feat(storage): give a convergence the budget its caller can afford to wait

[aparajon]

SchemaBot converges its own storage schema on every boot, under an advisory lock that keeps two instances from converging at once. That convergence is bounded by a five-minute budget, and the budget is short for an availability reason rather than a DDL one: a pod converging is a pod not yet serving, and while it holds the lock no other instance can start either.

storage apply lets an operator run that same bootstrap deliberately, from a terminal, ahead of a roll. Because it is the same code, it inherited the same five minutes — which took the work out of the roll but not out of the ceiling. The case the command exists for, an index over a table with a long history, still timed out from the terminal and still had to be built by hand.

The budget now follows the path that asked rather than the code that runs. It is an option threaded through both bootstrappers' contexts and both advisory-lock waits, defaulting to the boot budget so a caller that names none keeps a boot's guarantee, and seeded to an hour in front of the operator path's options so a caller's own budget still wins. On PostgreSQL the per-statement DDL budget derives from the effective budget rather than once from the boot constant, so a raised ceiling is not silently re-capped per statement. --timeout lowers it for a run that should fail fast.

An operator runs storage apply ahead of a roll. The only outstanding DDL is an index over a table with eight years of rows, and the build takes 22 minutes.

Before                                       After

┌──────────────────────────────┐             ┌──────────────────────────────┐
│ storage apply                │             │ storage apply                │
│ budget: 5m — a boot's        │             │ budget: 1h — an operator's   │
└──────────────┬───────────────┘             └──────────────┬───────────────┘
               │ index build, 22m                           │ index build, 22m
               ▼                                            ▼
┌──────────────────────────────┐             ┌──────────────────────────────┐
│ 5m: context deadline         │             │ 22m: the DDL completes       │
│ the copy is abandoned        │  ✗          │ the lock is released         │
└──────────────┬───────────────┘             └──────────────┬───────────────┘
               │                                            │
               ▼                                            ▼
┌──────────────────────────────┐             ┌──────────────────────────────┐
│ storage still unconverged    │             │ storage is converged         │
│ the index is built by hand   │             │ the roll finds nothing to do │
└──────────────────────────────┘             └──────────────────────────────┘

The maximum is held at the default. A convergence cannot yet be stopped once it starts — the context is built from Background so a caller hanging up cannot abandon a table copy half-done, which means the budget is the only thing that ends one early. An hour of held lock is already the outer edge of what should be untakeable-back. Raising the cap is the payoff of the follow-up that adds storage cancel, not something to do before it.

Out of range is refused rather than clamped, in both directions, so a command never reports a budget it did not get. That includes a duration the wire's whole seconds cannot carry: --timeout 500ms would truncate to the zero that means "no preference" and come back as the hour.

A budget above the maximum

$ schemabot storage apply --timeout 2h
Error: --timeout: a convergence budget of 2h0m0s exceeds the maximum of 1h0m0s; a convergence holds the storage bootstrap lock for its whole budget and cannot yet be stopped, so pods booting in that window will not come up

A budget the request cannot carry

$ schemabot storage apply --timeout 500ms
Error: --timeout: a convergence budget of 500ms is shorter than the one second the request carries; name a whole number of seconds

Invariants

• Establishes AV-11 — a storage convergence is bounded by what its caller can afford to wait. Enforced by the non-positive refusal at the shared entry point before any dialect is dispatched to, the operator path's seeded default, and apitypes.ResolveStorageApplyTimeout at both ends of the wire.
• Establishes AV-12 — a storage convergence records nothing in the storage it converges. This one is not new behavior: the convergence entry points take a connection string rather than a store, so no row is written today. What is new is that something holds it there. Raising the operator budget to an hour makes a convergence a long-lived thing running against a live serving instance, which is exactly when someone reaches for "record that this happened" — and that write would land in a table being rewritten, or on a first boot in a table that does not exist yet. Enforced on both dialects by converging a seeded database and requiring the row count of every table in the live catalog to come through unchanged; the census reads the catalog rather than a list, so a table added to the embedded schema is covered without anyone extending the test. Both tests were checked against an injected write on each bootstrapper and fail on it.
• Upholds AV-9 unchanged. The budget is not a schema source and the destructive gate is untouched; this PR modifies all four files AV-9's *Enforced:* line names, and enforcement stays in each of them.

⚠️ ID collision to resolve: #1389 also takes AV-11. Whichever of the two merges second needs to renumber — to AV-13 if this PR lands first, since it takes AV-12 as well.

Opened by Claude Code (Opus 5).