fix(reconcile): bound cursor result authority

[seonghobae]

Summary

Bound reconciliation-store database-result authority without changing schema, provider I/O, scheduler, tenant authority, recovery semantics, central .github, or protected main.

Current branch: fix/reconciliation-fetchall-boundary-b84f0c9
Protected main: main@5913c4bad79d6bc29d7cc1c624abb7db2ea6a77c
Current PR base: fix/recovery-evidence-weakref-coverage-b84f0c9@01d231fde23b82e2ced258d7bfcb4721ed75706d (#233)
Current exact head: e65b208b0c942b6df6a787fe13641c79288966a7
State: Draft/open/mechanically mergeable, explicitly stacked on dependency root #233.

Database-result authority

This branch:

1. requests finite DB-driver materialization with cursor.fetchmany(max_candidates + 1) instead of unbounded fetchall();
2. rejects behavior-bearing result-container subclasses before overridden iteration executes;
3. rejects pages exceeding the validated max_candidates budget instead of trusting SQL LIMIT or cursor behavior alone;
4. snapshots at most budget + 1 outer rows before candidate conversion so concurrent caller mutation cannot widen a validated page;
5. snapshots mutable list rows through at most three members and requires exactly two members before immutable conversion;
6. preserves exact tuple rows as immutable authority while rejecting invalid row factories and non-string identity primitives before behavior-bearing normalization; and
7. rejects overlong persisted endpoint aliases and remote batch IDs with O(1) length checks before alias normalization or remote-ID regex validation.

The query remains parameterized and retains LIMIT %s; bounded fetchmany is an additional result-materialization boundary, not a replacement for the SQL limit.

Current-parent reconciliation

Fresh inspection found that the named #233 base had advanced from historical 04a6e2450a6df4bff34c797e1828b43fe73a6bf6 to current 01d231fde23b82e2ced258d7bfcb4721ed75706d, while this branch remained at 271181b17a8fe043d9410f3a8e4a4fecfa1183ad. Relative to current #233 that was a real stale-parent topology: 20 ahead / 4 behind, merge base 04a6e245....

The four intervening #233 commits change only CI/release workflow ownership and tests/test_workflow_contracts.py; they do not overlap this PR's reconciliation-store paths. Repair commit e65b208b0c942b6df6a787fe13641c79288966a7 is an ordinary two-parent reconciliation whose first parent is unchanged #258 head 271181b... and second parent is current #233 01d231f.... The tree is current #233 plus only this PR's four owned blobs. Branch publication was fast-forward only (force=false); no rebase or history rewrite was used.

Fresh compare now reports 21 ahead / 0 behind with merge base exactly 01d231fde.... Relative semantic delta remains exactly:

• pg_llm_batch/reconciliation_store.py;
• tests/test_reconciliation_store.py;
• tests/test_reconciliation_store_failures.py;
• tests/test_reconciliation_store_result_boundary.py.

The root coverage/workflow tests remain owned by #233 and are inherited rather than copied into this PR's relative delta.

Exact-head validation

Fresh generation belongs only to exact e65b208b0c942b6df6a787fe13641c79288966a7:

• CI 34458718111: SUCCESS;
• Release Acceptance 34458718081: SUCCESS.

CI verified the exact source head in all five jobs. Python 3.10/3.12/3.14 unit jobs passed. The quality job passed compile, Ruff, 100% public-docstring gate, 100% production coverage gate, lock freshness, and package build. Container/image and PostgreSQL runtime smokes passed. Release Acceptance checked out the exact PR head, materialized two clean exact-head source trees, built both distribution sets, verified artifact identity, and preserved bounded reproducibility evidence successfully.

Historical runs remain evidence only for the heads that executed and are not transferred to this reconciled head. Fresh formal-review and inline-thread inventory before reconciliation was empty; absence of review is not approval. Keep this PR Draft while #233 remains non-integrated and while current review authority is incomplete.

Integration boundary

#233 is the earliest integration root. Its leaf CI/Release Acceptance/Security/Semgrep evidence is GREEN, but required compatibility CodeQL remains failed and no qualifying independent approval is established. Central .github#2040 remains a read-only prerequisite for this lane: central protected main is cb0872c9a20d5584703dffacca65c096fc034c6c, while #2040 remains at historical-base head 6706c231ab06a3c91c43fdb5b989cfcd79fff593 and its CodeQL run 34251822255 is terminal failure. Fresh LineageWeave consumer reproductions on 2026-09-10 continue to show compatibility jobs reading the current-head dispatch verdict and then failing enforcement while dispatch itself succeeds, so this is still a canonical central defect, not a pg-llm-batch waiver opportunity.

After #233 reaches protected main, refetch protected main, this branch ancestry/mergeability, current-base workflows/checks, reviews and threads before any Ready/merge transition. No self-approval, synthetic status, routine bypass, force push, destructive rebase, or predecessor-evidence transfer is authorized.

Refs #102, #233, #244 and central .github#2040.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}