fix: Add cancellable style maintenance with verified coverage

[buildingjoshbetter]

Scope

Tracked style-rebuild foundation for #747, stacked on #809 and including the #808/#810 maintenance prerequisites. This draft implements checkpoint A only. Incremental coverage and automatic routing remain required before release or issue closure.

Problem and correction

Legacy style accumulators need a source rebuild, but an untracked synchronous rebuild can block foreground work, publish stale output, or lose the previous generation on cancellation. A private style_vectors adapter now uses the existing maintenance runner and its outer publication transaction.

• Lazily enroll one private checkpoint. Keep the eight public layers and nine public consolidation result keys unchanged.
• Record style algorithm and accumulator provenance. Metadata-only preparation installs three output invalidation triggers; direct profile edits invalidate coverage without advancing source counters.
• Capture source, compute the existing 256-dimensional style algorithm, validate exact source values under writer ownership, then publish profiles, raw sums, hash version and coverage atomically. Unsupported future formats are preserved and rejected.
• Cooperatively cancel capture and computation. Only explicitly owned connections receive a temporary SQLite progress handler, which is removed before commit or rollback. Caller-owned handlers remain untouched.
• Defer only verified cancellation, stale-source or writer-contention cases after safe transaction handling. Unknown SQL errors and ambiguous rollback remain failures. A cancelled SQLite auto-rollback requires evidence from this adapter's actual progress callback.
• Preserve newer invalidation and running diagnostics when restoration is blocked. Initial and per-layer baseline reads handle narrowly identified contention without claiming successful work or restored state.
• Retain the original positional recovery calls for the other eight layers. Existing clustering recovery assertions remain intact.

This draft does not activate automatic style work, rebuild during a getter, reconstruct raw sums from normalized profiles, or change models, dtype, dimensions, rerankers or retrieval limits. Public low-level builders retain their existing SQLite-fenced contract.

Validation

• Root: 35 new focused tests plus 31 existing accumulator tests passed using stdlib and in-memory SQLite.
• Independent review: no blocker, including persistent-writer, cancelled-baseline, stale-restoration, witnessed auto-rollback and all eight legacy positional recovery paths.
• Corrected integration-based candidate: 2,849 passed, 22 skipped, 3 deselected; 2,046 subtests passed, with actual sqlite-vec. Log SHA256: fea826751f4265111487d1fb20aac844559ff4bb8488785d2e0fae93dfb08bfa.
• Exact isolated publication branch: 2,738 passed, 22 skipped, 3 deselected; 1,392 subtests passed, with actual sqlite-vec. Log SHA256: 32f66c4483ed4414ec63c17ce6c413d621dbf2ca71de62423a4c38276552edfa.
• Publication production and new test bytes exactly match the independently reviewed candidate. Documentation conflict resolution preserved both prerequisite sections and the exact 56-line addition.
• Configured Ruff, Python 3.10 grammar, whitespace, scoped new-content privacy and public commit-identity checks passed. Hosted checks are pending.

Earlier failed receipts are retained. A previous revision failed five existing recovery checks after adding a keyword to positional wrappers. This correction narrows the new behavior to style maintenance; it does not weaken those tests. Adversarial review also caught read contention after preparation and distinguished witnessed cancellation from an unexplained lost transaction.

Release requirements and limits

Checkpoint B must advance source coverage atomically with ordinary appends, avoid double counting and prove 75 current appends cause zero extra full style builds. Checkpoint C must route startup, explicit and bulk work through coalesced ownership and report bounded style health. Neither is implemented by this draft.

Synthetic transaction tests establish the scoped correctness properties. They do not establish native latency, memory, MPS or thermal improvement. Only generated synthetic test data was used; no personal memories, transcripts or credentials. No main merge, issue closure or release.