Migration safety: rebuild FTS after incompatible-index wipe, fail fast on embedder feature gap

[CorVous]

Summary

Three defects found while verifying the migration of a live instance (Sapphire, Python-era data) onto the Rust port. All are general port fixes — the migration just exposed them.

1. fix(history): rebuild FTS from DB when the on-disk index was wiped or empty. TantivyFts::open_or_recreate deletes any incompatible index dir (real case: every Python-written index — the on-disk schema has row_id.fieldnorms=false, the Rust schema builds true) and rebuild_fts had zero call sites, so a wipe left search permanently empty with no error. HistoryStore::open now repopulates any index that was recreated or is empty while its source table has rows (facts previously had no rebuild path at all). One-time, idempotent on reopen, INFO-logged.
2. fix(run): fail fast on embedder feature-gap before opening the store. create_embedder(...).unwrap_or(None) swallowed FastembedMissing; a fastembed config on a binary built without local-embed mutated the store/FTS and then died in create_projectors with a message recommending backend="hash" — wrapped in the "token may be invalid" hint. resolve_embedder now runs before Familiar::load_from_disk and surfaces the real error (naming local-embed), honoring the factory doc's "refuses to start" contract.
3. fix(activities): de-flake c1_state_cleared_before_wake_publish. Pre-existing since the Layer-3 port: the invariant holds in the implementation (state cleared strictly before wake publish, same task); the flake was recv_wake's 1s hang-guard racing 6–8 spawn_blocking DB round-trips under load (~5% idle, ~67% under CPU saturation). Raised to 30s — all six call sites .expect(Some), so no assertion weakened.

Plus a style: commit (rustfmt).

Verification

• Full suite green under default features and --features discord; clippy -D warnings clean under both; fmt --all --check clean.
• End-to-end against a copy of real production data (17 MB DB, 10132 turns / 3758 facts, Python-written tantivy 0.26.0 indexes): fail-fast aborts in ~7 ms with zero mutation; with the gap resolved, startup rebuilds both indexes to exact table parity and proceeds to gateway auth.
• Search-content equivalence: 58 real queries against the rebuilt index vs an independent oracle (the Python familiar_en analyzer chain re-applied over the DB) — exact result-set match on every query; the original index was itself stale (33 orphaned turn docs, 13 live facts missing), so the rebuild is strictly more correct.
• Flake fix: 20/20 single-threaded + 10/10 under full 8-core CPU saturation.

Notes

• Touches the same store.rs init path and run.rs regions as open Streaming leak detection, familiars root migration, and guard audit logging #209 (which removes migrate() per Migration audit #202) — no semantic conflict, but whichever lands second takes a small rebase. Streaming leak detection, familiars root migration, and guard audit logging #209's docs reference rebuild_fts picking up skipped docs; this PR is what wires that behavior up.
• Cross-runtime FTS reuse is symmetrically impossible (Python tantivy also refuses a Rust-written index), so rebuild-from-DB is the durable answer in both directions.

🤖 Generated with Claude Code