fix(wiki): bound lock waits and isolate cache audits

[fishmingyu]

Summary

Close the remaining Wiki-only database hardening gate without adding another storage protocol, backend, constructor option, or public export.

Built-in generation waiters now fail after a bounded acquisition interval, while audit and prewarm dry-run commands inspect a private, pinned SQLite snapshot without creating state beside the source database.

Changes

• Bound each process-local and SQLite generation-lock acquisition to 30 seconds; timeout never transfers ownership or interrupts the current owner.
• Copy a quiescent database through a pinned source descriptor, reject active SQLite transaction sidecars or source changes, and query only the temporary snapshot with immutable read-only SQLite connections.
• Keep dry-run operator retry inspection on cached data instead of entering outline generation.
• Preserve the eight-symbol codenib.storage facade, SQLiteWikiStore(path) constructor, WikiStore protocol, schema, and version 0.2.3 boundary.
• Record the completed S1 gate and add adapter, concurrency, audit, prewarm, and command-entry regressions.
• Lock invariant: successful acquisition is the linearization point. Order is outline/page local, then store, then page evidence, then global retrieval; citation-only work starts at store. Timed-out waiters acquire no ownership, and no owner state survives its context.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Performance improvement
• Tests

Testing

• Tests pass locally
• Added new tests for the changes
• 698 focused Wiki, CLI, storage API, and Web runtime tests passed.
• 6894 non-slow/non-integration tests passed with the environment-only Docker test file excluded; the standard tier reached 3395 passes before stopping because this host has no /usr/bin/docker.
• Repository-pinned Black 24.8.0, isort 5.13.2, flake8 7.1.1, and git diff --check passed.

Checklist

• My code follows the project style guidelines
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings
• Any dependent changes have been merged and published

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T21:59:33.671147Z	cbb0002	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.