#509 Bound Codex SQLite recovery sweeps

Summary

• bound Codex SQLite recovery to 50 eligible threads per sweep, ordered newest-first, with a persisted resume cursor
• default SQLite-only recovery to a 30-day window with Rust SyncOptions and AI_HIST_CODEX_SQLITE_MAX_AGE_DAYS overrides
• batch projection/catalog lookups, skip complete rollouts, emit CaptureProgress, and run uncatalogued sources before established ones
• document the recovery policy and add cap/resume, cutoff, fingerprint, progress, and source-order coverage

Fixes #508

Validation

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• RUST_TEST_THREADS=4 cargo test --workspace --all-features
• RUST_TEST_THREADS=4 cargo test -p ai-hist --no-default-features
• cargo build -p ai-hist --no-default-features
• cargo publish --dry-run -p ai-hist --allow-dirty
• native binding contract verification
• env -u XDG_DATA_HOME npm test in sdk-ts (281 passed)
• node --test scripts/*.test.mjs (174 passed)
• node scripts/check-public-api.mjs
• node scripts/smoke-history-packages.mjs
• out-of-tree Rust consumer against this checkout
• node scripts/benchmark-sync.mjs --gate
• rust-oleum quality gate

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

[!NOTE]
Medium Risk
Changes core ingest/sync ordering, catalog ownership during Codex SQLite batches, and fingerprint fast-path behavior; mis-tuned cutoffs or cursor bugs could delay or skip thread recovery, though behavior is heavily tested.

Overview
Codex SQLite recovery is now bounded and resumable instead of walking every incomplete thread in one sync. Each sweep processes at most 50 eligible threads (newest first), persists a codex_sqlite_sweep_cursor_v1 cursor for the backlog, and marks coverage incomplete until the cursor clears or retries finish—so other providers can run between batches and scoped ticks still advance a pending backlog.

Policy knobs: SyncOptions::codex_sqlite_max_age_days (builder + field) and AI_HIST_CODEX_SQLITE_MAX_AGE_DAYS default to a 30-day updated_at window (0 disables). The source fingerprint includes the Codex SQLite cap/cutoff so policy changes cannot be skipped by the fast path.

Supporting behavior: sweep logic moves into providers/codex/sqlite/sweep, batches projection and raw_path catalog lookups via with_raw_path_cache, emits CaptureProgress as codex-sqlite, and runs sources with no catalog rows before established ones in registry order. Docs and changelog describe the recovery policy.

^{Reviewed by Cursor Bugbot for commit 305b68a9501a256a6adefac6aa11930a269b88c5. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Agent Relay sessions

• codex session 01a14571 · opened via gh pr create · last active 2026-10-16