fix(lcm): FTS parity COUNT(*) ran under _LOAD_LOCK on every engine load (freeze #3)

[Kyzcreig]

Card: t_d3963974. Not merged. No deploy and no gateway restart; the operator owns both.

Root cause

_fts_needs_rebuild_structural (db_bootstrap.py:2420-2432 on main) ran SELECT COUNT(*) FROM messages (SCAN messages USING COVERING INDEX idx_msg_session_ts, 2.5M rows) and COUNT(*) FROM messages_fts_docsize on every MessageStore/SummaryDAG construction, under _LOAD_LOCK. Cold measurement on an APFS clone of the fleet DB: 13.4 s of a 17.9 s MessageStore() init. Live on 2026-09-24: 163x PHASE=context_engine_load_slow, held 49-64 s, waited up to 120 s. The two autocommit COUNTs could also straddle an ingest: 15/300 false mismatches, each followed by a full inline FTS rebuild (held 779.8 s, <=12 waiters, from py-spy samples).

Provenance

• Introduced: 8b869633a4 (2026-06-16, "feat: vendor LCM context engine"), _fts_needs_rebuild_structural lines 308/315-317. Found with git log -S content_count / -S docsize_table / git blame; the only hit for all three is 8b86963.
• 27b617846e (08-06 re-vendor): no +/- lines touching the count; carried it unchanged.
• d8b2d2448e fix(lcm): search_content backfill probe was a full-table scan on every boot (10 GB, ~21 min, all turns parked) — partial index + batched commits #887, 4964ea0518 fix(lcm): ingested_at backfill = second full-table scan on every boot; gate one-time backfills behind lcm_migration_state + lint the init path #902, 4806d08c8b test(lcm): regression layer for the boot-scan class (query-plan + scale-ratio + init-path lint) and a loud context_engine_load_slow signal #903: 0 diff lines touching COUNT/docsize/_fts_needs_rebuild. None of them introduced it. test(lcm): regression layer for the boot-scan class (query-plan + scale-ratio + init-path lint) and a loud context_engine_load_slow signal #903's plan check ("SCAN messages" in plan and "USING COVERING INDEX" not in plan, and skipping every messages_fts statement) is why it stayed hidden. Growth of the DB is what made it visible.

Fix

Fix:

• The parity check moves to _fts_count_parity_mismatch. It never runs on
  the throttle=True (load) path. A metadata marker
  (fts_parity_checked_at:) throttles it to once per
  LCM_FTS_PARITY_CHECK_INTERVAL_HOURS (default 6 h). When due, it runs
  on the existing background integrity thread (own connection). A
  mismatch sets the /lcm doctor integrity flag instead of rebuilding
  inline. Both counts are read in one snapshot.
• Explicit repair (throttle=False) and /lcm doctor still run parity
  synchronously.
• A no-op load writes nothing:
  • _clear_integrity_failed runs only after a real repair. Before, it
    also erased the background corruption flag on every load.
  • The messages_dedup_v1 and schema_version upserts are marker-gated.
  • The integrity claim uses a 1 s busy timeout, not 30 s.
• Lifecycle GC (on_session_start, every agent init):
  • no longer holds BEGIN IMMEDIATE across two SELECT DISTINCT
    session_id full scans;
  • uses indexed per-session probes;
  • runs at most once per 6 h per process.
• _backfill_search_content no longer rewrites NULL over NULL for
  undecryptable rows. That rewrite fired msg_fts_update on every boot.

Evidence

RED (new test, unmodified plugins @ df43599):

E       AssertionError: engine load / session start full-scans a guarded table (the Apollo-freeze class):
E         SELECT COUNT(*) FROM "messages"  ->  SCAN messages USING COVERING INDEX idx_msg_session_ts
E         SELECT COUNT(*) FROM "messages_fts_docsize"  ->  SCAN messages_fts_docsize
E         SELECT DISTINCT session_id FROM messages  ->  SCAN messages USING COVERING INDEX idx_msg_session_ts
E         SELECT DISTINCT session_id FROM summary_nodes  ->  SCAN summary_nodes USING COVERING INDEX idx_nodes_session_node
E       sqlite3.OperationalError: database is locked
E               Failed: engine construction needed the write lock (issued a write on the load path): database is locked
E       AssertionError: an ordinary (no-op) open erased the background scan's corruption flag
E       assert (None is not None)
FAILED tests/context_engine/test_lcm_init_cost_regression.py::test_second_open_issues_no_full_scan_of_guarded_tables
FAILED tests/context_engine/test_lcm_init_cost_regression.py::test_engine_construction_needs_no_write_lock
FAILED tests/context_engine/test_lcm_init_cost_regression.py::test_ordinary_open_keeps_background_corruption_flag
3 failed, 1 passed in 4.21s

GREEN: 4 passed in 5.56s. Full tests/context_engine/: 393 passed in 50.15s. ruff: clean.

Deploy (operator)

After merge to main: ~/.hermes/fleet/deploy.sh (fast-forwards the runtime tree to fork/main, then restarts through safe-gateway-restart). --no-restart stages the deploy only. New knob: LCM_FTS_PARITY_CHECK_INTERVAL_HOURS (default 6).

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[Kyzcreig]

🤖 merged-by: aegis · lane: incident-recovery · gate: BYPASS: No terminal FleetReview record for PR #966 yet; active Apollo outage, scoped Aegis review and all required CI green; retain merge-queue integration gate · why: Apollo production LCM freeze #3: 2.8M-row parity scan and false rebuild race; deterministic RED/GREEN, 394 context_engine tests green, required CI green; Ace explicitly requested merge/deploy ASAP