[lucidprogrammer]

Hosted runs (head ea9b7e29):

• Linux: CI 40253959199 — green, 20 min 32 s.
• macOS: CI 40253959207 — green, 45 min 25 s (best achievable on the free macOS runners).

Pinned to ContextDB dev 56dccfdc.

What changed

Writes during a reindex are no longer refused. A write's own lookups (embedding-space registry, the entity it attaches to, its own invalidations) ran in the bounded user read session, so while a reindex committed row by row they could wait past the 5 s read budget and the write failed with ReadActiveTimeExceeded. They now run as ordinary statement reads of committed data; every public read keeps its budget. Guard: observation_recorded_while_a_reindex_commit_holds_the_commit_boundary_is_not_refused_by_the_read_budget.

Route validation reports the real refusal. Embedding-route validation no longer turns every lookup error into UnknownEmbeddingSpace.

Deterministic tests. Fixtures that polled with sleeps now wait on explicit events, checkpoints or a seamed clock; a ratchet over private fixtures keeps the count of timed sites from growing. digest_immutable_no_update_symbol no longer starts a nested dependency build (600 s+ on macOS): it proves at compile time that Store exposes no public update_digest, and tests/compile_fail.rs still runs the full UI check. The temporary macOS trybuild diagnostics that traced that build are removed.

Dependencies. ContextDB re-pinned to dev 56dccfdc; tokio 1.54.1, ctutils 0.4.5, rustls-webpki 0.103.16 and webpki-root-certs/webpki-roots 1.0.10 (RUSTSEC-2026-0381, -0382, -0383, -0385, -0386); lockfile changes limited to those packages.

Commit (on dev 09b1c591)

ea9b7e29 store, ci, tests, deps: preserve writes during reindex, add macOS checks, make fixtures deterministic, and update dependencies

Known, fixed upstream and not yet on ContextDB dev

• Two subscription tests can report delivered == 2 on macOS: the engine can hand an out-of-scope event to a context-scoped sink. Reproduced and fixed in the bounded-storage work; arrives with its dev landing.
• readers_are_never_refused_while_another_process_reopens_the_store can fail rarely (1 in ~1,400 reopens): a reader is refused while a writer opens the store. Same landing.
• Remaining timed waits in subscription and maintenance fixtures need the engine's test seams from that landing.

Cross-family review (Grok)

The collapsed tree is identical to the reviewed tree (d39033b6). SHIP on every change after fixes: lockfile limited to tokio after a STEER on unrelated edges; manifest and lockfile hash pins refreshed after a STEER; the digest compile-time check now rejects every public form after a STEER on a generic update_digest<T>() -> T.