HW-13: make SQLite contention policy explicit

[skylarbpayne]

Summary

• freeze HW-13 v1 as an admission-bounded SQLite retry policy, not a completion or publication deadline
• durably emit sqlite.lock_retry and re-check the usable lease budget before every additional SQLite operation
• return an admitted operation's normal result immediately, with no post-success elapsed-time failure or diagnostic callback
• remove sqlite.lock_recovered from v1; the durable retry record plus the normal result is the recovery trace
• preserve writable PRAGMA, WAL refusal/offline migration, storage-doctor, unsupported-filesystem, and stop/checkpoint/switch/start behavior

Frozen v1 contract

The lease budget controls whether a retry may begin. After a known BUSY/LOCKED failure, run_with_lock_retry() emits sqlite.lock_retry, applies bounded jitter/sleep, re-reads monotonic time immediately before another operation, and starts it only when elapsed_ms + busy_timeout_ms <= lease_budget_ms. Failed admission durably emits sqlite.lock_exhausted and raises without another operation.

The operation callable is one bounded SQLite unit using the configured busy timeout and owns domain idempotency. Once an admitted operation returns normally, its result is authoritative. V1 does not promise wall-clock completion/publication within the lease budget and does not emit sqlite.lock_recovered; those semantics require a separately specified transaction-aware successor.

TDD and verification

• red: frozen-contract selection produced 4 expected failures (sqlite.lock_recovered still emitted and late admitted success translated to exhaustion)
• Python 3.9 focused: 20 passed in 0.25s
• Python 3.11 focused: 20 passed in 0.27s
• Python 3.9 contention probe: normal written result, one or more durable sqlite.lock_retry records, exactly one target write
• Python 3.11 contention probe: normal written result, one or more durable sqlite.lock_retry records, exactly one target write
• Python 3.9 full: 649 passed, 1 skipped in 35.01s
• Python 3.11 full: 648 passed, 2 skipped in 29.52s
• fixture SHA-256: edb753f16920807120362d9570cc5a75da70b113c24d4ab0daccc05e44837634
• exact net diff allowlist: 5/5 required paths, no extras; .hermes/showcase-artifacts/** unchanged

Ancestry and scope

• immutable head: d8d7e5f4a97a672d2e1b35de4ac2a0318bf5d0df
• required base/current main 4674210f67d6d8ab4cf86abeb9ae330124c75294 remains an ancestor
• FND-RT 583459d3ee36dae63f89dbd87d175f91b53ec39d and FND-OP 2727a46b1a799a4a2125d3b85e292db514f1fb98 remain ancestors
• excluded PR feat: support custom select values in review queue #131 head fc9eb5ae0797c5cbdfcf51d6b9be551e6ba85331 is not an ancestor

Operational boundary

No merge, install, deploy, live registry/database/profile mutation, service restart/reconfiguration, cron change, or external side effect was performed.

Do not merge. This immutable head requires exactly one fresh Palmer-only SR, then only on SR PASS one separate fresh Palmer-only QR at the same head.

[skylarbpayne]

Closing unmerged under the frozen Disposition C gate. The sole final Palmer SR at d8d7e5f found that macOS filesystem detection uses BSD stat -f %T, returns / instead of a filesystem type, and therefore cannot fail closed on unsupported NFS/SMB storage. No QR, repair3, retry review, merge, install, deploy, or live mutation is authorized for this lane; branch/worktree remain as audit evidence.