feat: install, execute and recover native candidates over dataset-bound SDS - #761

Native candidates over dataset-bound SDS

Backend admits, installs and recovers Planner's native physical candidates, binds them to dataset-scoped SDS, and accepts scoped accuracy evidence. Candidates are still selected by complete provider quotes. ERP and analytical workload costing were split into #786, which follows #728.

Stack: main → #763 → #765 → #761 → #728 → #786 → #780 → #742 → #775. Controls #766 branch from #761; diagnostics #756 branch from #786.

Before this PR

Native TopK computations and stored-state maintenance boundaries did not consistently survive deployment installation and recovery. Accuracy facts could not be scoped to one query, data population and snapshot, so heap and ratio candidates could not be certified.

After this PR

For topk by(job)(1, rate(requests_total[1m])), Planner supplies exact ranking, query-time CMS/CountSketch heap, and fixed-window precomputed heap candidates. Backend binds counter or heap SDS and preserves the supplied operators. The precompute candidate buffers complete timestamped counter states, finalizes each series' Rate, builds a fresh heap, and stores it; query execution reads that heap. It never adds finalized rates across windows.

For sum by(job)(rate(requests_total[1m])), Planner also supplies query-time Sum and precomputed Sum. Both finalize Rate per series before grouping. Complete 60-second windows may overlap at a five-second evaluation cadence; each window is an independent result.

Spatial TopK supports native exact ranking and signed CountSketch heap over the complete current-series snapshot. Arbitrary signed values do not authorize CMS.

Scoped accuracy evidence (quantile operand domains, TopK separation bounds) is bound to the query, data workload, snapshot and validity window. Missing proof leaves a candidate visible but not admissible; composed results (for example a quantile ratio) must satisfy the root accuracy target, not only leaf guarantees.

Installed query and maintenance programs retain typed boundaries. Bound SDS reads validate deployed output and semantic definition, window, generation, encoding and schema. SDS definitions and cost manifests carry the logical dataset identity, so quotes cannot be reused across dataset scopes. Manifests include maintenance programs as well as query programs. Recovery does not re-lower the physical operators.

Validation and scope

• Real-process Remote Write → counter/heap SDS → HTTP → restart tests cover both heap families, counter resets, independent and overlapping windows, hidden/missing series labels and missing windows.
• Candidate tests cover accuracy rejection, quote-driven exact/CMS/CountSketch selection, both physical graphs, and recovery rejection when the maintenance program is missing.
• Full workspace suite (--test-threads=1): all targets pass except three asapquery_compatibility_process_e2e tests (two backend-readiness timeouts and issue_701_702_uncertified_ratios_require_exact_fallback). They fail identically on the pre-split feat: install, execute and recover native candidates over dataset-bound SDS #761 head with ASAP_TEST_TIMEOUT_SCALE=4, so the split did not introduce them. Strict all-target Clippy and rustfmt pass.
• test: assert Level-1 candidate membership and account for every rejection #728's Level-1 tests pass on this branch, confirming they need no ERP costing.

Without workload_cost_evidence, deployment still requires complete quotes, as on the base. Automatic ERP/analytical costing, HLL confidence contracts and ERP accuracy admission are in #786.

Planner #462 pin: 176c1bd565e0c400f9a35996c2bd65de32475e72.

Closes #752. See docs/design_docs/evidence-dependent-candidates.md and docs/design_docs/summary-catalog-sds-architecture.md.

🤖 Generated with Claude Code