Track owned repository opens and report migration progress and stalls

[samuelstroschein]

Repository opens could keep running after a requester timed out without exporting their unfinished parent span. Old-format admission called every pending open a migration, and the protocol deadline could incorrectly report capacity exhaustion.

The manager now owns a correlated opening operation with actual storage/engine phases, last completed work, and bounded structural diagnostics. Short completed spans report progress and terminal failures independently of the parent; a progress stall reports LIX_OPEN_STALLED while retaining the same opener and lifecycle guard. Request deadlines report a separate retryable opening error. SlateDB progress comes from actual dependency completions and durable bounded migration checkpoints; engine work-group counts remain monotonic across copy/repair stages, including sparse replica repairs. Terminal failures retain their operation context through cache cleanup instead of becoming retryable opening deadlines. Existing fencing, checkpoint resume, source preservation, and publication guards remain in force.

Deployment requires updating the server and SDK together. Existing physical repository storage remains migratable; compatibility with older SDK binaries is outside this change's scope.

LIX_SERVER_OPEN_STALL_TIMEOUT_SECS defaults to 300 seconds without completed work or a phase transition. Stall reporting does not cancel a started writer or start a replacement.

Validation:

• Strict Clippy passed for all targets/features of the engine, server and SlateDB packages; all 10 engine doctests and the server/SlateDB doctest suites passed.
• CI workflow/release tooling: 143 passed, one optional Docker test skipped; changenotes and server protocol validation passed.
• All 5,565 engine/server/SlateDB tests passed with all features (including all engine simulations); 99 existing ignored tests remained skipped. Formatting and diff checks passed.
• Seven matched in-memory trials per variant measured current-format open medians of 0.587 ms without a callback and 0.653 ms with a recording callback; 64-row physical migration medians were 305.655 ms and 305.168 ms. These are local callback-overhead checks, not remote-latency claims; individual samples were not retained.
• Regression coverage includes exported reports while the parent remains unfinished, retained ownership during stalls, resumption without a second opener, typed opening/deadline/stall policy, safe terminal diagnostics, durable checkpoint counting, resumed large-value copying, and source preservation after failure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T18:47:09.487469Z	c548575	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c5485750a7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".