Cargo compile was not run because the required $HOME/Workspace build volume is unavailable on this host per AGENTS.md.

[forhappy]

Follow-up hardening in 5f5bd8b: cache directory creation now uses Crab's private non-symlinked cache-directory guard before opening SQLite.

[forhappy]

Performance follow-up in ee3730c: persistent-cache row-count/eviction is sampled once per 64 write batches instead of scanning the SQLite table on every add lookup batch, keeping the hot path bounded and avoiding repeated COUNT(*) work.

[forhappy]

Async-runtime hardening in 4c8cabb: persistent SQLite reads and writes now run on spawn_blocking, so large candidate batches cannot stall Tokio executor threads. The in-memory LRU remains synchronous and bounded.

[forhappy]

Clippy cleanup in 432c9e3: sampled eviction now uses the repository's is_multiple_of idiom.

[forhappy]

CI fix in 3a4e9c5: converted SQLite-decoded [u8; 32] values back into the workspace MerkleHash/DataHash type at the cache boundary. The failing cache-service manifest compile was caused by this explicit type mismatch.

[forhappy]

Additional write-path optimization in 5b2f3a2: identical candidate refreshes now become SQLite no-ops via a conditional upsert, reducing WAL/page churn while changed placements still replace stale rows. Added a refresh regression assertion.

[forhappy]

Follow-up optimization on 223c30b: path-qualified literal selectors (for example models/weights.bin) now use direct metadata/classifier/ignore checks and avoid an O(repository-files) walk. Ambiguous basenames, globs, directories, magic selectors, and missing paths retain the exhaustive walker. Added regression coverage for direct selection, hidden-parent/traversal rejection, and duplicate-safe behavior. Local fmt/metadata/diff checks pass; Cargo execution remains deferred because the required $HOME/Workspace target volume is unavailable.

[forhappy]

Follow-up optimization on 546c848: multi-file uncached xorb linking now builds one preparation-wide chunk ownership map. Completed xorbs resolve recipients by placement hash instead of scanning every file/placement pair, preserving deterministic file-order ownership and the no-owner invariant. Added a regression test for shared-chunk recipient linking. This removes the quadratic linking cost for large multi-file adds.

[forhappy]

Follow-up cache optimization on 21b92e8: persist confirmed remote misses in a separate bounded v1 SQLite table. New add processes can skip repeating proof lookups for chunks previously confirmed absent; positive/negative updates are atomic and mutually replace each other. Stale negatives are advisory and only cause local repacking; positive push candidates remain proof-revalidated. Added negative-entry round-trip/refresh coverage.

[forhappy]

Final rebased commit is 72a174c (same cache optimization surface after formatting/robustness cleanup). Branch remains descended from origin/main; unrelated worktree edits are not included.

[forhappy]

Follow-up hardening on 0e249e0: confirmed negative remote-cache entries now carry observed_at timestamps and expire after five minutes. Lookup lazily removes expired/future-skewed misses; legacy v1 miss tables gain the timestamp column with a zero default, so old observations expire immediately. Positive candidates remain unchanged and proof-revalidated.

[forhappy]

Final commit after TTL hardening: 0e249e0. Branch remains rebased on origin/main; formatting, metadata, and diff checks pass. CI has been retriggered for this commit.

[forhappy]

Follow-up on 924159d: path-qualified literal directory selectors now walk only the selected subtree. Overlapping roots are deduplicated; direct files and directory results are path-deduplicated; nested .gitignore precedence and hidden-directory rules remain enforced. Glob, basename, magic, and missing selectors retain the full walker.

[forhappy]

Final commit after directory-selector hardening: d275118. Path-qualified literal directories now restrict traversal to selected roots with overlap/path deduplication and nested ignore handling; all ambiguous selectors retain the full walk. Formatting, metadata, and diff checks pass.

[forhappy]

Final commit 5f5fad5 includes a small allocation optimization: uncached multi-file xorb payloads are moved directly into the content-addressed writer instead of cloning the Bytes buffer. This preserves payload hashing/identity checks while removing one refcount/copy path.